WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 06:42:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,463 Commits 80 Branches 17 Tags
b07ce5bd383d21423affcedfac2425a90458a7d8
Commit Graph
2463 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty b07ce5bd38 Crash64: Add support for type 0x01 to crashdump64 2020-09-23 20:28:23 +01:00
Mike Auty 577c4acec3 Layers: Crash64 improve logging 2020-09-23 20:28:23 +01:00
Mike Auty c4ff2da9be Layers: Fix context cloning infinite loop with crashdumps 2020-09-23 20:28:23 +01:00
Mike Auty 31e251e108 Layers: Initial crashdump64 implementation 2020-09-23 20:28:23 +01:00
iMHLv2andikelos 8baf13d3e3 refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps 2020-09-23 19:27:37 +01:00
memoryforensics1andikelos 9048c04aa4 envars plugin 
parse environment variables
 2020-09-22 20:03:19 +01:00
Mike Auty c436882f4d Windows: Fix up the sids JSON slightly 2020-09-22 19:49:34 +01:00
memoryforensics1andikelos 0f34c82b6c Update privileges.py 2020-09-22 19:49:01 +01:00
memoryforensics1andikelos 004fc1480b Update privileges.py 2020-09-22 19:49:01 +01:00
memoryforensics1andikelos 15bce1ce72 privileges plugin 
added privileges plugin
 2020-09-22 19:49:01 +01:00
Mike Auty f3e77ad645 Windows: Minor typos and JSON name change in sids plugins 2020-09-22 19:38:36 +01:00
memoryforensics1andikelos d1264e0134 Update __init__.py 2020-09-22 18:30:54 +01:00
memoryforensics1andikelos 30be4ee2ec fix get_sids function 
fix get_sids function in broken images
 2020-09-22 18:30:54 +01:00
memoryforensics1andikelos 31080ad416 fix 2020-09-22 18:21:58 +01:00
memoryforensics1andikelos a5d5ff2bda getsids getservicesids 2020-09-22 18:21:58 +01:00
Mike Auty 77312e193a Plugins: Update the banner plugin filename. 2020-09-22 00:25:20 +01:00
Mike Auty 0ac26d40a1 Plugins: Support mac banners as well 2020-09-22 00:21:13 +01:00
Mike Auty 0a57a49572 Plugins: Add LinuxBanners plugin 2020-09-22 00:21:13 +01:00
Andrew Caseandikelos e58e55b433 Update code for better variable names and minor version bump 2020-09-16 17:35:49 +01:00
Andrew Caseandikelos afe39eee1b Add new method for safe walking of generic list heads. Convert pslist to use it. 2020-09-16 17:35:49 +01:00
Mike Auty c82ad2fbd0 Windows: Fix callbacks is_vista_or_later 2020-09-15 01:28:48 +01:00
Andrew Caseandikelos 5e53440b43 Add the socket filters plugin for OSX 2020-09-13 22:06:09 +01:00
Andrew Caseandikelos 23e6516cd3 Add missing commas to cli warnings so they appear across newlines in output 2020-09-13 01:38:57 +01:00
Andrew Caseandikelos 40eafa03e6 Change bad copy/descriptions for Mac that say Linux 2020-09-11 01:37:56 +01:00
Andrew Caseandikelos 98d6844ac0 Address ikelos's review comments 2020-09-11 01:28:14 +01:00
Andrew Caseandikelos 6673d4774c Add cached file listing plugin for Mac 2020-09-11 01:28:14 +01:00
lyles6andikelos 85775239b5 changed back to same format as get_parent 2020-09-10 09:13:31 +01:00
slyles1001andikelos 720f46a962 provides for vadnode and core 2020-09-10 09:13:31 +01:00
Mike Auty 8bf7ab9218 Bugfix: Vadinfo invalid exception 2020-09-10 01:39:10 +01:00
Mike Auty 00dcddbeb8 Framework: Prep master for additional commits 2020-09-10 00:07:00 +01:00
cecioandikelos 6972ae1cc8 in vadinfo.py, modified an exception handling and maxsize comparison 2020-09-08 23:32:54 +01:00
cesareandikelos d74032fd53 Added maxsize option to vadinfo as optional parameter, as in Vol2. 
Right now the default is set to 0 (no limit) as opposed to Vol2 where it is
set to 1GB.
 2020-09-08 23:32:54 +01:00
cecioandikelos 61d4ee3c0e some mods in comments 2020-09-08 22:36:09 +01:00
cecioandikelos 9c5dcda6e9 "pe" imported directly and little modification to comment 2020-09-08 22:36:09 +01:00
cecioandikelos d060a5cbdb dump of processes extracted by psscan (Issue #318) 2020-09-08 22:36:09 +01:00
Mike Auty 6b9ec5a079 Poolscanner: More native_layer validity checks 2020-09-08 02:45:20 +01:00
Mike Auty b04329e2e9 Poolscanner: Ensure File.Buffer checks right layer 2020-09-08 02:23:32 +01:00
Mike Auty 4a8ce9f104 Plugins: Relent on not allow default to be Optional 2020-09-02 11:27:53 +01:00
Mike Auty 752a62a216 Windows: Convert pstree to non-inheritted plugin 2020-09-02 11:13:39 +01:00
Mike Auty 96b68b9cdc Plugins: Don't ever insert an invalid value 2020-09-02 11:13:39 +01:00
memoryforensics1andikelos 37de4d45e7 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 74f1492097 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 2408f26f1f fix, add cross_thread_flags to ETHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6be5716195 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 489dd0cf77 add KTHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6487eb5596 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 8a3ee4f0b7 add token object 
_TOKEN struct added
 2020-09-02 10:52:53 +01:00
Mike Auty 6c3176b32c Linux: Improve lengths for name_as_str 2020-09-01 23:36:21 +01:00
Mike Auty eb02ee1b81 Configuration: Give PluginRequirements simple type values 2020-09-01 15:44:57 +01:00
Mike Auty 7ea2340d31 Automagic: Refactor valid kernels to valid kernel 2020-09-01 09:02:13 +01:00