WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-23 14:42:25 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,463 Commits 80 Branches 17 Tags
b07ce5bd383d21423affcedfac2425a90458a7d8
Commit Graph
75 Commits
Author SHA1 Message Date
AsafEitaniandikelos 7ab72a1066 yapf and some corrections 2020-08-31 17:05:20 +01:00
Mike Auty ebad953a74 Windows: Refactor winver to versions. 2020-08-29 10:58:16 +01:00
Mike Auty 6e816c2f20 Windows: Convert os_distinguisher to callable class 2020-08-29 10:58:16 +01:00
Mike Auty 71366cde33 Windows: Refactor the location of os_distinguisher 2020-08-29 10:58:16 +01:00
Janandikelos b816a9972a adds poolscanner support for non-kernel symbols 2020-08-24 19:03:28 +01:00
Janandikelos b82aadeddf bumps version number due to api change, clarifies code 2020-08-24 19:03:28 +01:00
Mike Auty 189b9579c9 Windows: docstring typo 2020-08-22 23:10:44 +01:00
Mike Auty c29c82671a Windows: Further poolscanner fixes before it gets used elsewhere 2020-08-22 23:10:18 +01:00
Mike Auty 482f6a3307 Windows: Ensure all poolscanner API is public 
Remove the "protected" _ since other plugins may want to use it.
At the moment we're the only consumer, so not bumping the version number
of this (since it would be a major version number change), but we'll
need to be careful of this in the future.
 2020-08-22 22:50:14 +01:00
Mike Auty 3014193587 Windows: Fix poolscanner typo 2020-08-22 22:47:51 +01:00
Dave Lassalleandikelos f0bc947bba add a comment about the pool header class type matching the kernel 2020-08-22 22:27:46 +01:00
Dave Lassalleandikelos 09ca2ecb40 issue #306 - _POOL_HEADER class based on OS 2020-08-22 22:27:46 +01:00
Janandikelos e5d51eb9b7 adds dynamic length of pool header alignments 2020-07-17 18:07:23 +01:00
Mike Auty a0da5fef83 Issue #186: Rebase and apply yapf 2020-05-27 23:16:18 +01:00
superponibleandikelos a4301afe22 issue #186 - skip type check on CMHIVE 2020-05-27 23:16:18 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Michael Ligh d5bdf9633d refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type 2020-04-07 09:22:52 -05:00
Mike Auty f34958a16d Poolscanner: Add necessary exception handling. 2019-12-04 22:11:42 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Mike Auty b6d807ff51 Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag 2019-11-27 11:30:14 +00:00
Mike Auty 31ddbaaa2e Typing: Fix python3 format string/byte output issues 2019-11-27 11:30:14 +00:00
Mike Auty b99ace86fb Tidy up exceptions to be more accurate. 2019-11-13 19:58:14 +00:00
Mike Auty 23b14b772a Poolscanner: Fix error in index checking. 2019-11-09 00:17:07 +00:00
Mike Auty 3b656e337a Update windows extensions to ensure they're documented. 2019-10-02 20:25:54 +01:00
Mike Auty 10a379b0ee Make 'import as' consistent and ensure proper plugin dependencies. 2019-10-02 01:25:03 +01:00
Mike Auty 153b3b7d39 Make sure we catch the most general exception for what we mean. 2019-09-27 11:19:53 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty d2b892cf94 Fix up docstring errors in documentation build 2019-09-19 23:00:37 +01:00
Mike Auty 1f9605abf7 Revert "Fix warnings when generated documentation." 
This actually broke autodoc generation and wasn't accurate.  The
documentation warnings may have to stay for now.

This reverts commit 37e13321f9.
 2019-09-17 18:32:44 +01:00
Mike Auty 7efe19224e Make several small typing information fixes. 2019-09-17 18:01:11 +01:00
Mike Auty 03bc3d927d Improve the name of a handles exposed function. 2019-09-08 13:22:42 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00
Mike Auty 9cde94bceb Change the license blurb on all files. 2019-08-27 23:11:00 +01:00
Mike Auty 71bb54379b Refactor the plugin versioning to be simpler to define. 2019-08-27 21:08:29 +01:00
Mike Auty 47c349e240 Add plugin requirements for all plugins. 2019-08-27 21:08:29 +01:00
Mike Auty 37e13321f9 Fix warnings when generated documentation. 2019-08-18 18:30:44 +01:00
Mike Auty 57510803d5 Fix up an issue when removing PoolHeaderSymbolTable. 2019-08-18 01:19:34 +01:00
Mike Auty 1082429aab Don't use a separate symbol table class just to add a class override. 2019-08-17 23:20:46 +01:00
Mike Auty be27aab8ae Refactor symbol to object_type (so it doesn't shadow builtin type). 2019-08-14 20:50:42 +01:00
Mike Auty 5362e2094e Initial attempt at cleaning up the API 
Context.object accepts a template or a string name (and now a type
flag).  Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).

The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
 2019-08-14 20:50:42 +01:00
Mike Auty fbeab3608c Make we raise if the _POOL_HEADER type doesn't exist. 2019-08-08 01:09:56 +01:00
Mike Auty 253ce69fc9 Refactor poolscanner layer to move more into the parallel scanner. 2019-08-07 18:37:56 +01:00
Mike Auty 9ed1a5a5b6 The header is not dependent on the constraint, so only construct it once. 2019-08-07 16:33:13 +01:00
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Mike Auty ef28a9b733 Apparently, it wasn't in 3.5, but it throws type-checking errors 
Python3.6 introduced it, but annoying the type-checker realizes that
we're using it like any int (ie, A | B) and throws a wobbly.  Really
want to see the back of python3.5...

Revert "IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen."

This reverts commit 17a0e1eac8.
 2019-06-28 15:31:59 +01:00
Mike Auty 17a0e1eac8 IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen. 2019-06-28 15:29:40 +01:00
Analystandikelos a90f3ed1a7 fixup an instance of is_windows_7 in poolscanner 2019-05-29 14:46:22 +01:00
Mike Auty 4ff137bc18 Fix up a is_windows_8_or_later call. 2019-05-29 14:46:22 +01:00
Mike Auty 38f249aef2 Change the os-distguisher to make it more flexible. 2019-05-29 14:46:22 +01:00