WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,463 Commits 80 Branches 18 Tags
b07ce5bd383d21423affcedfac2425a90458a7d8
Commit Graph
195 Commits
Author SHA1 Message Date
memoryforensics1andikelos d1264e0134 Update __init__.py 2020-09-22 18:30:54 +01:00
memoryforensics1andikelos 30be4ee2ec fix get_sids function 
fix get_sids function in broken images
 2020-09-22 18:30:54 +01:00
lyles6andikelos 85775239b5 changed back to same format as get_parent 2020-09-10 09:13:31 +01:00
slyles1001andikelos 720f46a962 provides for vadnode and core 2020-09-10 09:13:31 +01:00
Mike Auty 6b9ec5a079 Poolscanner: More native_layer validity checks 2020-09-08 02:45:20 +01:00
Mike Auty b04329e2e9 Poolscanner: Ensure File.Buffer checks right layer 2020-09-08 02:23:32 +01:00
memoryforensics1andikelos 37de4d45e7 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 74f1492097 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 2408f26f1f fix, add cross_thread_flags to ETHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6be5716195 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6487eb5596 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
AsafEitaniandikelos 7ab72a1066 yapf and some corrections 2020-08-31 17:05:20 +01:00
Mike Auty 71366cde33 Windows: Refactor the location of os_distinguisher 2020-08-29 10:58:16 +01:00
Janandikelos b82aadeddf bumps version number due to api change, clarifies code 2020-08-24 19:03:28 +01:00
Janandikelos 6b8c9ff024 removes unnecessary enum, incorporates has_valid_member and emphasises max and min year for validation 2020-08-24 19:03:28 +01:00
Janandikelos db04a29185 removes additional TCP state enum 2020-08-24 19:03:28 +01:00
Janandikelos 46b5e29500 adds netscan plugin, network objects extension and symbol JSONs 2020-08-24 19:03:28 +01:00
Dave Lassalleandikelos 09ca2ecb40 issue #306 - _POOL_HEADER class based on OS 2020-08-22 22:27:46 +01:00
Mike Auty 8e420cbe62 Core: Multiple typing fixes across the tree 2020-08-16 22:22:24 +01:00
Mike Auty 31600254b9 Codebase: Apply yapf across the codebase. 2020-07-23 01:31:41 +01:00
Dave Lassalleandikelos 42a97dd10c Registry: handle ints, multi strings, and binary data with StrLike 2020-07-16 19:44:18 +01:00
Mike Auty 9a4669881d Registry: Move StringLike from conversion to StrLike format_hint. 2020-07-16 19:44:18 +01:00
Mike Auty eb90d4e830 Registry: Retain data recovered from registry strings 2020-07-16 19:44:18 +01:00
Mike Auty 5571f19b09 Registry: Move StringLike from conversion to StrLike format_hint. 2020-07-16 19:44:18 +01:00
Mike Auty ee41e7968f Registry: Retain data recovered from registry strings 2020-07-16 19:44:18 +01:00
Michael Lighandikelos 87ff6dd87c refs #200 raise ValueError if an object doesn't have a name 2020-07-01 20:51:22 +01:00
Mike Auty a0da5fef83 Issue #186: Rebase and apply yapf 2020-05-27 23:16:18 +01:00
superponibleandikelos a21ab89019 issue #186 - add bigpools plugin 2020-05-27 23:16:18 +01:00
superponibleandikelos e969f44471 issue #186 - _CMHIVE.is_valid() 2020-05-27 23:16:18 +01:00
Mike Auty 0c43beb42d Core: Apply yapf across all files again. 2020-05-05 22:14:33 +01:00
Michael Lighandikelos 4c7f2a3762 catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes) 2020-02-12 19:19:27 +00:00
Mike Auty 7873a65999 Procdump: Don't loop through twice without good reason. 2020-02-12 19:07:24 +00:00
Mike Auty a3def09a13 Registry: Optimize calls to DataLength and improve documentation. 2020-01-15 22:59:58 +00:00
Mike Auty 83a8afba6b Objects: Simplify get_symbol_table to get_symbol_table_name. 2019-12-04 23:41:27 +00:00
Mike Auty 386f94d9ee Pool: Make object_header type checking the plugin's responsibility. 2019-12-04 22:11:42 +00:00
Mike Auty 8691c68604 Pool: Refactor pool extension to its own file. 2019-12-04 22:11:42 +00:00
Mike Auty 1eea645da0 EPROCESS: Wrap get_peb functions in error handlers 2019-12-04 21:13:19 +00:00
xabiugarteandikelos 35abb343da Raise exception instead of return None 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 3545ab7746 Fixes on pydoc, types, exception catching 2019-12-04 20:02:31 +00:00
xabiugarteandikelos c9520dc37f Remove extra line 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 11d3d304ba Refactor get_peb functionality in EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos a6944f7a06 Add InitOrder and MemOrder functions to EPROCESS 2019-12-04 20:02:31 +00:00
xabiugarteandikelos 949a2a2ddc Change unsigned long long by pointer 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 8da9d90c19 Small fix on EPROCESS is_valid 2019-12-02 13:07:04 +00:00
xabiugarteandikelos 1123ed074d Tiny fix in EPROCESS.is_valid 2019-12-02 13:07:04 +00:00
Mike Auty b0b868d79c Typing: General typing fixes across the tree 2019-11-27 11:30:14 +00:00
Mike Auty b99ace86fb Tidy up exceptions to be more accurate. 2019-11-13 19:58:14 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
Mike Auty 989f08eff2 Revert "EPROCESS: Fix is_valid check missing cast." 
This reverts commit 60eda0a52b.

Turns out, this is pull request #110, only done worse.
 2019-11-09 16:06:30 +00:00
Mike Auty 60eda0a52b EPROCESS: Fix is_valid check missing cast. 2019-11-09 15:56:19 +00:00