ikelos and GitHub
b083549e33
Merge pull request #1393 from gcmoreira/linux_pagecache_dumping_convention_1392
...
Linux: Update inode pagecache plugin to conform to framework dumping convention
2024-12-17 00:17:37 +00:00
ikelos and GitHub
03c3488458
Merge pull request #1070 from vobst/add-sanity-check-find_aslr-linux
...
Linux: add sanity check in `find_aslr`
2024-12-17 00:05:09 +00:00
ikelos and GitHub
2cdc0fea5d
Merge pull request #1406 from j-t-1/intel
...
Remove use of int function after math.ceil
2024-12-16 23:54:37 +00:00
ikelos and GitHub
793039b6a3
Merge pull request #1402 from TheMythologist/develop
...
Refactor: move version `None` check to top
2024-12-16 23:45:07 +00:00
ikelos and GitHub
b037a486b5
Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19
...
Linux - Fix dentry type support for kernels pre 3.19
2024-12-16 23:42:25 +00:00
ikelos and GitHub
dc4eedb3f9
Merge pull request #1403 from j-t-1/text_renderer
...
Tiny change text_renderer.py
2024-12-16 23:30:33 +00:00
ikelos and GitHub
71de86d19d
Merge pull request #1398 from j-t-1/manual
...
Update the CLI manual documentation
2024-12-16 23:25:24 +00:00
Gustavo Moreira
267c5a60c3
Linux: PageCache: Remove unused variable
2024-12-17 10:05:38 +11:00
ikelos and GitHub
d2725b6a00
Merge pull request #1394 from j-t-1/linux
...
Tweak the getting started linux tutorial
2024-12-16 22:46:44 +00:00
ikelos and GitHub
2fd9dd8a52
Merge pull request #1395 from j-t-1/mac
...
Tweak the getting started mac tutorial
2024-12-16 22:45:40 +00:00
ikelos and GitHub
88537066fa
Merge pull request #1396 from j-t-1/windows
...
Tweak the getting started windows tutorial
2024-12-16 22:44:32 +00:00
j-t-1 and GitHub
b37923c183
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 17:08:37 +00:00
j-t-1 and GitHub
02b11b44a2
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 16:59:58 +00:00
Gustavo Moreira
3b0f0915c7
linux: page_cache: add testcase for page_cache.files plugin
2024-12-16 19:36:54 +11:00
Gustavo Moreira
bb1ff69e42
linux: dentry: Fix dentry type support for kernels pre-3.19
2024-12-16 19:25:24 +11:00
j-t-1 and GitHub
c8c39837ab
Tiny change text_renderer.py
2024-12-15 19:26:22 +00:00
TheMythologist
5086be30b2
Refactor: move version None check to top
2024-12-15 14:04:15 +08:00
j-t-1 and GitHub
31492f4ab8
Rectify maximum repetition of verbose flag
...
From four to six (-vvvvvv).
2024-12-14 15:50:50 +00:00
j-t-1 and GitHub
b235ed05b7
Update the CLI manual documentation
2024-12-12 18:50:23 +00:00
j-t-1 and GitHub
d77d696e2b
Tweak the getting started windows tutorial
2024-12-12 17:49:25 +00:00
j-t-1 and GitHub
e31e13f471
Tweak the getting started mac tutorial
2024-12-12 17:44:01 +00:00
j-t-1 and GitHub
6ffef285f4
Tweak the getting started linux tutorial
2024-12-12 17:36:51 +00:00
Gustavo Moreira
9d0cd4b4c9
Linux: PageCache: Update inode plugin to conform to framework dumping convention
2024-12-12 11:17:15 +11:00
Mike Auty
b6717d80d9
Windows: Fix up minor typo and CodeQL warning
2024-12-10 23:55:44 +00:00
ikelos and GitHub
f00b596954
Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls
...
Add detection of direct and indirect system calls
2024-12-10 23:54:02 +00:00
ikelos and GitHub
b8298a345f
Merge pull request #1169 from volatilityfoundation/mftscan_updates_resident_data_plugin
...
Add new resident data displaying plugin. Scan in correct layer. Condense code and remove duplication. Fix bugs
2024-12-09 20:24:27 +00:00
Andrew Case
13eae6c3df
Add capstone to test system requirements. Allow lazy type checks
2024-12-09 13:19:06 -06:00
Andrew Case
af65d7e32d
Address feedback
2024-12-09 13:10:34 -06:00
Andrew Case
e7fca5a83f
Update year
2024-12-09 13:10:34 -06:00
Andrew Case
262c7f1aa7
Make VAD API public as intended
2024-12-09 13:10:34 -06:00
Andrew Case
fce2125a8e
Make VAD API public as intended
2024-12-09 13:10:34 -06:00
Andrew Case
9f8e39efa0
Fix formatting problem between black versions
2024-12-09 13:10:34 -06:00
Andrew Case
e66a3e929b
Add detection of direct and indirect system calls
2024-12-09 13:10:34 -06:00
ikelos and GitHub
ec550232ac
Merge pull request #1388 from eve-mem/issue_1387
...
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:58:40 +00:00
Andrew Case
582feccf93
Address feedback
2024-12-09 12:56:07 -06:00
eve
b86e839718
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:30:19 +00:00
ikelos and GitHub
2ae723513a
Merge pull request #1386 from j-t-1/doc
...
Cosmetic changes to documentation
2024-12-07 17:19:38 +00:00
j-t-1 and GitHub
45f9064623
Cosmetic changes to documentation
2024-12-07 17:11:49 +00:00
j-t-1 and GitHub
e165c78ba7
Cosmetic changes to documentation
2024-12-07 16:37:39 +00:00
j-t-1 and GitHub
04d2554442
Cosmetic changes to documentation
2024-12-07 16:36:18 +00:00
j-t-1 and GitHub
97698cc5ed
Cosmetic changes to documentation
2024-12-07 16:29:58 +00:00
j-t-1 and GitHub
9ebc0bd90d
Cosmetic changes to documentation
2024-12-07 16:20:45 +00:00
Mike Auty
d29c23e922
Windows: Protect against missing _MM_SESSION_SPACE symbol
2024-12-07 15:52:58 +00:00
ikelos and GitHub
78e3ee26a0
Merge pull request #1384 from j-t-1/doc
...
Small documentation changes
2024-12-07 01:04:22 +00:00
j-t-1 and GitHub
93a47e811b
Small documentation changes
2024-12-06 21:52:51 +00:00
j-t-1 and GitHub
846403115a
Small documention changes
2024-12-06 16:00:03 +00:00
ikelos and GitHub
e2cdbdc2bf
Merge pull request #1382 from j-t-1/PYO
...
PEP 488 – Elimination of PYO files
2024-12-06 00:26:21 +00:00
j-t-1 and GitHub
f11ef06c27
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 21:30:20 +00:00
j-t-1 and GitHub
5acf8858d9
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 18:31:04 +00:00
Mike Auty
3ff304ceed
Layers: Fix intel bug introduced in commit 73d4f2f
...
The patch failed to mask the incoming address to the maximum physical
address. This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.
Fixes #1374 .
Thanks to @the-rectifier for quickly identifying the issue!
2024-12-03 19:58:23 +00:00
