WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,751 Commits 80 Branches 17 Tags
b15e69e11dad74e5a7ee321b8a3fdfd416dde71b
Commit Graph
2751 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
iMHLv2 b15e69e11d ensure the crashinfo plugin gets a crash layer 2021-06-01 13:55:21 -05:00
iMHLv2 7152ca0ffc refactor load_segments() to fix 32-bit bitmap crashdumps 2021-05-11 15:59:42 -05:00
iMHLv2 00db33e0fe print human readable dump type in crashinfo, along with bitmap header size, bitmap size, and page count 2021-03-31 09:52:12 -05:00
iMHLv2 fb54a2cade report segments in the crash layer with LOGLEVEL_VVVV 2021-03-30 21:23:46 -05:00
iMHLv2 3ebbddbd8d don't save objects in self 
they contain a reference to the context, so if we ever pickle that, then it'll cause a massive recursion loop and fail
 2021-03-30 21:12:32 -05:00
iMHLv2 f5e5fd0060 apply fixes and improvements for crash layer (see description) 
1) Remove empty newlines before the license

2) Remove unused imports

3) Add support for 32-bit Bitmap crash dumps

4) Move _SUMMARY_DUMP to crash_common.json and fix the swapped Pages and BitmapSize offsets

5) Fix other errors in crash64.json (swapped SystemTime vs SystemUpTime, PsActiveProcessHead should be unsigned long long, several incorrect offsets for other members

6) Switched to new volatility3 namespace

7) Reverted required_framework_version to (1, 0, 0)

8) Fixed crashinfo plugin from unpacking the wrong number of values from layer.mapping(). Actually, the plugin no longer displays runs - it shows metadata instead.

9) Address Ikelos' comments in PR #452
 2021-03-30 17:25:32 -05:00
iMHLv2 f4dee3c5f0 sync with fa1c03d of jxwegner/volatility3 2021-03-30 15:27:09 -05:00
Mike Auty f3c3e2c4f9 Windows: Don't try to delete URLs 2021-03-29 17:50:35 +01:00
ikelosandGitHub ef258ec010 Merge pull request #417 from volatilityfoundation/issues/optional-symbol-shift 
Issues/optional symbol shift
 2021-03-21 00:43:04 +00:00
Mike Auty 792fb7080c Symbols: Set symbol_shift default rather than None 
Since all the checks for symbol_shift use essentially "if not
config['symbol_shift']" is doesn't matter whether 0 or None is
returned.  I'd like to test this on an ASLR image, but I think it should
be fine and I'd feel much happier about everything if we could give it a
numeric default.
 2021-03-21 00:21:13 +00:00
Mike Auty 2402a51c60 Symbols: Make the symbol shift optional 
The symbol_shift isn't quite as nice as it could be, because we use None
to demark an unset state, which is different than a value of 0 (because
unset will trip linux to try to identify, whereas 0 will not).

Every where we use the value, we get it from the dictionary and use 0 if
it's not found (essentially forcing a default), but ideally, the default
would be set.  As such, it's safe to set optional to true (and thus not
require it for configuration files), but it's not ideal that the linux
symbol finder can't determine whether to run or not without knowing
whether the value's been intentionally set...
 2021-03-21 00:21:13 +00:00
ikelosandGitHub 6702595ebe Merge pull request #482 from volatilityfoundation/feature/better-strings-checking 
Feature/better strings checking
 2021-03-21 00:13:37 +00:00
ikelosandGitHub de78763e32 Merge pull request #480 from volatilityfoundation/feature/better-version-info 
Windows: Add additional version info finding method
 2021-03-21 00:11:40 +00:00
ikelosandGitHub 63101e6d0a Merge pull request #479 from volatilityfoundation/feature/directory-restructure 
Windows: Group JSON symbols under directories
 2021-03-21 00:10:43 +00:00
ikelosandGitHub 8e420dec41 Merge pull request #481 from volatilityfoundation/feature/version-pdbutility 
Windows: Generalize symbol_table_from_pdb
 2021-03-18 14:42:09 +00:00
Mike Auty ea71cbe9c9 Windows: Fix the verinfo versioning 
This should already have been versioned because it had a classmethod.
Since it wasn't, we can start at (1, 0, 0) but it should only need
framrwork version (1, 0, 0) as well.
 2021-03-17 21:02:55 +00:00
Mike Auty 9c30ed19ef Windows: Deprecate netstat create_tcpip_symbol_table 2021-03-17 20:07:29 +00:00
Mike Auty 8d8b2ea2dd Windows: Fix up hardcoded filename in pdbutil 2021-03-17 15:31:58 +00:00
Mike Auty 180087e746 Windows: Update vadyarascan with compiled file option 2021-03-15 22:58:48 +00:00
Mike Auty 88bddbd596 Windows: Clarify separate yara compiled method 2021-03-15 22:56:40 +00:00
ikelosandGitHub c75bef2b05 Merge pull request #477 from dadokkio/develop 
enable support for compiled rules in Yara
 2021-03-15 22:54:55 +00:00
Mike Auty 05ffab9108 Windows: Make generate_mapping externally visible 2021-03-15 22:39:24 +00:00
Mike Auty 0890a96249 Windows: Check strings file before use 
This will cause the strings plugin to exit early if the strings file has
formatting issues.
 2021-03-15 22:16:49 +00:00
Mike Auty 0a7a749667 Documentation: Add text about banners and isfinfo 2021-03-15 11:15:44 +00:00
Mike Auty 95a9effbe3 Windows: Generalize symbol_table_from_pdb 2021-03-14 23:28:00 +00:00
Mike Auty 970d15a82e Documentation: Document volshell 2021-03-14 21:47:53 +00:00
Mike Auty 4e50402f11 Windows: Add additional version info finding method 2021-03-14 20:17:06 +00:00
Mike Auty f41c75775a Windows: Group JSON symbols under directories 2021-03-14 19:24:45 +00:00
Mike Auty 5d77a7ca6b PDB: Don't bump the version unnecessarily 
The version field of the producer should be enough to determine the
difference
 2021-03-13 18:50:29 +00:00
Mike Auty 638d73b822 PDB: Improve pdb parsing 2021-03-13 15:34:02 +00:00
Mike Auty cdf67cad2b Windows: Cache PDB files again 
Unfortunately, opening the file as a layer will cause it to cache anyway
 2021-03-13 01:50:11 +00:00
dadokkio cd3ad1e067 fix config 2021-03-12 13:09:38 +01:00
Arcuri DavideandGitHub 5c8bd3c9d9 enable support for compiled rules 2021-03-12 11:30:04 +01:00
Mike Auty 5eaa5ef7b2 CLI: Remove unnecessary urllib imports 2021-03-11 15:50:45 +00:00
Mike Auty a9e91ea19b Objects: Writing an object should return the re-read object 2021-03-07 16:08:36 +00:00
Mike Auty 5e01ab811b CLI: Improve URI handling error for windows 2021-03-07 13:08:48 +00:00
Mike Auty 6a6e2a0e5c CLI: Fix and refactor the URI handling code 2021-03-07 13:03:45 +00:00
Mike Auty 01025c88bb CLI: Fixes windows file path handling 
Closes: #470
 2021-03-07 12:44:15 +00:00
ikelosandGitHub 099042ec3d Merge pull request #471 from chop0/patch-1 
Update copyright notice
 2021-03-07 10:50:41 +00:00
Alec PetridisandGitHub 69d303da8c Update copyright notice 2021-03-06 22:44:19 -08:00
Mike Auty 1b57a899e8 Objects: Encode strings as bytes when writing 2021-03-05 01:16:14 +00:00
Mike Auty 62c1d1df35 Layers: Avoid writing to unwritable physical layers 2021-03-05 01:14:44 +00:00
Mike Auty 963b448d36 Objects: Revert setting attributes to write data 2021-03-05 01:13:34 +00:00
Mike Auty f251a1db15 Windows: Update PDB code to work without cache 2021-03-05 01:10:26 +00:00
Mike Auty bc47073903 CLI: Fix logging issue after root logger change 2021-03-05 00:17:09 +00:00
ikelosandGitHub 3fe8e2d4d9 Merge pull request #469 from volatilityfoundation/feature/improved-object-writing 
Objects: Improve writing of objects
 2021-03-04 23:45:14 +00:00
ikelosandGitHub 9ef972192d Merge pull request #468 from volatilityfoundation/feature/improved-typing 
Core: Improve typing across codebase
 2021-03-04 23:36:42 +00:00
Mike Auty a75ccd72b1 Layers: Restore a loss from a rebase/merge 2021-03-04 23:34:04 +00:00
Mike Auty f51b534792 Merge branch 'feature/better-nonexistant-file-handling' into develop 2021-03-04 23:26:07 +00:00
Mike Auty 2fe7e22bf8 CLI: Tidy up single_location handling 2021-03-04 23:25:53 +00:00