WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-01 04:39:03 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,565 Commits 80 Branches 17 Tags
be8b7580dd7eff5f47eec0921859ed2f538ff2b2
Commit Graph
5565 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David McDonaldandAndrew Case be8b7580dd Windows Amcache: Update dependency and change method signature 
This updates the Windows Amcache plugin to use the latest changes in
Windows HiveList. It requires a major version bump of its own due to a
breaking method signature change, and is therefore in its own commit.

Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonaldandAndrew Case 3a7e61b285 Windows Hivelist: Update dependents 
This updates all plugins that depend on windows.hivelist.HiveList to use
the updated method signature, and bumps their dependency version
accordingly.

Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonaldandAndrew Case 6092e3ee0a Windows HiveList: Update list_hives method signature 
Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonald 5cc0ea967f Windows SSDT: Updates plugin consumers 
Updates all plugins that use the `ssdt` module with correct parameters
and updated version requirement values.
 2025-03-05 17:59:38 -06:00
David McDonaldandAndrew Case 9239742b6f Windows SSDT: Simplify build_module_collection signature 
This simplifies the `build_module_collection` signature to take a single
`kernel_module_name` parameter instead of `layer_name` and
`symbol_table_name` parameters, both of which would only ever belong to
the kernel anyway. This will prevent future confusion for consumers of
this method.

Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonaldandAndrew Case 2f016d7403 Windows Modules/Modscan: Clean up APIs 
This cleans up the APIs for some methods in the modscan/modules plugins
that currently take separate symbol_table_name and layer_name
parameters, when it really makes more sense to just pass in the context
and the kernel module name.

It also updates the pslist plugin requirement version, and uses the
updated method signatures.

Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonaldandAndrew Case 5cbc07887c Windows PsList: Add method for listing procs from kernel 
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.

Also updates the documentation to reflect pslist method signature
change.

Co-authored-by: Andrew Case <andrew@dfir.org>
 2025-03-05 17:59:38 -06:00
David McDonald 59919dc1da Windows: Adds GUI plugin 2025-03-05 17:59:38 -06:00
David McDonald 319edbb486 Windows: Adds windows OS version checks 2025-03-05 17:59:38 -06:00
David McDonald b92247fe32 Windows: Adds windows GUI vtypes 2025-03-05 17:59:38 -06:00
ikelosandGitHub caa52c08d3 Merge pull request #1670 from volatilityfoundation/fix_module_enum 
Avoid smear in module enumeration paths
 2025-03-05 23:43:34 +00:00
Andrew Case 437c611cb9 Avoid smear in module enumeration paths 2025-03-05 23:45:38 +00:00
ikelosandGitHub 453b2f6f9e Merge pull request #1664 from volatilityfoundation/fix_psaux_env_decode 
Correctly use decode with replace to avoid backtraces on partially sm…
 2025-03-05 23:42:12 +00:00
ikelosandGitHub 7c17d3b6ea Merge pull request #1669 from volatilityfoundation/fix_node_access 
Prevent backtraces when the node head is smeared
 2025-03-05 23:41:17 +00:00
ikelosandGitHub 96604fb586 Merge pull request #1668 from volatilityfoundation/fix_keyboard_notifiers 
Gracefully terminate the plugin when the keyboard notifier list head …
 2025-03-05 23:40:47 +00:00
ikelosandGitHub 0bea7e2604 Merge pull request #1667 from volatilityfoundation/fix_slot_access 
Ensure slot address is valid inside of array
 2025-03-05 23:40:02 +00:00
ikelosandGitHub be1e933a90 Merge pull request #1666 from volatilityfoundation/elf_parsing_decode_fix 
Properly decode values from ELF files even with partial smear
 2025-03-05 23:39:35 +00:00
ikelosandGitHub 993f664797 Merge pull request #1665 from volatilityfoundation/fix_netfilter 
Prevent backtraces in netfilter due to smear
 2025-03-05 23:38:56 +00:00
Andrew Case 56d7398fe5 Prevent backtraces when the node head is smeared 2025-03-05 23:25:52 +00:00
Andrew Case 3141a741eb Gracefully terminate the plugin when the keyboard notifier list head is paged out 2025-03-05 23:21:21 +00:00
Andrew Case 86fa9d8556 Ensure slot address is valid inside of array 2025-03-05 23:15:14 +00:00
Andrew Case bfab5bfd23 Properly decode values from ELF files even with partial smear 2025-03-05 23:11:37 +00:00
Andrew Case 86ef99f57a Properly decode values from ELF files even with partial smear 2025-03-05 23:10:27 +00:00
Andrew Case e5b0c84532 Prevent backtraces in netfilter due to smear 2025-03-05 23:05:36 +00:00
Andrew Case 6036cbd3e0 Correctly use decode with replace to avoid backtraces on partially smeared strings 2025-03-05 22:42:07 +00:00
ikelosandGitHub ced9e15b0c Merge pull request #1663 from volatilityfoundation/fix_check_idt 
Fix several bugs in IDT verification for Linux
 2025-03-05 22:32:07 +00:00
Andrew Case 4d7f1ea311 Fix several bugs in IDT verification for Linux 2025-03-05 22:33:53 +00:00
ikelosandGitHub 6654ba9446 Merge pull request #1660 from Abyss-W4tcher/bump_ubuntu_runner_to_22_04 
Bump GitHub runner to Ubuntu 22.04
 2025-03-05 21:28:12 +00:00
ikelosandGitHub df097bf4cd Merge pull request #1658 from volatilityfoundation/fix_tty_check 
Correctly check tty instance to avoid backtrace
 2025-03-05 21:15:55 +00:00
ikelosandGitHub d0805b1400 Merge pull request #1657 from volatilityfoundation/useful_error_message 
Report the memer name and type when attributes cannot be found
 2025-03-05 21:14:59 +00:00
ikelosandGitHub 54b70b0fd4 Merge pull request #1654 from volatilityfoundation/fix_vma_iteration 
Fix bugs in Linux memory region enumeration
 2025-03-05 21:09:14 +00:00
ikelosandGitHub b68b6817e8 Merge pull request #1653 from volatilityfoundation/kmsg_fixes 
Fix crash-causing bugs. Add typing where possible.
 2025-03-05 21:07:54 +00:00
Abyss Watcher 22594847d2 ubuntu 20.04 unsupported on 01/04/2025 2025-03-04 17:36:40 +01:00
Abyss Watcher 8b634e49e1 ubuntu 20.04 unsupported on 01/04/2025 2025-03-04 17:25:09 +01:00
Andrew Case d2f16dc0f4 Correctly check tty instance 2025-03-01 15:03:18 -06:00
Andrew Case 8ce77e81eb Report the memer name and type when attributes cannot be found 2025-03-01 14:47:00 -06:00
Andrew Case 57b086295b Fix bugs in Linux memory region enumeration 2025-03-01 14:00:42 -06:00
Andrew Case 89e87ff24c Fix crash-causing bugs. Add typing where possible. 2025-03-01 12:36:40 -06:00
ikelosandGitHub 795b853ad5 Merge pull request #1641 from volatilityfoundation/1639-broken-use-of-cell_datacount 
#1639 - cast big data to _CM_BIG_DATA
 2025-02-27 20:06:13 +00:00
Dave Lassalle a906506736 #1639 - cast big data to _CM_BIG_DATA 2025-02-26 13:25:40 -06:00
ikelosandGitHub 481e93b6fd Merge pull request #1635 from volatilityfoundation/issues/issue1443 
Linux: Fix typing is lsof
 2025-02-25 15:08:27 +00:00
Mike Auty 1c8f9edaf0 Linux: Fix typing is lsof 
Fixes #1443
 2025-02-25 10:15:30 +00:00
ikelosandGitHub d8b8b20bcc Merge pull request #1625 from volatilityfoundation/issues/issue1435 
Windows: Fix console potentially unbound variables
 2025-02-25 09:42:43 +00:00
ikelosandGitHub 1f3c4f24dc Merge pull request #1631 from volatilityfoundation/issues/issue1408 
Issues/issue1408 - Delete partial cache downloads
 2025-02-25 09:40:37 +00:00
ikelosandGitHub 08f47d499c Merge pull request #1630 from volatilityfoundation/issues/issue1629 
Issues/issue1629
 2025-02-25 09:36:39 +00:00
ikelosandGitHub d70c571e6a Merge pull request #1624 from volatilityfoundation/feature/linux_ifconfig_plugin 
Feature/linux ifconfig plugin
 2025-02-25 09:35:09 +00:00
ikelosandGitHub 37bdb6cb99 Merge pull request #1632 from volatilityfoundation/fix_poolscanners 
Check Win10+ SlushSize member to support Windows 11 pool scanning. Re…
 2025-02-23 22:38:32 +00:00
Andrew Case ba56e42634 Fix for black 2025-02-23 22:34:23 +00:00
Andrew Case 335606774d Check Win10+ SlushSize member to support Windows 11 pool scanning. Restrict the Pools that current scanners accept. 2025-02-23 22:30:20 +00:00
Mike Auty 48894dae0c Core: Fix up ruff issue from #1631 2025-02-23 20:56:17 +00:00