Gustavo Moreira
bee2a398eb
Linux: Minor: Add comment/header on each set of constants
2024-10-29 15:13:26 +11:00
Gustavo Moreira
bb6dc9a595
Merge branch 'develop' into linux_boottime_support
2024-10-29 14:41:51 +11:00
Gustavo Moreira
57ffd5b939
Linux: Boottime API: Refactor TimespecVol3::negate() to return a new object instead of modifying the original. It also normalizes its values, aligning with the behavior of the other addition and subtraction operators
2024-10-29 14:24:16 +11:00
Gustavo Moreira
c4274c942c
Linux: Fix exception message in TimespecVol3::__sub__()
2024-10-29 13:49:58 +11:00
Gustavo Moreira
4895af47bd
Linux: Boottime timeliner: Rollback timeliner event type changes and use the created time for the boot time plugin
2024-10-29 13:46:19 +11:00
ikelos and GitHub
a1961401d5
Merge pull request #1320 from dgmcdona/dgmcdona/linux_pagecache_missing_iter_implementation
...
Linux: Extensions - removes abc.Iterable definition
2024-10-25 00:35:24 +01:00
David McDonald
4c2d2f98da
Removes collections.abc.Iterable superclass
...
Per @gcmoreira this is the correct fix vs the one previously proposed,
since self.vol.member_name cannot be used as the member name to
iterate this type.
2024-10-24 15:39:15 -05:00
David McDonald
388a3e6458
Linux: Adds missing abc.Iterable implementation
...
`hlist_head` is missing an implementation for
`collections.abc.Iterable`, resulting in a crash at runtime. This fixes
the issue by providing the required `__iter__` implementation for
`hlist_head`.
2024-10-24 14:39:22 -05:00
ikelos and GitHub
62aa9c1e12
Merge pull request #1318 from Abyss-W4tcher/use_volshell_additional_locals
...
Allow to import external locals in volshell environment
2024-10-24 00:05:32 +01:00
Abyss Watcher
7f2d8eabb7
set correct locals priority
2024-10-23 21:39:57 +02:00
Abyss Watcher
708d933021
use additional_locals in run method
2024-10-23 21:23:14 +02:00
ikelos and GitHub
1500d2ecf6
Merge pull request #1314 from gcmoreira/linux_add_hlist_head_object_extension_fix_1313
...
Linux adds hlist_head object extension
2024-10-22 23:21:04 +01:00
Gustavo Moreira
db8667f88a
Linux - Fix hlist_head object extension by dropping the iterator since it can't determine the correct member_name
2024-10-23 08:55:44 +11:00
Mike Auty
65daab6cfa
Linux: Fix minor coding style transgression
2024-10-22 21:47:13 +01:00
ikelos and GitHub
3e6ea7bb0e
Merge pull request #1290 from dgmcdona/dgmcdona/windows-unloadedmodules-traceback
...
Windows: unloadedmodules bugfix
2024-10-22 21:38:31 +01:00
ikelos and GitHub
b0a30c0652
Merge pull request #1238 from gcmoreira/linux_fix_mnt_namespace_issue_1187
...
Linux: Add support for the mount namespace in kernels 6.8+
2024-10-22 21:22:50 +01:00
ikelos and GitHub
51ac7600f5
Merge pull request #1315 from Abyss-W4tcher/rust_type_confusion_warning
...
dwarf2json rust type confusion sanity check
2024-10-22 21:20:22 +01:00
ikelos and GitHub
028502d772
Merge pull request #1288 from gcmoreira/linux_ptrace
...
Add Linux ptrace plugin
2024-10-22 21:11:44 +01:00
Gustavo Moreira
1651ecb1d7
linux: boottime api: Fix explicit returns mixed with implicit (fall through) returns
2024-10-18 13:58:27 +11:00
Gustavo Moreira
d25df2357a
Linux: pslist: Add the boottime plugin
2024-10-18 12:59:23 +11:00
Gustavo Moreira
69512dc991
Linux: pslist: Add creation time column and timeline support to the linux.pslist plugin
2024-10-18 12:58:02 +11:00
Gustavo Moreira
f822468407
linux: Implement boot time support in the Volatility 3 core framework
2024-10-18 12:40:02 +11:00
Gustavo Moreira
18f7f035ee
linux: fix datetime import and remove unused ones
2024-10-18 12:29:09 +11:00
Abyss Watcher
e739d96a33
dwarf2json rust type confusion sanity check
2024-10-14 14:03:38 +02:00
Gustavo Moreira
f00c4c3c39
Allows to create objects when using the same symbol table
2024-10-14 16:35:43 +11:00
Gustavo Moreira
15a51cf1ec
Linux - Add hlist_head object extension. Fix #1313
2024-10-14 16:13:56 +11:00
ikelos and GitHub
7b0cb4facd
Merge pull request #1304 from volatilityfoundation/feature/column-select-cli-only
...
Support hiding columns in the CLI
2024-10-13 22:32:14 +01:00
ikelos and GitHub
d1d45ca22f
Merge pull request #1311 from gcmoreira/linux_threads_support_from_6.7
...
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 22:31:33 +01:00
Gustavo Moreira
e3521147d6
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 09:26:37 +11:00
ikelos and GitHub
a10fb5b4b6
Merge pull request #1308 from dgmcdona/dgmcdona/linux-netfilter-fix
...
Linux: Netfilter - fix traceback on missing module name
2024-10-11 18:28:34 +01:00
David McDonald
fb4dd924ce
Linux: Netfilter - fix traceback on missing module name
...
When the module name can't be found, `None` ends up in this field,
causing a traceback when rendering. This fixes it by replacing `None`
with `renderers.NotAvailableValue()`.
This occurred in the context of a netfilter hook from a hidden module.
2024-10-11 10:15:43 -05:00
Mike Auty
e817e72bc2
Support hiding columns in the CLI
2024-10-08 22:52:44 +01:00
Gustavo Moreira
620dd4e67d
Linux: ptrace: version patch number back to zero
2024-10-08 21:55:21 +11:00
Gustavo Moreira
6b5bef4133
Linux: ptrace: bumping version patch number to re-run the black linter with #1301
2024-10-08 21:27:29 +11:00
ikelos and GitHub
4ffaad5a15
Merge pull request #1301 from gcmoreira/fix_black_stable_version
...
Fix black stable version issue with Python 3.8
2024-10-08 09:42:58 +01:00
Gustavo Moreira
384042202e
fix black stable version issue with Python 3.8
2024-10-08 18:37:32 +11:00
Gustavo Moreira
aa95913940
Linux: ptrace: improve header names and variables
2024-10-08 16:03:36 +11:00
Gustavo Moreira
3c4b9996ce
Linux: ptrace: move tracee TIDs to multiple rows
2024-10-08 16:00:35 +11:00
Gustavo Moreira
eb2d4b1765
Linux: ptrace: add ptrace functions to the task_struct object extension
2024-10-08 15:54:48 +11:00
Gustavo Moreira
f92dfdd33b
Linux: ptrace: remove patch number in plugin requirement
2024-10-08 15:53:07 +11:00
ikelos and GitHub
d1c5fc2ac1
Merge pull request #1299 from volatilityfoundation/1298-printkey-output-confusing-when-key-not-found
...
#1298 - include hive name in key path
2024-10-07 23:19:14 +01:00
ikelos and GitHub
64d55bf1a7
Merge pull request #1209 from dgmcdona/dgmcdona/windows-amcache
...
Windows: Adds Amcache plugin
2024-10-07 23:15:04 +01:00
ikelos and GitHub
5ff06fe1ef
Merge pull request #1272 from volatilityfoundation/816-port-cmdscan-and-console-plugins-from-vol2-to-vol3-please
...
#816 cmdscan and console
2024-10-07 23:13:19 +01:00
ikelos and GitHub
1409f472db
Merge pull request #1297 from volatilityfoundation/1296-sort-volshell-methods-alphabetically
...
refs #1296 sort volshell methods alphabetically in hh() output
2024-10-07 23:07:46 +01:00
ikelos and GitHub
eb74437dbe
Merge pull request #1263 from gcmoreira/linux_lsof_refactoring_fixes_and_improvements
...
Linux: Add support for threads in both lsof and sockstat plugins.
2024-10-07 23:04:24 +01:00
Mike Auty
9addf6bee8
Remove the old .style.yapf
...
This was used before we shifted to black permanently. It allowed
additional spacing between keyword arguments and their default values,
but it was inconsisnent and could get in a state where it would flip
between two weights, so every "fix" would then be "fixed" back again.
No longer feasible for a project of this size.
2024-10-07 22:57:57 +01:00
ikelos and GitHub
5c4e26865d
Merge pull request #1289 from dgmcdona/dgmcdona/linux-dentry-simple-dname
...
Linux: Properly get paths in simple_dname paths
2024-10-07 22:37:16 +01:00
Dave Lassalle
996875c059
#1298 - include hive name in key path
2024-10-07 16:13:12 -05:00
David McDonald
27ea555b37
Add product version to output columns
2024-10-07 13:54:30 -05:00
David McDonald
dec0d506f9
Fix type signature on get_name
2024-10-07 13:54:07 -05:00
Gustavo Moreira