David McDonald
c134dcd643
Windows Timers: Bump patch version
2024-12-17 13:55:34 -06:00
David McDonald
b04ca88d07
Windows Extensions: Fixes type-hint on list_timers
...
This method is incorrectly type-hinted as returning a `Tuple` when it
should be returning an instance of the `KTIMER` extension class. This
leaves the version number as is since it only updates the type-hint, but
let me know if that's incorrect and we need to bump it.
2024-12-17 13:29:51 -06:00
ikelos and GitHub
0b04a138ad
Merge pull request #1389 from dgmcdona/dgmcdona/24H2_handles_pointer_decoding
...
fix(Windows: Handles): Unreliable SAR value on 24H2
2024-12-17 00:20:05 +00:00
ikelos and GitHub
b083549e33
Merge pull request #1393 from gcmoreira/linux_pagecache_dumping_convention_1392
...
Linux: Update inode pagecache plugin to conform to framework dumping convention
2024-12-17 00:17:37 +00:00
ikelos and GitHub
03c3488458
Merge pull request #1070 from vobst/add-sanity-check-find_aslr-linux
...
Linux: add sanity check in `find_aslr`
2024-12-17 00:05:09 +00:00
David McDonald
7299f925dc
Windows: Handles - major version bump
...
Bumps the major version in plugin + dependences after removal of a
publicly exposed instance method.
2024-12-16 17:58:53 -06:00
ikelos and GitHub
2cdc0fea5d
Merge pull request #1406 from j-t-1/intel
...
Remove use of int function after math.ceil
2024-12-16 23:54:37 +00:00
ikelos and GitHub
793039b6a3
Merge pull request #1402 from TheMythologist/develop
...
Refactor: move version `None` check to top
2024-12-16 23:45:07 +00:00
ikelos and GitHub
b037a486b5
Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19
...
Linux - Fix dentry type support for kernels pre 3.19
2024-12-16 23:42:25 +00:00
ikelos and GitHub
dc4eedb3f9
Merge pull request #1403 from j-t-1/text_renderer
...
Tiny change text_renderer.py
2024-12-16 23:30:33 +00:00
ikelos and GitHub
71de86d19d
Merge pull request #1398 from j-t-1/manual
...
Update the CLI manual documentation
2024-12-16 23:25:24 +00:00
Gustavo Moreira
267c5a60c3
Linux: PageCache: Remove unused variable
2024-12-17 10:05:38 +11:00
ikelos and GitHub
d2725b6a00
Merge pull request #1394 from j-t-1/linux
...
Tweak the getting started linux tutorial
2024-12-16 22:46:44 +00:00
ikelos and GitHub
2fd9dd8a52
Merge pull request #1395 from j-t-1/mac
...
Tweak the getting started mac tutorial
2024-12-16 22:45:40 +00:00
ikelos and GitHub
88537066fa
Merge pull request #1396 from j-t-1/windows
...
Tweak the getting started windows tutorial
2024-12-16 22:44:32 +00:00
j-t-1 and GitHub
b37923c183
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 17:08:37 +00:00
j-t-1 and GitHub
02b11b44a2
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 16:59:58 +00:00
Gustavo Moreira
3b0f0915c7
linux: page_cache: add testcase for page_cache.files plugin
2024-12-16 19:36:54 +11:00
Gustavo Moreira
bb1ff69e42
linux: dentry: Fix dentry type support for kernels pre-3.19
2024-12-16 19:25:24 +11:00
j-t-1 and GitHub
c8c39837ab
Tiny change text_renderer.py
2024-12-15 19:26:22 +00:00
TheMythologist
5086be30b2
Refactor: move version None check to top
2024-12-15 14:04:15 +08:00
j-t-1 and GitHub
31492f4ab8
Rectify maximum repetition of verbose flag
...
From four to six (-vvvvvv).
2024-12-14 15:50:50 +00:00
David McDonald
e8b3185528
Windows: Handles - New pointer calculation method
...
After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to
be stable as far back as Windows 8. It's also a union, with an
`ObjectPointerBits` member at the same offset as `LowValue` but within a
specific bit range (bit length 44, bit position 20). Taking this value
and shifting it left by four produces the correct pointer. This four-bit
shift is due to 16-byte alignment of object header structures, and is
what we would expect to see with 44-bit pointers in Windows. See
https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/
2024-12-13 10:47:12 -06:00
j-t-1 and GitHub
b235ed05b7
Update the CLI manual documentation
2024-12-12 18:50:23 +00:00
j-t-1 and GitHub
d77d696e2b
Tweak the getting started windows tutorial
2024-12-12 17:49:25 +00:00
j-t-1 and GitHub
e31e13f471
Tweak the getting started mac tutorial
2024-12-12 17:44:01 +00:00
j-t-1 and GitHub
6ffef285f4
Tweak the getting started linux tutorial
2024-12-12 17:36:51 +00:00
Gustavo Moreira
9d0cd4b4c9
Linux: PageCache: Update inode plugin to conform to framework dumping convention
2024-12-12 11:17:15 +11:00
Mike Auty
b6717d80d9
Windows: Fix up minor typo and CodeQL warning
2024-12-10 23:55:44 +00:00
ikelos and GitHub
f00b596954
Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls
...
Add detection of direct and indirect system calls
2024-12-10 23:54:02 +00:00
David McDonald
a07ee5a0d5
fix(Windows: Handles): Unreliable SAR value on 24H2
...
Handles are not being decoded in 24H2+ samples. This is because the
`Handles._decode_pointer` method grabs the SAR shift value from the
disassemble function, but in these samples this value (`0x11`) is
incorrect. Adding a fallback to the default SAR value of `0x10` if the
obtained pointer is not valid in the kernel address space resolves the
issue.
2024-12-09 18:11:27 -06:00
ikelos and GitHub
b8298a345f
Merge pull request #1169 from volatilityfoundation/mftscan_updates_resident_data_plugin
...
Add new resident data displaying plugin. Scan in correct layer. Condense code and remove duplication. Fix bugs
2024-12-09 20:24:27 +00:00
Andrew Case
13eae6c3df
Add capstone to test system requirements. Allow lazy type checks
2024-12-09 13:19:06 -06:00
Andrew Case
af65d7e32d
Address feedback
2024-12-09 13:10:34 -06:00
Andrew Case
e7fca5a83f
Update year
2024-12-09 13:10:34 -06:00
Andrew Case
262c7f1aa7
Make VAD API public as intended
2024-12-09 13:10:34 -06:00
Andrew Case
fce2125a8e
Make VAD API public as intended
2024-12-09 13:10:34 -06:00
Andrew Case
9f8e39efa0
Fix formatting problem between black versions
2024-12-09 13:10:34 -06:00
Andrew Case
e66a3e929b
Add detection of direct and indirect system calls
2024-12-09 13:10:34 -06:00
ikelos and GitHub
ec550232ac
Merge pull request #1388 from eve-mem/issue_1387
...
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:58:40 +00:00
Andrew Case
582feccf93
Address feedback
2024-12-09 12:56:07 -06:00
eve
b86e839718
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:30:19 +00:00
ikelos and GitHub
2ae723513a
Merge pull request #1386 from j-t-1/doc
...
Cosmetic changes to documentation
2024-12-07 17:19:38 +00:00
j-t-1 and GitHub
45f9064623
Cosmetic changes to documentation
2024-12-07 17:11:49 +00:00
j-t-1 and GitHub
e165c78ba7
Cosmetic changes to documentation
2024-12-07 16:37:39 +00:00
j-t-1 and GitHub
04d2554442
Cosmetic changes to documentation
2024-12-07 16:36:18 +00:00
j-t-1 and GitHub
97698cc5ed
Cosmetic changes to documentation
2024-12-07 16:29:58 +00:00
j-t-1 and GitHub
9ebc0bd90d
Cosmetic changes to documentation
2024-12-07 16:20:45 +00:00
Mike Auty
d29c23e922
Windows: Protect against missing _MM_SESSION_SPACE symbol
2024-12-07 15:52:58 +00:00
ikelos and GitHub
78e3ee26a0
Merge pull request #1384 from j-t-1/doc
...
Small documentation changes
2024-12-07 01:04:22 +00:00
David McDonald