WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,957 Commits 80 Branches 17 Tags
c4c7aa2b13374efdcc64ed7f2d192c8f662a5dc1
Commit Graph
2957 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty c4c7aa2b13 Windows: Remove regression introduced during rebase 2021-10-06 21:44:04 +01:00
Mike Auty aedfd0c54a Windows: Fix up some poolscaner rebase issues 2021-10-06 21:38:32 +01:00
ikelosandGitHub bdd62caa26 Merge pull request #569 from volatilityfoundation/feature/coalese-module-objects 
Core: Change Module to ConfigurableInterface
 2021-10-06 21:04:29 +01:00
ikelosandGitHub 3625bf4bd8 Merge pull request #548 from volatilityfoundation/feature/deprecate-symbol-shift 
Core: Bump API to 2.0.0 and remove symbol_shift
 2021-10-06 21:04:14 +01:00
Mike Auty 8f1c5ee55c Core: Bump API to 2.0.0 and remove symbol_shift 2021-10-06 21:03:40 +01:00
ikelosandGitHub b2c8a4d02f Merge pull request #531 from volatilityfoundation/poolscan_fix_get_object_generator 
[API] fix mutantscan (and possibly others)
 2021-10-06 20:43:25 +01:00
iMHLv2andMike Auty ea335b03ae change return to yield after get_object() turned into a generator in 2da510d8 2021-10-06 20:42:51 +01:00
iMHLv2andMike Auty 2d2a457517 fix pool scanners on some windows versions 
This fixes the size of _POOL_HEADER on 32-bit versions of Windows (was 16, should be 8). Also, get_object() is not doing enough validation and its returning too early. I turned that into a generator so it yields both valid and invalid objects, since the caller does validation anyway. Another way of fixing this is to pass the type_map and cookie from the caller into get_object() so it can do the proper validation and only return valid objects.
 2021-10-06 20:42:48 +01:00
ikelosandGitHub 42e308aed0 Merge pull request #570 from fgomulka/issues/issue_529_driverscan_additional_structures 
[API] Issues/issue 529 driverscan additional structures
 2021-10-06 20:39:21 +01:00
x 3c578aa605 Fix bug in skeleton key check 2021-09-30 15:15:09 +00:00
ikelosandGitHub c6375e2a84 Merge pull request #572 from volatilityfoundation/feature/avml-support 
Feature/avml support
 2021-09-29 02:06:28 +01:00
Mike Auty 88ee6bc7fc Windows: Add better errors for undownloadable pdb 2021-09-26 12:50:07 +01:00
Mike Auty 5fb9444d95 Core: Fix AVML dependency 2021-09-26 10:03:25 +01:00
Mike Auty 151170b3df Core: Add dependency for AVML 2021-09-26 10:03:25 +01:00
Mike Auty 16f5abcdf5 Layers: Improve response if snappy not installed 2021-09-26 10:03:25 +01:00
Mike Auty ca39b20c6d Layers: Implement AVML file support 2021-09-26 10:03:25 +01:00
Mike Auty f8ce367fd5 Layers: Fix segmentation for non-linear and linear 2021-09-26 10:02:54 +01:00
Mike Auty 2dd13d6b4b Revert "Layers: Improve non-linear segmented layers" 
This reverts commit ce5bc3ccd8.

Seems like it broke standard images for some reason, this needs
investigation before it comes back.
 2021-09-26 02:01:07 +01:00
Mike Auty ce5bc3ccd8 Layers: Improve non-linear segmented layers 2021-09-26 01:33:54 +01:00
Frank Gomulka 10a56d7707 Merge branch 'issues/issue_529_driverscan_additional_structures' of github.com:fgomulka/volatility3 into issues/issue_529_driverscan_additional_structures 2021-09-19 16:05:01 -04:00
Frank Gomulka 3919c909bc Comment and Pydoc changes 2021-09-19 16:04:17 -04:00
Frank Gomulka 54203e0253 Add patch for driverscan for windows 7 and earlier 
This patches an issue for some versions of windows that require the
bottom-up approach for finding the size of "object body" by
recognizing additional structures occupying the "object body"
position. The sizes of these additional structures are added to
the size of `_DRIVER_OBJECT` to more accurately compute the actual
size of "object body".
 2021-09-19 16:04:13 -04:00
Mike Auty 95713fc7ac Core: Change Module to ConfigurableInterface 2021-09-19 01:33:10 +01:00
Mike Auty dd35e78dd0 Linux: Fix kmsg plugin 2021-09-19 01:32:39 +01:00
Mike Auty 9e3d1bdc26 Core: Fix module size finding 2021-09-19 01:05:23 +01:00
ikelosandGitHub 1af0c2185d Merge pull request #546 from volatilityfoundation/mac_list_files_infinite_loops 
Fix several code paths that could infinite loop and were triggered ba…
 2021-09-15 20:32:12 +01:00
ikelosandGitHub 8409e2df83 Merge pull request #559 from volatilityfoundation/feature/unify-dtb-selfref-checks 
Feature/unify dtb selfref checks
 2021-09-15 20:25:36 +01:00
ikelosandGitHub cb4cc7805f Merge pull request #563 from NiklasBeierl/doc_list_head 
Doc: list_head.to_list, pslist pid 0
 2021-09-12 14:59:19 +01:00
Mike Auty cc26494b7b Automagic: Don't churn memory as much 2021-09-12 13:21:17 +01:00
Mike Auty 48e802e255 Automagic: Ensure reserved bits are for valid pages 2021-09-12 12:55:42 +01:00
Mike Auty 807662c41f Automagic: Prioritize tests in order 2021-09-12 12:36:35 +01:00
Mike Auty ee2a868c97 Automagic: Windows 32-bit bit 7 is not always 0 2021-09-12 11:35:44 +01:00
Mike Auty 86afc8fb0c Automagic: Actually use reserved_bits 2021-09-08 22:42:58 +01:00
Mike Auty ca047c1fd5 Revert "Automagic: Sort DTB results by test" 
This reverts commit 75feba0099.
 2021-09-08 21:46:35 +01:00
Mike Auty 75feba0099 Automagic: Sort DTB results by test 2021-09-08 21:31:45 +01:00
Mike Auty 76d319c83a Automagic: Improve reserved bit detection for PAE 2021-09-08 20:50:38 +01:00
Niklas Beierl bef1a0f654 Doc: list_head.to_list, pslist pid 0 
Added Documentation for the params of list_head.to_list

Added a comment to linux.pslist explaining why the init task is not yielded.
 2021-09-08 12:04:28 +02:00
Mike Auty 02a1ff31b4 Automagic: Extended the possible DTB locations for Win 11 2021-09-07 09:25:39 +01:00
Mike Auty 4b3fc58c9f Mac: Finish the previous LGTM clean-up 2021-09-06 20:21:29 +01:00
ikelosandGitHub 9908fa54a9 Merge pull request #406 from volatilityfoundation/plugin-zips 
Plugin zips
 2021-09-05 15:51:12 +01:00
Mike Auty 853b0376ce Core: Change zipimporting code 
The previous patch in this branch would allow passing zipfiles
as part of the plugin path list.  Instead, we now traverse any
zipfiles in the plugin directories and load them based on where
they are.  The filenames for the zip files aren't important.
 2021-09-05 15:49:21 +01:00
Mike Auty 10aa2f7620 Core: Support zip files as plugin paths 2021-09-05 15:49:21 +01:00
Mike Auty ced2dbe67d Mac: Remove unused code (LGTM) 2021-09-05 15:44:30 +01:00
Mike Auty 7d7a8e4c2e Linux: Remove unused code (LGTM) 2021-09-05 15:44:12 +01:00
ikelosandGitHub d0a963b070 Merge pull request #557 from volatilityfoundation/issues/issue556 
Windows: Pstree loop protection
 2021-09-05 12:58:58 +01:00
ikelosandGitHub df5df3dbe4 Merge pull request #561 from volatilityfoundation/issues/issue_547_regvaluetype_usage 
Correct usage for RegValueTypes enum
 2021-09-05 12:50:45 +01:00
Mike Auty 17efe7dbdc Windows: Fix issue #385 2021-09-05 12:48:32 +01:00
Mike Auty e9e80035eb Linux: Fixes after the pslist kernel req change 2021-09-04 15:28:57 +01:00
superponible 6492a458db correct usage for RegValueTypes enum 2021-09-03 17:32:57 -05:00
Mike Auty be54de140e Automagic: Better check for bad DTBs 2021-09-03 15:44:36 +01:00