WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-29 03:09:48 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,879 Commits 80 Branches 17 Tags
c8a85e11b2709d2b79ff2fa17e68dcff0660bf33
Commit Graph
3879 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub c8a85e11b2 Merge pull request #995 from xabrouck/dirty 
Check IoC of dirty bit in PTEs from executable VMAs.
 2023-09-03 21:56:25 +01:00
ikelosandGitHub c72129203b Merge pull request #996 from eve-mem/Linux-Change-get_process_memory_sections-to-use-get_vma_iter 
Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels
 2023-09-03 21:41:43 +01:00
Mike Auty b4c6b661f0 Core: Include only volatility3 in distributions packages 
Fixes #951
 2023-09-03 21:13:37 +01:00
xabrouck 6f7f1284ad Fix bug with PAGE_SHIFT that wasn't shifted, also greatly increases performance 
Use black
Better logging
 2023-08-18 11:37:04 +02:00
EveandGitHub 804d68d94d Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels 2023-08-17 13:38:23 +01:00
Mike Auty 581c493f4f Add in action to make old tickets stale. 2023-08-16 21:35:11 +01:00
xabrouck 7c82da4f50 check IoC of dirty bit in PTEs from executable VMAs. 
this can for example detect code injected using ptrace().
this can also detect injected code that was reset to the original code (malware uninstalled before memory dump happened).
 2023-08-14 11:53:14 +02:00
Mike Auty 5d4c70d517 Documentation: Fix requirements -> get_requirements #993 2023-08-03 15:16:36 +01:00
ikelosandGitHub b050b108e4 Merge pull request #988 from xabrouck/avml-fix2 
fix bug in snappy lib loading and make it work on macOS.
 2023-07-27 14:08:35 +01:00
xabrouck a226b90b4d previous commit would break linux snappy support 2023-07-27 09:37:57 +02:00
xabrouck d872abaf30 fix bug in snappy lib loading and make it work on macOS. 2023-07-27 09:28:53 +02:00
ikelosandGitHub 6f71781405 Merge pull request #984 from gcmoreira/linux_capabilities_fixes 
Linux capabilities fixes
 2023-07-20 11:02:56 +01:00
Gustavo Moreira 90da6298e0 Added further details to the kernel_cap_struct::cap comments 2023-07-20 00:29:52 +02:00
Gustavo Moreira 9ba3d9ba4e Several fixes: 
* The capabilities array was to have a 64bit bitwise.
* Capabilities set has to be tested with the kernel maximum. We can't use the plugin capabilities set, otherwise we can have wrong interpretations when we tried to compress the list of capabilities to "all"
* Supports kernels >= 6.3. They changed the kernel_cap_struct::cap type again to a u64 type.
 2023-07-19 22:48:06 +02:00
ikelosandGitHub 373d769690 Merge pull request #978 from volatilityfoundation/feature/parameterized_object_from_symbol 
Core: Add type parameter to object_from_symbol
 2023-07-12 22:17:53 +01:00
ikelosandGitHub 89b6c090b3 Merge pull request #952 from cpuu/mac_pslist 
Add more process information to mac.pslist plugin
 2023-07-12 22:16:55 +01:00
cpuuandGitHub f8fc5d5e58 Update pslist.py 
list modules in code in alphabetical order
 2023-07-12 14:43:38 +09:00
cpuuandGitHub 6907575d77 Merge branch 'volatilityfoundation:develop' into mac_pslist 2023-07-12 14:37:30 +09:00
ikelosandGitHub 74e8582360 Merge pull request #957 from gcmoreira/linux_capabilities 
Linux capabilities plugin
 2023-07-10 07:49:44 +01:00
Gustavo Moreira 42fe37ed52 Adjust docstring to the new retuned type. 2023-07-10 01:12:20 +02:00
Gustavo Moreira 38e9b6baa8 Removed Dict type from the imports 2023-07-10 01:08:46 +02:00
Gustavo Moreira 63c7719763 Fixed returned types. An empty string is now returned when no capability is enabled. 2023-07-10 01:01:30 +02:00
Mike Auty 239e164ce6 Windows: Fix strings plugin missing kernel pages 
@eve-mem spotted that we were only recording the first kernel page in
any contiguous set of kernel pages, thus missing some results.  This
should now be fixed.
 2023-07-09 23:50:13 +01:00
Gustavo Moreira 241cf832f9 Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass. 
Last but not leas, CAP_FULL moved to constants.
 2023-07-10 00:07:40 +02:00
Mike Auty 6c0ce1d130 Volshell: Typo Fixes #958 2023-07-01 20:58:36 +01:00
Mike Auty 66598f5b63 Core: Second fix is the charm... 2023-07-01 19:05:22 +01:00
Mike Auty c8e53ff16a Core: Fix small typing issue in previous patch 2023-07-01 19:02:51 +01:00
Mike Auty 50b5d2232b Core: Add type parameter to object_from_symbol 2023-07-01 19:00:03 +01:00
Mike Auty 1ff2d80b44 Documentation: Update basics - memory layer information 2023-07-01 17:02:10 +01:00
Mike Auty a9698e4e73 Documentation: minor fixes/updates 2023-07-01 17:01:33 +01:00
ikelosandGitHub 5aa0a64cfa Merge pull request #884 from eve-mem/linux_proc_dump 
First attempt at adding a --dump option to linux.proc
 2023-06-18 15:07:19 +01:00
EveandGitHub fa5af08c81 Merge branch 'develop' into linux_proc_dump 2023-06-18 07:34:45 +01:00
ikelosandGitHub e17cb1532b Merge pull request #970 from volatilityfoundation/issues/issue969 
Windows: Fix VAD offset canonicalization
 2023-06-16 19:01:21 +01:00
Mike Auty aa04b8ca3d Windows: Fix VAD offset canonicalization #969 2023-06-16 18:03:07 +01:00
ikelosandGitHub 2e577790d2 Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961 
Fix issue #961: Prevent potential dentry pointer memory smear
 2023-05-30 17:51:05 +01:00
Mike Auty b9e5cfb393 Core: Protect from clearing a non-existant cache 
Issue kindly raised by @garanews, thanks!  5:D
 2023-05-22 15:05:43 +01:00
Gustavo Moreira 0f42f0eaf1 fix typo 2023-05-22 01:39:14 +01:00
Gustavo Moreira bea981180d Prevent potential dentry pointer memory smear 2023-05-22 01:32:00 +01:00
Gustavo Moreira f0bd978716 Fix typo 2023-05-20 12:17:09 +02:00
Gustavo Moreira 4f5ca6116c Add black recommendations 2023-05-17 16:07:56 +01:00
Gustavo Moreira d5d318d3cf Fix wrong constants module 2023-05-17 15:26:24 +01:00
Gustavo Moreira 3d9efc3b34 Added linux capabilities plugin 2023-05-17 14:14:33 +01:00
Mike Auty 8e56cb39d1 Docs: Fix the documentation dependencies 2023-05-10 22:07:38 +01:00
Mike Auty 3f1797f7e5 Core: Change readthedocs build platform 
Fixes #953
 2023-05-10 21:57:59 +01:00
Mike Auty e28b42731e Core: Change readthedocs python version 
Attempting to fix #953
 2023-05-10 21:55:23 +01:00
ikelosandGitHub 2149231bb7 Merge pull request #949 from cpuu/mac-tutorial 
Add tutorial for macOS Analysis
 2023-05-10 11:11:21 +01:00
ikelosandGitHub 534f9be127 Merge pull request #928 from eve-mem/linux_maple_tree 
Add basic support for Linux maple tree struct
 2023-05-10 11:06:44 +01:00
ikelosandGitHub e4db77d20a Merge pull request #942 from gcmoreira/mountinfo_fixes 
Mountinfo fixes
 2023-05-10 11:03:32 +01:00
Gustavo Moreira 7516346b64 Adjust framework versioning 2023-05-10 10:55:19 +02:00
Eve b3c348820f Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/__init__.py 2023-05-10 09:18:05 +01:00