Gustavo Moreira
c8cb4465da
PR review fixes: Remove filter function, it isn't needed
2024-08-06 23:08:21 -07:00
Gustavo Moreira
339a9a94f5
PR review fixes: pidhashtable plugin add missing typing.
2024-08-06 23:00:09 -07:00
Gustavo Moreira
7df0636f30
PR review fixes: Fix pidhashtable plugin explicit returns mixed with implicit returns
2024-08-06 04:57:33 -07:00
Gustavo Moreira
bd37aa3930
PR review fixes: Fix pidhashtable plugin
2024-08-06 04:48:49 -07:00
Gustavo Moreira
c9eb81c95f
PR review fixes: Improve eBPF extension objects: bpf_prog and added bpf_prog_aux. Apply changes to the EBPF and Sockstat plugins.
2024-08-06 04:40:48 -07:00
ikelos and GitHub
398198042f
Merge branch 'develop' into linux_page_cache
2024-08-04 13:44:37 +01:00
Gustavo Moreira
3e75c2ae9d
Fix @functools.cache . It's available since Python 3.9
2024-08-04 14:40:45 +10:00
Gustavo Moreira
cc04f665e3
Fix inode type
2024-08-03 23:47:28 +10:00
Gustavo Moreira
103537801e
Linux: Add a basic eBPF program enumeration plugin to test and demonstrate using the IDR abstraction
2024-08-03 21:44:38 +10:00
Gustavo Moreira
55212008f8
Linux: Add pidhashtable plugin. This is based on the vol2 plugin, removing ancient kernel support, curating code and enhancing comments, while using the new IDR abstraction included also in this effort.
2024-08-03 21:39:51 +10:00
Gustavo Moreira
ac27d6663a
Linux: Add two page cache plugins, linux.pagecache.Files and linux.pagecache.InodePages
2024-08-03 21:26:29 +10:00
Gustavo Moreira
41684478ad
Linux: Add page cache support, including abstractions like RadixTree, XArray, and IDR, to support both older and latest kernel versions
2024-08-03 21:21:49 +10:00
Gustavo Moreira
a369a9e23c
Linux: dentry object extension: Add a method to walk dentries subdirectories
2024-08-03 21:05:23 +10:00
Gustavo Moreira
231f682b27
Linux: Improve mount's object extension method docstrings
2024-08-03 21:01:59 +10:00
Gustavo Moreira
0dfb9d8a0f
Linux mountinfo: Add a method to yield all filesystem superblocks
2024-08-03 20:57:23 +10:00
Gustavo Moreira
d4ed07f95b
PR review fixes: Add fixme to remember we should move wintime_to_datetime/unixtime_to_datetime out of renderers
2024-08-03 20:51:32 +10:00
ikelos and GitHub
32c8dc50af
Merge pull request #1229 from volatilityfoundation/feature/argcomplete
...
Feature/argcomplete
2024-08-03 10:37:51 +01:00
ikelos and GitHub
eb757b41cc
Merge pull request #1230 from gcmoreira/linux_inode_timespec_timespec64_obj_extensions
...
Linux: Add inode, timespec, and timespec64 object extensions
2024-08-02 10:56:37 +01:00
Gustavo Moreira
ed20834763
PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side.
2024-08-02 19:48:09 +10:00
Gustavo Moreira
d34b1ded3e
PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side.
2024-08-02 19:46:23 +10:00
Gustavo Moreira
933a41fa3a
PR review fixes: Convert inode's is_* functions to properties
2024-08-02 14:22:27 +10:00
Gustavo Moreira
b8d68b9a5e
PR review fixes: Avoid using renderers in core functions.
2024-08-02 14:21:29 +10:00
Gustavo Moreira
efba3a1b73
PR review fixes: Convert inode's is_* functions to properties
2024-08-02 14:17:57 +10:00
Gustavo Moreira
930d29046a
PR review fixes: Avoid using renderers in core functions.
2024-08-02 14:15:01 +10:00
Gustavo Moreira
79529fb815
PR review fixes: Rename method name from private to internal
2024-08-02 13:52:07 +10:00
Gustavo Moreira
1dcaf9c0b1
PR review fixes: Rename method name from private to internal
2024-08-02 13:50:51 +10:00
ikelos and GitHub
af5a743b35
Merge pull request #1219 from qpalzmz112/develop
...
Added psxview plugin
2024-08-02 01:33:59 +01:00
qpalzmz112
98c0094da5
Updated unpacked variable names
2024-08-01 18:51:11 -05:00
qpalzmz112
d19013c852
fixed typo, updated plugin docstring, and updated comment
2024-08-01 16:19:24 -05:00
Mike Auty
0bda154385
Clarify the documentation a little
2024-08-01 21:08:18 +01:00
Mike Auty
e6308a6035
Make suggested changes by gcmoreira
2024-08-01 21:04:24 +01:00
Gustavo Moreira
3017a7d00c
Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them.
2024-08-01 12:23:09 +10:00
Gustavo Moreira
90b8b5340f
Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them.
2024-08-01 11:46:10 +10:00
qpalzmz112
9e8864521c
Added debug log for failed address translation
2024-07-31 18:02:52 -05:00
qpalzmz112
fd6e4bec5c
Updated with feedback from the PR
2024-07-31 17:53:29 -05:00
Mike Auty
d576f8cb48
Fix CodeQL error
2024-07-31 21:49:07 +01:00
Mike Auty
73bc10c283
Wire the argcomplete into volshell too
2024-07-31 21:46:57 +01:00
ikelos and GitHub
16cde44400
Merge pull request #1228 from volatilityfoundation/ldr_fix
...
Remove errant filter on ldrmodule checks
2024-07-30 23:21:57 +01:00
ikelos and GitHub
2743e78481
Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update
...
Windows: Updates netscan with new symbol file
2024-07-30 23:19:56 +01:00
ikelos and GitHub
189f8729e5
Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes
...
Renderers time conversion fixes
2024-07-30 23:08:11 +01:00
ikelos and GitHub
af7466b353
Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix
...
Windows: Fixes bad structure member in callbacks
2024-07-30 22:45:50 +01:00
ikelos and GitHub
4e8d64ed86
Merge pull request #1217 from eve-mem/windows_issue_1146
...
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
2024-07-30 22:38:36 +01:00
ikelos and GitHub
bee333908b
Merge pull request #1221 from volatilityfoundation/issues/issue1216
...
Renderers: Allow BaseAbsentValues in value results
2024-07-30 22:37:42 +01:00
Andrew Case
a84a3706c5
Remove errant filter on ldrmodule checks
2024-07-30 14:00:41 -05:00
David McDonald
56b618f5c3
Windows: Updates netscan with new symbol file
...
`netscan` was missing coverage for Windows 10 Build 20348, causing
owners and create times for `_TCP_ENDPOINTS` to be missing. This adds a
symbol file and the necessary version check in the netscan plugin.
Testing confirms that this returns the correct creation time and owner
process.
2024-07-30 13:04:53 -05:00
Gustavo Moreira
efc48d5831
Make timeliner able to sort aware datetimes. Otherwise, it will raise an exception when comparing the plugin output data with this naive datetime
2024-07-30 17:18:14 +10:00
David McDonald
d97fd777f3
Windows: Bumps netstat module version requirement
...
This is a bump of the version number for the netstat plugin's `modules`
requirement - it didn't get updated after #1173 was merged.
2024-07-29 18:41:57 -05:00
David McDonald
ba7ec00599
Windows: Fixes bad structure member in callbacks
...
This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
2024-07-29 17:55:56 -05:00
Gustavo Moreira
b343734bae
Renderers conversion exceptions fix: Even though the documentation states that OverflowError should be raised starting from version 3.3, it has been observed that ValueError is still being triggered. Also, in Linux, we noticed that OSError is also being raised in some cases.
2024-07-29 15:16:34 +10:00
Gustavo Moreira
ece15c914f
Renderers conversion exceptions fix: Since version 3.3 utcfromtimestamp() and fromtimestamp() Python datimetime module raises OverflowError instead of ValueError. As of today, Volatility3 requires Python 3.7.3 so we should only include OverflowError
2024-07-29 14:18:10 +10:00
Gustavo Moreira