WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-17 23:27:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,912 Commits 80 Branches 18 Tags
cb4cc7805f674b135cb2129ffcd3579eb04c8f2e
Commit Graph
2912 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub cb4cc7805f Merge pull request #563 from NiklasBeierl/doc_list_head 
Doc: list_head.to_list, pslist pid 0
 2021-09-12 14:59:19 +01:00
Niklas Beierl bef1a0f654 Doc: list_head.to_list, pslist pid 0 
Added Documentation for the params of list_head.to_list

Added a comment to linux.pslist explaining why the init task is not yielded.
 2021-09-08 12:04:28 +02:00
Mike Auty 4b3fc58c9f Mac: Finish the previous LGTM clean-up 2021-09-06 20:21:29 +01:00
ikelosandGitHub 9908fa54a9 Merge pull request #406 from volatilityfoundation/plugin-zips 
Plugin zips
 2021-09-05 15:51:12 +01:00
Mike Auty 853b0376ce Core: Change zipimporting code 
The previous patch in this branch would allow passing zipfiles
as part of the plugin path list.  Instead, we now traverse any
zipfiles in the plugin directories and load them based on where
they are.  The filenames for the zip files aren't important.
 2021-09-05 15:49:21 +01:00
Mike Auty 10aa2f7620 Core: Support zip files as plugin paths 2021-09-05 15:49:21 +01:00
Mike Auty ced2dbe67d Mac: Remove unused code (LGTM) 2021-09-05 15:44:30 +01:00
Mike Auty 7d7a8e4c2e Linux: Remove unused code (LGTM) 2021-09-05 15:44:12 +01:00
ikelosandGitHub d0a963b070 Merge pull request #557 from volatilityfoundation/issues/issue556 
Windows: Pstree loop protection
 2021-09-05 12:58:58 +01:00
ikelosandGitHub df5df3dbe4 Merge pull request #561 from volatilityfoundation/issues/issue_547_regvaluetype_usage 
Correct usage for RegValueTypes enum
 2021-09-05 12:50:45 +01:00
Mike Auty 17efe7dbdc Windows: Fix issue #385 2021-09-05 12:48:32 +01:00
Mike Auty e9e80035eb Linux: Fixes after the pslist kernel req change 2021-09-04 15:28:57 +01:00
superponible 6492a458db correct usage for RegValueTypes enum 2021-09-03 17:32:57 -05:00
Mike Auty 5d030263ea Windows: Totally revert broken merge issue505-2 2021-09-02 21:50:24 +01:00
Mike Auty 3f0f5fb29c Windows: Reduce the full automagic range *again* 5:\ 2021-09-02 17:05:35 +01:00
ikelosandGitHub 3072a584cb Merge pull request #511 from volatilityfoundation/issues/issue505-2 
Windows: Ensure DTBs don't have all valid entries
 2021-09-02 13:11:41 +01:00
Mike Auty 4634a146c7 Windows: Pstree loop protection 2021-09-02 02:11:32 +01:00
ikelosandGitHub 6b3396f4cc Merge pull request #555 from shu-tom/develop 
Fixed an issue where the symbol file download from the Microsoft site failed
 2021-08-30 13:48:34 +01:00
shusei tomonaga b43712f9f4 Fixed an issue where the PDB guid value was not zero padded. 2021-08-30 21:24:47 +09:00
ikelosandGitHub 7626f60bb4 Merge pull request #526 from volatilityfoundation/feature/linux-mac-repo 
Feature/linux mac repo
 2021-08-30 12:42:59 +01:00
Mike Auty e6547a2d5e Revert "CLI: Verify improvement for buildbot" 
This fix for buildbot didn't seem to have any effect

This reverts commit 57e1243932.
 2021-08-28 00:34:11 +01:00
Mike Auty 57e1243932 CLI: Verify improvement for buildbot 2021-08-27 22:23:33 +01:00
ikelosandGitHub 35713bb6d8 Merge pull request #554 from volatilityfoundation/feature/linux-mac-windows-unify-config 
Feature/linux mac windows unify config
 2021-08-27 22:20:43 +01:00
Mike Auty f082c1c8cc Objects: Fix up pointer caching to default to native layer 2021-08-26 17:25:03 +01:00
Mike Auty b1156fa0a1 Automagic: Remove the superfluous num_entries fields 2021-08-26 16:18:27 +01:00
Mike Auty 1e1b3fda36 Windows: Fix up typo in num_entries parameter 2021-08-26 14:05:53 +01:00
Mike Auty 2371c1158d Windows: Ensure DTBs don't have all valid entries 
We were finding that PAE results were being masked by certain pages with
64bit results.  The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.

As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
 2021-08-26 11:50:04 +01:00
Mike Auty aa1c24e60a Core: Make pointer caching more accurate 2021-08-26 11:43:32 +01:00
ikelosandGitHub 2dda3b4946 Merge pull request #549 from volatilityfoundation/feature/intel-coalesce-by-default 
Layers: Coalesce intel mapping responses
 2021-08-25 16:46:43 +01:00
Mike Auty ece34139db Mac: Standadize on kernel config name 2021-08-25 16:10:55 +01:00
Mike Auty ad3560e1bc Linux: Shift linux plugins to using kernel as their default module 2021-08-25 15:48:53 +01:00
Mike Auty b90fd6bbb2 Automagic: Only traverse down intel layers 2021-08-24 21:59:18 +01:00
Mike Auty 27c5dfdffd Plugins: Add in architectures for ModuleRequirement 
Fixes #553
 2021-08-24 21:47:47 +01:00
ikelosandGitHub 7bf3ac4a41 Merge pull request #551 from volatilityfoundation/feature/windows-kernel-module 
Windows: Update to kernel ModuleRequirement for ease of config
 2021-08-22 12:28:47 +01:00
Mike Auty 97da37d968 Windows: Update to kernel module for ease of config 2021-08-20 00:53:03 +01:00
Mike Auty ab075ac667 Windows: Fix pstree physical/virtual offsets 2021-08-20 00:52:43 +01:00
Mike Auty 0aa59111df Generic: YaraScanner fail on no rules 2021-08-19 23:06:55 +01:00
Mike Auty 260f879334 Core: Fix caching of pointer objects 2021-08-19 15:32:48 +01:00
Mike Auty 98db5e46d4 Windows: Remove hardcoded parameter in poolscanner 2021-08-19 11:12:05 +01:00
Mike Auty db2ec8cfb2 Core: Ensure module configuration is recordable 2021-08-16 16:59:11 +01:00
x ef27d07183 Add missing patch that fixes KERB_ECRYPT structure size 2021-08-13 15:06:48 +00:00
x 70750d2b92 Remove unused variable from plugin 2021-08-12 22:52:08 +00:00
ikelosandGitHub 5f276df35c Merge pull request #484 from volatilityfoundation/skeleton_key_check_plugin 
Skeleton key check plugin
 2021-08-12 23:39:39 +01:00
x d86b9b34e4 Fix return types, change confusing use of continue, switch to get_absolute_symbol_address 2021-08-12 15:47:16 +00:00
Mike Auty 19b2a06964 Layers: Coalesce intel mapping responses 2021-08-11 22:02:08 +01:00
Mike Auty 3ad20d566c Automagic: Minor fixes for jar files and layers 2021-08-11 21:51:41 +01:00
Mike Auty e7623baf45 Linux: Support None to turn off remote banner locations 2021-08-11 21:24:39 +01:00
Mike Auty bb40a8a207 Automagic: Catch remote download exceptions 2021-08-11 21:22:03 +01:00
Mike Auty 3b2aae40d2 Automagic: Support remote banner versioning and chaining 2021-08-11 21:22:03 +01:00
Mike Auty 79b3be4cf6 Automagic: Add in remote banner cache first attempt 2021-08-11 21:22:03 +01:00