Arthur Deierlein
ccd3e8f367
move python version check into its own module
2024-12-17 22:55:39 +01:00
Arthur Deierlein
2119b8c7b8
fix framework/__init__
2024-12-17 22:55:39 +01:00
Arthur Deierlein
c33e378c84
chore(framework/__init__): move up imports
2024-12-17 22:55:39 +01:00
Arthur Deierlein
2e093c1a53
chore(framework/automagic/linux): convert lambda to function
2024-12-17 22:55:38 +01:00
Arthur Deierlein
75a324ddba
chore(developement/schema_validate): move logging import up
2024-12-17 22:55:38 +01:00
Arthur Deierlein
e708a62eef
make ruff happy
2024-12-17 22:55:38 +01:00
Arthur Deierlein
a63ea662f4
apply unsafe fixes (ruff check --unsafe-fixes --fix)
2024-12-17 22:55:38 +01:00
Arthur Deierlein
ad7daafc50
linted with ruff (ruff check . --fix)
2024-12-17 22:55:38 +01:00
Arthur Deierlein
8e9b719a16
use ruff for linting and enforce linting via ci
2024-12-17 22:53:05 +01:00
ikelos and GitHub
ac842bbe74
Merge pull request #1415 from TheMythologist/develop
...
Fix: Error early if no inodes are found in linux.pagecache.InodePages plugin
2024-12-17 19:53:59 +00:00
ikelos and GitHub
068a604a8b
Merge pull request #1397 from j-t-1/library
...
Modify using as a library documentation
2024-12-17 19:36:24 +00:00
ikelos and GitHub
49ad2bdd21
Merge pull request #1422 from dgmcdona/dgmcdona/pedump_contextmanager
...
Windows: PeDump - use contextmanager
2024-12-17 19:35:10 +00:00
j-t-1 and GitHub
6e3defc677
Merge branch 'volatilityfoundation:develop' into library
2024-12-17 19:22:48 +00:00
j-t-1 and GitHub
24e1904376
Modify using as a library documentation
...
Tiny changes.
2024-12-17 19:22:35 +00:00
David McDonald
9ef90c2091
Windows: PeDump - use contextmanager
...
Several tools, including pyright and PyCharm, report that `file_handle`
may be an unbound local. Regardless of whether or not this is likely to
happen in practice, it makes sense to just use a `ContextManager` here
anyway, since `FileHandlerInterface` implements it.
2024-12-17 13:17:27 -06:00
Mike Auty
246d19c0fa
Windows: Fix black issue
2024-12-17 18:14:29 +00:00
Mike Auty
054f0496c1
Windows: Cannot use capstone typing information if capstone didn'tr import
2024-12-17 17:55:52 +00:00
ikelos and GitHub
6c1614de6c
Merge pull request #1414 from gcmoreira/fix_producer_maetadata_bug_introduced_in_1369
...
Fix ProducerMetadata class bug introduced in #1369
2024-12-17 17:48:45 +00:00
TheMythologist
0255151ef5
Fix: Error early if no inodes are found in linux.pagecache.InodePages plugin
2024-12-17 12:15:46 +08:00
Gustavo Moreira
74ff42a12d
Fix ProducerMetadata class bug introduced in #1369
2024-12-17 13:28:57 +11:00
ikelos and GitHub
0b04a138ad
Merge pull request #1389 from dgmcdona/dgmcdona/24H2_handles_pointer_decoding
...
fix(Windows: Handles): Unreliable SAR value on 24H2
2024-12-17 00:20:05 +00:00
ikelos and GitHub
b083549e33
Merge pull request #1393 from gcmoreira/linux_pagecache_dumping_convention_1392
...
Linux: Update inode pagecache plugin to conform to framework dumping convention
2024-12-17 00:17:37 +00:00
ikelos and GitHub
03c3488458
Merge pull request #1070 from vobst/add-sanity-check-find_aslr-linux
...
Linux: add sanity check in `find_aslr`
2024-12-17 00:05:09 +00:00
David McDonald
7299f925dc
Windows: Handles - major version bump
...
Bumps the major version in plugin + dependences after removal of a
publicly exposed instance method.
2024-12-16 17:58:53 -06:00
ikelos and GitHub
2cdc0fea5d
Merge pull request #1406 from j-t-1/intel
...
Remove use of int function after math.ceil
2024-12-16 23:54:37 +00:00
ikelos and GitHub
793039b6a3
Merge pull request #1402 from TheMythologist/develop
...
Refactor: move version `None` check to top
2024-12-16 23:45:07 +00:00
ikelos and GitHub
b037a486b5
Merge pull request #1405 from gcmoreira/fix_dentry_prior_kernels_3.19
...
Linux - Fix dentry type support for kernels pre 3.19
2024-12-16 23:42:25 +00:00
ikelos and GitHub
dc4eedb3f9
Merge pull request #1403 from j-t-1/text_renderer
...
Tiny change text_renderer.py
2024-12-16 23:30:33 +00:00
ikelos and GitHub
71de86d19d
Merge pull request #1398 from j-t-1/manual
...
Update the CLI manual documentation
2024-12-16 23:25:24 +00:00
Gustavo Moreira
267c5a60c3
Linux: PageCache: Remove unused variable
2024-12-17 10:05:38 +11:00
ikelos and GitHub
d2725b6a00
Merge pull request #1394 from j-t-1/linux
...
Tweak the getting started linux tutorial
2024-12-16 22:46:44 +00:00
ikelos and GitHub
2fd9dd8a52
Merge pull request #1395 from j-t-1/mac
...
Tweak the getting started mac tutorial
2024-12-16 22:45:40 +00:00
ikelos and GitHub
88537066fa
Merge pull request #1396 from j-t-1/windows
...
Tweak the getting started windows tutorial
2024-12-16 22:44:32 +00:00
j-t-1 and GitHub
b37923c183
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 17:08:37 +00:00
j-t-1 and GitHub
02b11b44a2
Remove use of int function after math.ceil
...
Return type of math.ceil is already an int.
2024-12-16 16:59:58 +00:00
Gustavo Moreira
3b0f0915c7
linux: page_cache: add testcase for page_cache.files plugin
2024-12-16 19:36:54 +11:00
Gustavo Moreira
bb1ff69e42
linux: dentry: Fix dentry type support for kernels pre-3.19
2024-12-16 19:25:24 +11:00
j-t-1 and GitHub
c8c39837ab
Tiny change text_renderer.py
2024-12-15 19:26:22 +00:00
TheMythologist
5086be30b2
Refactor: move version None check to top
2024-12-15 14:04:15 +08:00
j-t-1 and GitHub
31492f4ab8
Rectify maximum repetition of verbose flag
...
From four to six (-vvvvvv).
2024-12-14 15:50:50 +00:00
David McDonald
e8b3185528
Windows: Handles - New pointer calculation method
...
After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to
be stable as far back as Windows 8. It's also a union, with an
`ObjectPointerBits` member at the same offset as `LowValue` but within a
specific bit range (bit length 44, bit position 20). Taking this value
and shifting it left by four produces the correct pointer. This four-bit
shift is due to 16-byte alignment of object header structures, and is
what we would expect to see with 44-bit pointers in Windows. See
https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/
2024-12-13 10:47:12 -06:00
j-t-1 and GitHub
b235ed05b7
Update the CLI manual documentation
2024-12-12 18:50:23 +00:00
j-t-1 and GitHub
c740a6c770
Modify using as a library documentation
...
Tiny changes.
2024-12-12 18:14:35 +00:00
j-t-1 and GitHub
d77d696e2b
Tweak the getting started windows tutorial
2024-12-12 17:49:25 +00:00
j-t-1 and GitHub
e31e13f471
Tweak the getting started mac tutorial
2024-12-12 17:44:01 +00:00
j-t-1 and GitHub
6ffef285f4
Tweak the getting started linux tutorial
2024-12-12 17:36:51 +00:00
Gustavo Moreira
9d0cd4b4c9
Linux: PageCache: Update inode plugin to conform to framework dumping convention
2024-12-12 11:17:15 +11:00
Mike Auty
b6717d80d9
Windows: Fix up minor typo and CodeQL warning
2024-12-10 23:55:44 +00:00
ikelos and GitHub
f00b596954
Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls
...
Add detection of direct and indirect system calls
2024-12-10 23:54:02 +00:00
David McDonald
a07ee5a0d5
fix(Windows: Handles): Unreliable SAR value on 24H2
...
Handles are not being decoded in 24H2+ samples. This is because the
`Handles._decode_pointer` method grabs the SAR shift value from the
disassemble function, but in these samples this value (`0x11`) is
incorrect. Adding a fallback to the default SAR value of `0x10` if the
obtained pointer is not valid in the kernel address space resolves the
issue.
2024-12-09 18:11:27 -06:00
Arthur Deierlein