Alejandro Diego
cd08cb95fd
Windows: Add filtering by offset to psscan
...
Add capability to the psscan plugin to filter by specific offset.
The filter would be used by other plugins to find specific offset using the psscan capabilities, like find
hidden processes as a result of some dkom for example.
The `--offset` flag argument should represent a physical address space.
The flag is included in the following plugins:
- dlllist
- handles
2024-02-19 13:35:31 -05:00
ikelos and GitHub
3703e119ce
Merge pull request #1084 from volatilityfoundation/feature/table-check
...
Symbols: Add support for metadata verification of symbol tables
2024-02-18 22:19:14 +00:00
ikelos and GitHub
6d34e43667
Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy
...
CLI: Add support for a configuration options file
2024-02-08 12:05:24 +00:00
Mike Auty
7b42ef0a9f
Documentation: Add in more information about overriding configuration values
2024-02-08 11:59:50 +00:00
Mike Auty
a66a446190
CLI: Reblack after updating PR - take 2
2024-02-08 11:16:41 +00:00
Mike Auty
9127509db9
CLI: Reblack after updating PR
2024-02-08 11:13:14 +00:00
ikelos and GitHub
da06d2e55a
Merge branch 'develop' into feature/cli-config-hierarchy
2024-02-08 11:10:28 +00:00
ikelos and GitHub
795477e24b
Merge pull request #1094 from iyassou/feature/windows-truecrypt
...
Windows: add TrueCrypt plugin
2024-02-04 09:28:55 +00:00
Iyassou Shimels
d44c0fef36
run Black formatter
2024-02-04 11:21:14 +03:00
ikelos and GitHub
bee98efd96
Merge pull request #1063 from forensicxlab/feature/IAT
...
Feature: Import Address Table
2024-02-03 23:50:11 +00:00
k1nd0ne
cf9029fd85
Fixing the year in the Copyright
2024-02-04 00:43:33 +01:00
Iyassou Shimels
41cbfbfa34
add license
2024-02-03 11:58:25 +03:00
Iyassou Shimels
ab8ed049a4
Windows: add TrueCrypt plugin
2024-02-03 11:32:00 +03:00
k1nd0ne
130621a2e7
Changing comment when Type error is occuring
2024-02-02 20:04:36 +01:00
ikelos and GitHub
18dd23a6b1
Merge pull request #1076 from ckusek15/windows-pstree
...
Windows: Add additional command line argument info to windows pstree
2024-02-01 11:16:24 +00:00
ikelos and GitHub
9b281c478b
Merge pull request #1071 from hsarkey/hsarkey/windows-malfind
...
Windows: Added '--refined' option to windows malfind plugin
2024-02-01 09:18:41 +00:00
ikelos and GitHub
e436328e88
Merge pull request #1092 from volatilityfoundation/stable
...
Stable
2024-01-31 21:43:57 +00:00
Mike Auty
f95be04305
Documentation: Bump the copyright here to 2024
2024-01-31 21:36:21 +00:00
ikelos and GitHub
d2f7b416de
Merge pull request #1091 from volatilityfoundation/release/v2.5.2
...
Documentation: Update copyright in README.md for 2024
2024-01-31 21:21:20 +00:00
Mike Auty
ba488c78cd
Documentation: Bump the copyright here to 2024
2024-01-31 21:13:00 +00:00
Mike Auty
86b0fd431a
Core: Apply black 24.1.0 across the whole codebase
2024-01-31 21:09:48 +00:00
Mike Auty
7de7dfdabf
Documentation: Update copyright in README.md for 2024
2024-01-31 21:05:00 +00:00
Mike Auty
6d093a4e43
Documentation: Update copyright in README.md for 2024
2024-01-31 21:04:16 +00:00
hsarkey
470c750d82
Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met
2024-01-31 16:00:29 -05:00
ikelos and GitHub
2b15f3fd87
Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan
...
Windows: SvcScan Binary Info
2024-01-30 16:49:18 +00:00
David McDonald
43e8e01daf
Removes unnecessary pass and deindents return stmt
2024-01-30 09:26:17 -06:00
David McDonald
4192e8a711
Fix condition in OsDistinguisher
2024-01-29 00:38:06 -06:00
David McDonald
42c2a86a37
Add logging for when a Services key cannot be retrieved
2024-01-29 00:38:06 -06:00
David McDonald
c517a44cde
Add type hints/casts to _get_service_key method
2024-01-29 00:38:06 -06:00
David McDonald
f5c1bf0f1f
Remove argument that matches default
2024-01-29 00:38:06 -06:00
David McDonald
5541378afe
Create unique config path
2024-01-29 00:38:06 -06:00
David McDonald
4b400b6df6
Refactor out code duplication in OS version checks
2024-01-29 00:38:06 -06:00
David McDonald
86d6b4f724
Bump plugin version
2024-01-29 00:38:06 -06:00
David McDonald
77b0110635
Windows: Fixes svc symbols and OS version detection
...
There were some changes made to the service structures between certain
versions of Windows that caused the PID/binary path to fail to parse
across quite a few samples. This adds the appropriate version detection
logic and updated symbol files to ensure that services are parsed
correctly across Windows versions.
2024-01-29 00:38:06 -06:00
David McDonald
837d3b7b9f
Windows: Add parsing of service binary/dll
...
Parses the binary or dll associated with each service from the Windows
SYSTEM hive and includes it in the output for each service.
2024-01-29 00:38:06 -06:00
Mike Auty
497d291ef4
Windows: Fix black on dumpfiles
2024-01-29 00:07:40 +00:00
ikelos and GitHub
b211dc17b0
Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles
...
Windows: Add regex filtering to dumpfiles
2024-01-28 23:58:16 +00:00
Mike Auty
4dc6f637b0
Core: Apply black 24.1.0 to the whole codebase
2024-01-28 23:50:45 +00:00
Brandon Barnacle
ae5375a622
PR comment changes
...
Change the --regex flag to --filter. Add a check so that --filter
cannot be used with --physaddr or --virtaddr. Change
self.config["filter"] check to check if file_re has been set.
2024-01-26 11:21:16 -05:00
Calvin Kusek
a50ebb6014
Windows: Display additional process info for windows.pstree
2024-01-18 22:25:54 -05:00
hsarkey
ef36cb5a6c
Updated windows.malfind to have a "Notes" column to indicate if a process meets
...
"refined" criteria, which includes common headers like MZ,PE or function
prologues. Fixed black formatting issue.
2024-01-17 17:51:27 -05:00
hsarkey
e6e138f12d
Updated windows.malfind to have a "Notes" column which will indicate if a process
...
meets a "refined criteria", meaning it has a common header type (MZ, PE, or a
function prologue).
2024-01-17 17:24:26 -05:00
hsarkey
4e89040dad
Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead
...
added an additional column called "Notes" to provide info on common headers.
2024-01-17 16:52:16 -05:00
Mike Auty
4b86b9ea89
Plugins: Remove unnecessary variable from windows.mftscan
2024-01-17 20:40:27 +00:00
Mike Auty
01ffcd9634
Core: Fixing None equality test in MapleTree implementation
2024-01-17 20:37:26 +00:00
Mike Auty
614d4d6f2b
Layers: Fix cloudstorage unnecessary import
2024-01-17 20:35:54 +00:00
Mike Auty
269058021d
Plugins: Fix up kmsg code issues
2024-01-17 20:34:39 +00:00
Mike Auty
7c8f4ca4ac
Schemas: As of 6.3.0 we require a producer metadata, not just format
2024-01-14 23:05:12 +00:00
Mike Auty
62366d4f6f
Symbols: Add support for metadata verification of symbol tables
2024-01-14 23:05:10 +00:00
bbarnacle
52dcfb45f4
Windows: Add regex filtering to dumpfiles
...
In volatility2, the windows.dumpfiles plugin allows you to filter the dumped files
using a regular expression. This PR adds the same functionality to volatility3.
The regular expression is passed in using --regex=REGEX and all files matching
REGEX will be dumped. The --ignore-case flag can be passed to make the search
case-insensitive. The search is case-sensitive by default. The matching
volatility2 functionality can be found here:
https://github.com/volatilityfoundation/volatility/blob/a438e768194a9e05eb4d9ee
9338b881c0fa25937/volatility/plugins/dumpfiles.py#L844
Manual testing was performed on windows memory images across different windows
versions to verify the expected output.
2024-01-11 13:24:05 -05:00
Alejandro Diego