WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,393 Commits 80 Branches 17 Tags
cd7296d64e426efcb06a6e76ddbf4481181bd3f9
Commit Graph
223 Commits
Author SHA1 Message Date
Mike Auty a16fb3bf7d Don't break on validity tests. 2018-12-13 01:16:05 +00:00
Mike Auty 76264cee34 Catch invalid _OBJECT_HEADER objects. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 650a188d51 updates for win8/win10 poolscanning 2018-12-13 01:16:05 +00:00
Mike Auty fa033b8ab7 Back out the symbol_table_name parameter, and provide full symbol names in the constraints. 2018-12-13 01:16:05 +00:00
Mike Auty eacc45dab6 Ensure POOL_HEADER finds the right object in the right symbol table. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4c68da8b06 move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4b0e7e5309 remove the Path column from poolscanner. add File scanning 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d653839359 switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing 2018-12-13 01:16:05 +00:00
Michael Lighandikelos d667a68f97 switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object() 2018-12-13 01:16:05 +00:00
Michael Lighandikelos a76d71a7dc move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00
Mike Auty 8acbe8bba3 Refactor conversion code from objects.utility to a conversion module in renderers. 2018-12-12 23:39:10 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty f57bfa5738 Prepare core plugins for moving into the framework namespace. 2018-12-09 13:32:32 +00:00
Mike Auty 341b9b8f9e Add in initial changes for scanner sections. 2018-12-07 01:47:16 +00:00
Mike Auty 36cc973d6d Fix up minor typo in the plugin help. 2018-11-04 22:43:46 +00:00
Mike Auty e6711f580d Add required poolheader types and change the PoolHeaderSymbolTable to match the inheritted constructor signature. 2018-10-24 19:31:22 +01:00
Mike Auty ff3bae0804 Fix up typing information. 2018-10-14 23:03:58 +01:00
Mike Auty df57ee5045 Fix minor typo in poolscanner logic (thanks mypy!). 2018-10-10 15:32:28 +01:00
Mike Auty e500e87fc6 Add in type annotations for the poolscanner plugin. 2018-10-05 00:20:44 +01:00
Mike Auty d829028a36 Apply various type annotation/bug fixes. 2018-10-05 00:16:42 +01:00
Mike Auty 2943ae1dc6 Fix up another exception gone rogue. 2018-10-04 02:13:40 +01:00
Mike Auty f044569613 Fix up catching the wrong exception type (and the lack of context). 2018-10-04 02:07:33 +01:00
Mike Auty d6b60149a1 Update poolscanner to use the new symbol_table_is_64bit function. 2018-10-03 23:36:54 +01:00
Mike Auty 77a894b224 Convert 64bit checks to a symbol utility function. 2018-10-03 23:36:28 +01:00
Mike Auty 09f12a2126 Add in most of the code required for poolscanning goodness. @imhlv2 to fix the tests. 2018-10-03 22:03:29 +01:00
Mike Auty c0b7376226 Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist. 2018-09-30 17:00:25 +01:00
Mike Auty de3bfad135 Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError. 2018-09-28 12:44:19 +01:00
Mike Auty 569bc97bc2 Fix up the use of native_layer_name in the poolscanning code. 2018-09-16 15:31:50 +01:00
Mike Auty 5add8ea078 Remove the obsolete FIXME. 2018-09-15 15:23:43 +01:00
Michael Lighandikelos fffdd253ae use renderers.NotApplicableValue() for the poolscanner plugin's name field 2018-09-15 15:22:38 +01:00
Mike Auty 0baa0ecdf5 Update the poolscanner to take care of multiple constraints with the same tag. 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 9d6055d2ba add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks 2018-09-15 15:22:38 +01:00
Michael Lighandikelos f02df7a92e reduce the extra tag_type_map lookup by yielding the constraint from the pool scanner 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 5d20faa0a7 work on _POOL_HEADER.get_object() 2018-09-15 15:22:38 +01:00
Michael Lighandikelos be6a351a11 start adding the _POOL_HEADER extension. expand the pool constraints to include processes 2018-09-15 15:22:38 +01:00
Mike Auty ce4ed9fea8 Add in the start of actual output from the poolscanner. 2018-09-15 15:22:38 +01:00
Michael Lighandikelos 56a5012a46 fix alignment, should offset be optional to context.module()? refactor pool type checks 2018-09-15 15:22:38 +01:00
Mike Auty 8a5d3b0c1e Initial poolscanning code. 2018-09-15 15:22:38 +01:00
Mike Auty 00a7f9ce2d Rework the way verinfo works. 2018-09-13 00:24:57 +01:00
Mike Auty 6dc8b4d517 Create a windows.registry category. 2018-09-12 22:55:41 +01:00
Mike Auty 312e74cd08 Improve typing information for verinfo. 2018-09-01 22:14:34 +01:00
Mike Auty 0550186ed2 Fix a couple bugs in moddump. 2018-09-01 22:04:51 +01:00
Mike Auty 9d05482e50 Make sure we appropriately use classmethods now they're in place. 2018-08-30 16:40:39 +01:00
Mike Auty ce63ee2e83 Conver the verinfo plugin to using the classmethod moddump. 2018-08-30 12:03:17 +01:00
Mike Auty edac0bee6f Update moddump to use classmethods. 2018-08-30 12:03:17 +01:00
Mike Auty 5791cfaab7 Stop overriding the builtin filter method, and ensure suitable parameter names. 2018-08-30 11:41:19 +01:00
Mike Auty f4dd40ba0b Ensure we're catching the appropriate expcetions rather than all of them. 2018-08-30 09:41:39 +01:00
superponible 19dcb80de6 catch os detection exception, change loop break to continue 2018-08-29 20:59:42 -05:00
Mike Auty cc99d08c88 Move userassist keys over to a JSON data file. 2018-08-30 00:52:02 +01:00
Mike Auty 93607b2586 Fix up exception catching with no exception specified. 2018-08-30 00:36:32 +01:00