WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 18:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,779 Commits 80 Branches 17 Tags
ced6ff346cd8694ed02f835da8bec62f60ff9b56
Commit Graph
3779 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira ced6ff346c Apply 'Black' suggestions 2023-05-08 11:54:48 +02:00
Gustavo Moreira a09f77897b sockstat improvements: 
+ Fixes issues with netlink sockets for older kernels, supporting now kernels < 3.7.10
+ Fixes issue with network namespace id for older kernels.
 2023-05-06 14:21:58 +02:00
Gustavo Moreira 2d922a8cd6 Improves the way the mount points and the namespaces are filtered. 
Previously, it was filtering by mount namespaces id. Even that approach was working as expected, it's not viable for older kernels were there was not a mount namespace ID. With this changes we filtered the mount points individually by the mount ID which is unique system wide, no mather the namespace to which it belongs to.
 2023-05-06 14:18:33 +02:00
Gustavo Moreira 7063e60944 mountinfo improvements: 
+ Fixes issue with repeated path suffixes.
+ Adds support for older kernels (<3.3.8) and
+ Adds a function which simplify the way the framework internally can gets a context and a vmlinux.
This is obtaining the context and symbol space from the same vol object instead of drag a context everywhere.
This changes also affects other plugins such as elfs, malfind and proc.maps.
It also adds doc strings to some of the existent functions.
 2023-05-06 14:12:09 +02:00
Gustavo Moreira b2d33c2cb0 Check if 'mnt_namespace' has the 'ns' member before using it 2023-04-26 00:36:58 +10:00
Gustavo Moreira 33f54f8cf7 Replace LinuxUtilities._do_get_path() with the new mountinfo _do_get_path() avoiding duplicate code. It also fixes issue #930 2023-04-26 00:33:35 +10:00
Mike Auty 900ab70452 Volshell: Mark the script as executable in the repo 2023-04-14 08:08:27 +01:00
Mike Auty ebb74e2f92 Core: Bump the copyright year of the README 2023-04-12 19:57:15 +01:00
ikelosandGitHub 66c37c3945 Merge pull request #898 from volatilityfoundation/feature/xen-coredump-support 
Layers: Add in Xen CoreDump format support
 2023-04-09 14:10:56 +01:00
ikelosandGitHub 467462ea0e Merge pull request #935 from digitalisx/fix/typo 
Fix: typo for `linux.iomem` plugin.
 2023-04-09 14:08:35 +01:00
Donghyun Kim 2e0ecdd770 Fix: typo for linux iomem plugin 2023-04-07 18:04:56 +09:00
ikelosandGitHub 3c31de8847 Merge pull request #934 from volatilityfoundation/issues/issue931 
Automagic: Update clear-cache and do removals first
 2023-04-06 09:22:57 +01:00
ikelosandGitHub 2ed7d0d45c Merge pull request #933 from volatilityfoundation/issues/issue932 
Plugins: Support yara-4.3.0 and above
 2023-04-05 14:12:51 +01:00
Mike Auty f33ea67e86 Automagic: Update clear-cache and do removals first 2023-04-04 23:57:35 +01:00
Mike Auty 41edab2309 Plugins: Support yara-4.3.0 and above 2023-04-04 23:23:27 +01:00
Mike Auty 60292c2da1 Linux: Fix slight issue in envvars renaming 2023-03-29 20:46:06 +01:00
ikelosandGitHub a77a1ae301 Merge pull request #920 from volatilityfoundation/issues/issue886 
Windows: Memoize part of the pool handling code
 2023-03-19 19:29:41 +00:00
Mike Auty d9a365d96f Linux: Rename linux.envars to linux.envvars 2023-03-11 17:33:20 +00:00
Mike Auty 9216bab61b Core: Improve import exception reporting 2023-03-11 17:32:46 +00:00
Mike Auty 46f56770af Core: Pointer is_readable should check the native layer 2023-03-11 15:18:58 +00:00
Mike Auty 36ec516470 Linux: Fix psscan task native_layer 2023-03-11 15:17:24 +00:00
Mike Auty 99417cdfcc Linux: Psscan check parent pointer is valid 2023-03-11 14:17:37 +00:00
Mike Auty b8755ac574 Linux: fix black lint issues 2023-03-08 20:42:24 +00:00
Mike Auty a35afd4f34 Core: Bump framwork version after release branch 2023-03-08 20:40:04 +00:00
ikelosandGitHub 97347efff3 Merge pull request #915 from 0xThiebaut/pstree 
Add PID filtering to `windows.pstree`
 2023-03-08 19:51:48 +00:00
ikelosandGitHub cd2e07da27 Merge pull request #881 from eve-mem/linux_envars 
add linux envars
 2023-03-08 18:59:05 +00:00
ikelosandGitHub f028b0a4dc Merge pull request #894 from eve-mem/linux_iomem 
add linux.iomem plugin based on vol2 plugin by atcuno
 2023-03-08 18:58:35 +00:00
ikelosandGitHub fff64b6071 Merge pull request #921 from eve-mem/linux_psscan 
Fix Linux psscan
 2023-03-08 18:56:16 +00:00
Eve 32db4c0e5f Fix black linting for linux.psscan. 2023-03-08 14:08:44 +00:00
Eve abfe104eb9 Fix linux.pscan to find memory layer to scan using kernel layers dependencies rather than hard coded value. 2023-03-08 14:02:13 +00:00
Eve bdf57f0716 Add extra debug messages to linux.psscan when finding symbol locations 2023-03-08 13:44:08 +00:00
Eve a34fb84976 Fix linux.psscan to use kernel offset when finding symbol location 2023-03-08 13:39:00 +00:00
Mike Auty 21e34ec605 Windows: Fix up double adding the symbol from context.module 2023-03-06 00:43:45 +00:00
Mike Auty f3dea3619c Windows: Memoize part of the pool handling code 2023-03-06 00:14:03 +00:00
Mike Auty 3791b21695 Layers: Fix new snappy implementation error 2023-03-06 00:13:47 +00:00
ikelosandGitHub 56b899e738 Merge pull request #913 from volatilityfoundation/feature/snappy-ctypes 
Feature/snappy ctypes
 2023-03-05 11:35:45 +00:00
Maxime THIEBAUT 588b096254 Add PID filtering to windows.pstree 2023-02-25 20:52:13 +01:00
Mike Auty 1770edf6fa Automagic: Fix typo in cache stats 2023-02-22 17:24:12 +00:00
Mike Auty ad3773d898 Automagic: Improve identified AVML CodeQL issues 2023-02-19 10:23:04 +00:00
Mike Auty c7252e9707 Automagic: Handle snappy for windows. 2023-02-19 10:03:23 +00:00
Mike Auty 471b19b037 Layers: Use ctypes for snappy support 2023-02-18 21:15:43 +00:00
Mike Auty 4734a3d1f8 Automagic: Fix cache issue with missing files 2023-02-18 21:14:02 +00:00
ikelosandGitHub 4f028416a3 Merge pull request #907 from agearhe/patch-1 
Update simple-plugin.rst
 2023-02-10 08:03:05 +00:00
AshleyandGitHub d6ebad8235 Update simple-plugin.rst 
Very minor typo fix.
 2023-02-09 21:19:11 -07:00
ikelosandGitHub 0245988fab Merge pull request #882 from eve-mem/linux_psscan 
add linux.psscan
 2023-02-03 10:51:47 +00:00
Eve 9e5a98ca40 Update linux.psscan with black linting and version 2023-02-03 10:51:18 +00:00
Eve e81935869a Update linux.psscan to find kernel layer name correctly 2023-02-03 10:37:29 +00:00
Eve 4bb6d93e12 Update linux.psscan 2023-02-03 10:18:06 +00:00
ikelosandGitHub 78d75a7b33 Merge pull request #904 from paulkermann/bugfix/csv-escape 
Add escapechar to csvwriter
 2023-02-03 09:46:40 +00:00
Mike Auty aac4c73528 Actions: Bump black checkout to Node16/wqv3 2023-02-03 09:22:30 +00:00