WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 13:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,998 Commits 80 Branches 17 Tags
d2ad867d1e422579e3ef024d342bfeb0658a054f
Commit Graph
2998 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira d2ad867d1e my mistake, it should be negated twice to get True when is valid 2021-12-10 13:20:43 +11:00
Gustavo Moreira e1942976bf wrong comparison with None 2021-12-10 13:10:47 +11:00
Gustavo Moreira 8e7aff4ad8 not in please 2021-12-10 13:09:41 +11:00
Gustavo Moreira 36ac92c11c undefined layers module 2021-12-10 13:06:38 +11:00
Gustavo Moreira 17e0b04cb3 undefined glob module 2021-12-10 13:06:15 +11:00
Mike Auty 581251cb05 Linux: Fix long standing typo (thanks to @gcmoreira) 2021-12-08 23:34:53 +00:00
ikelosandGitHub 32ec4afed3 Merge pull request #586 from volatilityfoundation/issues/qemu-speed-up 
Layers: Speed up qemu by not bisecting
 2021-12-08 23:08:32 +00:00
ikelosandGitHub 8f083ed1dd Merge pull request #476 from japhlange/issues/issue474_netscan_win8sp1x64 
adds netstat symbols to Win8x64 ISF files
 2021-12-06 20:10:25 +00:00
Jan 125658ee0d re-adds accidentally deleted file 2021-12-06 21:09:39 +01:00
Jan be4d014f1a improves decision making when to inspect driver pe header based on version_dict 2021-12-06 17:18:39 +01:00
Jan 6cd2d940f3 adds proper version requirement for verinfo 2021-12-06 17:18:38 +01:00
Jan 3aac7b228e adds a few clarifying comments and handles errors better 2021-12-06 17:16:23 +01:00
Jan ee65793fd8 adds new ISF for tcpip.sys 6.3.9600.19935 + distinguisher 2021-12-06 17:16:20 +01:00
Jan 90ad7b1609 reverts pointless createtime offset change 2021-12-06 17:14:40 +01:00
Jan fffb375909 adds netstat symbols to Win8x64 ISF files 2021-12-06 17:14:40 +01:00
Mike Auty 96820e2804 Plugins: Bump skeleton_key_check to 2.0.0 2021-12-03 16:02:06 +00:00
ikelosandGitHub da1216a747 Merge pull request #594 from a5hlynx/develop 
update version to 2.0.0
 2021-12-03 15:58:15 +00:00
a5hlynx 680349016e update version to 2.0.0 2021-12-04 00:29:00 +09:00
Mike Auty f821ac6072 Layers: Comment out unused code in AVML 2021-11-17 20:42:11 +00:00
Mike Auty 8d48faa0d9 Layers: Close file on layer destruction to prevent ResourceWarning 2021-11-17 13:52:25 +00:00
Mike Auty 3cb2bf9fac Core: Fix up python 3.10 support 
Fixes #589
 2021-11-17 13:41:09 +00:00
Mike Auty a1cbea27a8 Layers: Speed up qemu by not bisecting 2021-11-08 22:56:06 +00:00
ikelosandGitHub 23453f5d8c Merge pull request #580 from volatilityfoundation/issues/large-page-fix 
Layers: Fix bug where PAT flag is treated as address
 2021-11-03 19:20:38 +00:00
ikelosandGitHub bcdec8a480 Merge pull request #584 from CaptWake/issue-449 
issue-449 - add --physical flag
 2021-10-27 23:21:50 +01:00
ikelosandGitHub 0c603a20ba Merge pull request #579 from volatilityfoundation/feature/vad-maxsize 
Windows: Set a 100Gb VAD max size for vadinfo
 2021-10-27 23:19:57 +01:00
Mike Auty 20ca165d0f Windows: Lower the vadlimit on MHL's advice 2021-10-27 23:19:30 +01:00
Stefano 6979a6d2ee psscan: Remove usage of PHYSICAL_DEFAULT variable 2021-10-25 17:56:33 +02:00
Stefano 2d3d133c0e issue-449 - add --physical flag 2021-10-24 19:02:14 +02:00
ikelosandGitHub a7ad0dbc0e Merge pull request #582 from garanews/develop 
fix some typo
 2021-10-19 09:02:14 +01:00
garanews 449c2aaddf fix some typo 2021-10-18 14:38:12 +02:00
Mike Auty 2a7831466c Layers: Fix bug where PAT flag is treated as address 2021-10-17 13:29:32 +01:00
Mike Auty 7cac1a98fd Core: Update documentation for RegExScanner 2021-10-13 15:03:17 +01:00
Mike Auty 5f3e519cae Core: Make the regex scanner default to DOTALL 
This will have no impact on the existing core use of the regex scanner,
and therefore does not require a version bump.
 2021-10-13 15:00:27 +01:00
Mike Auty adfb0de187 Windows: Set a 100Gb VAD max size for vadinfo 2021-10-13 14:50:42 +01:00
Mike Auty daef7df46f Windows: Improve PDB scanning regex 
The regular expression for finding PDB signatures didn't have an
apprioriate flag to treat newline characters like normal characters,
meaning that if a newline character occurred between the RSDS header
and the name of the pdb file, the pdb signature would be missed.

Also updated the filenames so that they're escaped, meaning it must be
an actual dot for the extension rather than any character.

Fixes #577
 2021-10-13 14:18:25 +01:00
ikelosandGitHub 2d39dc5a91 Merge pull request #575 from volatilityfoundation/issue_566_dependencies 
refs #566 refactor dependencies
 2021-10-11 11:21:12 +01:00
Mike Auty 472547061c Core: Fix up setup.py documentation 2021-10-11 11:20:48 +01:00
Mike Auty 57b2de3166 Modules: Ensure created modules have distinct config paths 2021-10-07 00:41:26 +01:00
Mike Auty 8d98cb8768 Symbols: Add symbol_masking back in (but not symbol_shift) 2021-10-06 22:56:43 +01:00
Mike Auty c4c7aa2b13 Windows: Remove regression introduced during rebase 2021-10-06 21:44:04 +01:00
Mike Auty aedfd0c54a Windows: Fix up some poolscaner rebase issues 2021-10-06 21:38:32 +01:00
ikelosandGitHub bdd62caa26 Merge pull request #569 from volatilityfoundation/feature/coalese-module-objects 
Core: Change Module to ConfigurableInterface
 2021-10-06 21:04:29 +01:00
ikelosandGitHub 3625bf4bd8 Merge pull request #548 from volatilityfoundation/feature/deprecate-symbol-shift 
Core: Bump API to 2.0.0 and remove symbol_shift
 2021-10-06 21:04:14 +01:00
Mike Auty 8f1c5ee55c Core: Bump API to 2.0.0 and remove symbol_shift 2021-10-06 21:03:40 +01:00
ikelosandGitHub b2c8a4d02f Merge pull request #531 from volatilityfoundation/poolscan_fix_get_object_generator 
[API] fix mutantscan (and possibly others)
 2021-10-06 20:43:25 +01:00
iMHLv2andMike Auty ea335b03ae change return to yield after get_object() turned into a generator in 2da510d8 2021-10-06 20:42:51 +01:00
iMHLv2andMike Auty 2d2a457517 fix pool scanners on some windows versions 
This fixes the size of _POOL_HEADER on 32-bit versions of Windows (was 16, should be 8). Also, get_object() is not doing enough validation and its returning too early. I turned that into a generator so it yields both valid and invalid objects, since the caller does validation anyway. Another way of fixing this is to pass the type_map and cookie from the caller into get_object() so it can do the proper validation and only return valid objects.
 2021-10-06 20:42:48 +01:00
ikelosandGitHub 42e308aed0 Merge pull request #570 from fgomulka/issues/issue_529_driverscan_additional_structures 
[API] Issues/issue 529 driverscan additional structures
 2021-10-06 20:39:21 +01:00
iMHLv2 f92d83f619 add the missing -r 2021-10-06 12:48:52 -05:00
iMHLv2 8ec52c7178 refs #566 refactor dependencies 2021-10-06 12:47:04 -05:00