WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,368 Commits 80 Branches 17 Tags
d34b1ded3e673e2d311d14c8e104668d7ebac78c
Commit Graph
4368 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira d34b1ded3e PR review fixes: Remove get_inode_number. It's better to use the type's original member name and handle the casting on the consumer side. 2024-08-02 19:46:23 +10:00
Gustavo Moreira efba3a1b73 PR review fixes: Convert inode's is_* functions to properties 2024-08-02 14:17:57 +10:00
Gustavo Moreira 930d29046a PR review fixes: Avoid using renderers in core functions. 2024-08-02 14:15:01 +10:00
Gustavo Moreira 1dcaf9c0b1 PR review fixes: Rename method name from private to internal 2024-08-02 13:50:51 +10:00
Gustavo Moreira 90b8b5340f Linux: Add inode, timespec, and timespec64 object extensions to support different kernel versions, ensuring we will get aware datetimes when using them. 2024-08-01 11:46:10 +10:00
ikelosandGitHub 16cde44400 Merge pull request #1228 from volatilityfoundation/ldr_fix 
Remove errant filter on ldrmodule checks
 2024-07-30 23:21:57 +01:00
ikelosandGitHub 2743e78481 Merge pull request #1227 from dgmcdona/dgmcdona/windows-netscan-update 
Windows: Updates netscan with new symbol file
 2024-07-30 23:19:56 +01:00
ikelosandGitHub 189f8729e5 Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes 
Renderers time conversion fixes
 2024-07-30 23:08:11 +01:00
ikelosandGitHub af7466b353 Merge pull request #1224 from dgmcdona/dgmcdona/windows-callback-symbol-fix 
Windows: Fixes bad structure member in callbacks
 2024-07-30 22:45:50 +01:00
ikelosandGitHub 4e8d64ed86 Merge pull request #1217 from eve-mem/windows_issue_1146 
Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var
 2024-07-30 22:38:36 +01:00
ikelosandGitHub bee333908b Merge pull request #1221 from volatilityfoundation/issues/issue1216 
Renderers: Allow BaseAbsentValues in value results
 2024-07-30 22:37:42 +01:00
Andrew Case a84a3706c5 Remove errant filter on ldrmodule checks 2024-07-30 14:00:41 -05:00
David McDonald 56b618f5c3 Windows: Updates netscan with new symbol file 
`netscan` was missing coverage for Windows 10 Build 20348, causing
owners and create times for `_TCP_ENDPOINTS` to be missing. This adds a
symbol file and the necessary version check in the netscan plugin.
Testing confirms that this returns the correct creation time and owner
process.
 2024-07-30 13:04:53 -05:00
Gustavo Moreira efc48d5831 Make timeliner able to sort aware datetimes. Otherwise, it will raise an exception when comparing the plugin output data with this naive datetime 2024-07-30 17:18:14 +10:00
David McDonald d97fd777f3 Windows: Bumps netstat module version requirement 
This is a bump of the version number for the netstat plugin's `modules`
requirement - it didn't get updated after #1173 was merged.
 2024-07-29 18:41:57 -05:00
David McDonald ba7ec00599 Windows: Fixes bad structure member in callbacks 
This fixes a bug in the x64 callbacks symbols. The `NotificationRoutine`
is currently an `unsigned int` instead of a void pointer. This prevents
the correct mapping of the notification routine to the kernel module
that contains it.
 2024-07-29 17:55:56 -05:00
Gustavo Moreira b343734bae Renderers conversion exceptions fix: Even though the documentation states that OverflowError should be raised starting from version 3.3, it has been observed that ValueError is still being triggered. Also, in Linux, we noticed that OSError is also being raised in some cases. 2024-07-29 15:16:34 +10:00
Gustavo Moreira ece15c914f Renderers conversion exceptions fix: Since version 3.3 utcfromtimestamp() and fromtimestamp() Python datimetime module raises OverflowError instead of ValueError. As of today, Volatility3 requires Python 3.7.3 so we should only include OverflowError 2024-07-29 14:18:10 +10:00
Gustavo Moreira 76414d3246 Renderers conversion fix: Create aware datetimes to represent times in UTC. Fix Python 3.12 datetime.utcfromtimestamp() deprecation. 
See warning note on https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp:

Because naive datetime objects are treated by many datetime methods as local times, it is preferred to use aware datetimes to represent times in UTC. As such, the recommended way to create an object representing a specific timestamp in UTC is by calling datetime.fromtimestamp(timestamp, tz=timezone.utc).

Additionaly, datetime.utcfromtimestamp() is deprecated since 3.12
 2024-07-29 14:13:54 +10:00
Mike Auty b659a060bd Renderers: Ensure the version is bumped so plugins can require the format_hints properly 2024-07-28 21:57:48 +01:00
Mike Auty 0d8fb76b3a Renderers: Allow BaseAbsentValues in value results 
Fixes #1216
 2024-07-28 19:57:23 +01:00
ikelosandGitHub 438fc79c8c Merge pull request #1197 from eve-mem/issue_1040 
Windows: remove size from filescan output as it is not the file size
 2024-07-26 10:03:50 +01:00
Eve 7a03e9deab Windows: Add a _version to the filescan plugin 2024-07-25 18:21:12 +01:00
Eve 799afe6e51 Windows: fix type in handles plugin 2024-07-25 18:02:30 +01:00
Eve 6f3f645dbc Windows: update handles plugin sar warnings to use DEFAULT_SAR_VALUE var 2024-07-25 17:59:10 +01:00
ikelosandGitHub 05aa81b63c Merge pull request #1214 from eve-mem/windows_issue_1146 
Windows: update handles plugin to use a default SAR value of 0x10
 2024-07-24 22:11:42 +01:00
ikelosandGitHub 19e1c21cbb Merge pull request #1207 from volatilityfoundation/issues/fix-generator-inheritance 
Add in threads that only provides an implmentation method
 2024-07-24 21:04:36 +01:00
Mike Auty f4cbed856b Fix up missing filter parameter 2024-07-24 20:47:05 +01:00
Mike Auty e1065f9e78 Fix up a missing super which @atcuno spotted 2024-07-24 20:32:36 +01:00
Eve 7d52f7992d Windows: Make the default sar value used in handles plugin a variable so if it needs to be changed it gets updated in one place only 2024-07-24 11:06:26 +01:00
Eve b8b146a444 Windows: update handles plugin to use a default SAR value of 0x10 if decoding fails. Produce warnings when this happens. Ref issue #1147 2024-07-24 10:59:52 +01:00
Mike Auty 5e96327cb0 Add in threads that only provides an implmentation method 2024-07-21 22:58:43 +01:00
ikelosandGitHub 721971652c Merge pull request #1168 from volatilityfoundation/svcdiff_malware_detection 
Add svclist and svcdiff plugins. Make svcscan more modular to support…
 2024-07-21 18:37:49 +01:00
Andrew Case 111873e173 Fix class vs static method and leading underscores 2024-07-21 11:54:06 -05:00
Andrew Case 21396185d0 Address feedback 2024-07-21 11:10:38 -05:00
ikelosandGitHub fba7255b23 Merge pull request #1204 from volatilityfoundation/pedump_v2 
Add pedump plugin and unified API for extracting PE files to disk
 2024-07-21 17:05:42 +01:00
Andrew Case 9454181b98 Address feedback 2024-07-21 09:42:19 -05:00
ikelosandGitHub 5645c4ff4b Merge pull request #1167 from volatilityfoundation/process_ghosting 
Add processghosting plugin to detect process ghosting and related tec…
 2024-07-21 13:31:35 +01:00
ikelosandGitHub be10469702 Merge pull request #1202 from dgmcdona/dgmcdona/windows-shimcachemem 
Windows: ShimcacheMem
 2024-07-21 13:21:45 +01:00
ikelosandGitHub d494df2673 Merge pull request #1201 from volatilityfoundation/issues/issue1200 
Windows: Fix vadyarascan sanity check and bad documentation
 2024-07-21 13:11:51 +01:00
ikelosandGitHub 6043e740ca Merge pull request #1177 from volatilityfoundation/118-missing-plugins-threads-timers 
118 missing plugins threads timers
 2024-07-21 12:03:18 +01:00
ikelosandGitHub 7aa509b92b Merge pull request #1186 from volatilityfoundation/userassist_timeline 
Add timeliner support to userassist
 2024-07-21 12:00:27 +01:00
atcuno 12f3beacfc Add dedicated plugin and API for extracting PE files from kernel and process memory 2024-07-18 17:56:24 -05:00
atcuno 75ccf1bfab Add dedicated plugin and API for extracting PE files from kernel and process memory 2024-07-18 17:54:33 -05:00
atcuno 920b3ec615 Black fix 2024-07-18 15:48:21 -05:00
atcuno b0a89f2109 Address feedback 2024-07-18 15:47:37 -05:00
atcuno 2a5e94a094 Black fixes 2024-07-18 15:01:10 -05:00
atcuno a7af052509 Black fixes 2024-07-18 14:59:40 -05:00
atcuno 8da046530f Address feedback 2024-07-18 14:57:31 -05:00
Andrew Case 1508a41499 Move registry table init into the generator function 2024-07-18 11:33:30 -05:00