4349 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Davide Arcuri	dc8dc9b078	fix yara depending plugins	2024-07-25 14:37:18 +02:00
Davide Arcuri	c6727ffb70	fix f-string for previous python release	2024-07-25 08:43:21 +02:00
Davide Arcuri	1616a898ae	restore comment	2024-07-25 08:37:27 +02:00
Davide Arcuri	fceb79ba8b	use with context, bump release	2024-07-25 08:34:04 +02:00
Arcuri DavideandGitHub	c92cd1935e	Merge branch 'volatilityfoundation:develop' into develop	2024-07-25 08:32:01 +02:00
ikelosandGitHub	05aa81b63c	Merge pull request #1214 from eve-mem/windows_issue_1146 ... Windows: update handles plugin to use a default SAR value of 0x10	2024-07-24 22:11:42 +01:00
ikelosandGitHub	19e1c21cbb	Merge pull request #1207 from volatilityfoundation/issues/fix-generator-inheritance ... Add in threads that only provides an implmentation method	2024-07-24 21:04:36 +01:00
Mike Auty	f4cbed856b	Fix up missing filter parameter	2024-07-24 20:47:05 +01:00
Mike Auty	e1065f9e78	Fix up a missing super which @atcuno spotted	2024-07-24 20:32:36 +01:00
Eve	7d52f7992d	Windows: Make the default sar value used in handles plugin a variable so if it needs to be changed it gets updated in one place only	2024-07-24 11:06:26 +01:00
Eve	b8b146a444	Windows: update handles plugin to use a default SAR value of 0x10 if decoding fails. Produce warnings when this happens. Ref issue #1147	2024-07-24 10:59:52 +01:00
Davide Arcuri	ce9832a2b3	both yara-python and yara-x support	2024-07-22 13:58:33 +02:00
Arcuri DavideandGitHub	0b84a5627b	Merge branch 'volatilityfoundation:develop' into develop	2024-07-22 13:56:34 +02:00
Mike Auty	5e96327cb0	Add in threads that only provides an implmentation method	2024-07-21 22:58:43 +01:00
ikelosandGitHub	721971652c	Merge pull request #1168 from volatilityfoundation/svcdiff_malware_detection ... Add svclist and svcdiff plugins. Make svcscan more modular to support…	2024-07-21 18:37:49 +01:00
Andrew Case	111873e173	Fix class vs static method and leading underscores	2024-07-21 11:54:06 -05:00
Andrew Case	21396185d0	Address feedback	2024-07-21 11:10:38 -05:00
ikelosandGitHub	fba7255b23	Merge pull request #1204 from volatilityfoundation/pedump_v2 ... Add pedump plugin and unified API for extracting PE files to disk	2024-07-21 17:05:42 +01:00
Andrew Case	9454181b98	Address feedback	2024-07-21 09:42:19 -05:00
ikelosandGitHub	5645c4ff4b	Merge pull request #1167 from volatilityfoundation/process_ghosting ... Add processghosting plugin to detect process ghosting and related tec…	2024-07-21 13:31:35 +01:00
ikelosandGitHub	be10469702	Merge pull request #1202 from dgmcdona/dgmcdona/windows-shimcachemem ... Windows: ShimcacheMem	2024-07-21 13:21:45 +01:00
ikelosandGitHub	d494df2673	Merge pull request #1201 from volatilityfoundation/issues/issue1200 ... Windows: Fix vadyarascan sanity check and bad documentation	2024-07-21 13:11:51 +01:00
ikelosandGitHub	6043e740ca	Merge pull request #1177 from volatilityfoundation/118-missing-plugins-threads-timers ... 118 missing plugins threads timers	2024-07-21 12:03:18 +01:00
ikelosandGitHub	7aa509b92b	Merge pull request #1186 from volatilityfoundation/userassist_timeline ... Add timeliner support to userassist	2024-07-21 12:00:27 +01:00
Davide Arcuri	bca4cdda74	replace yara-python with yara-x	2024-07-19 11:09:52 +02:00
atcuno	12f3beacfc	Add dedicated plugin and API for extracting PE files from kernel and process memory	2024-07-18 17:56:24 -05:00
atcuno	75ccf1bfab	Add dedicated plugin and API for extracting PE files from kernel and process memory	2024-07-18 17:54:33 -05:00
atcuno	920b3ec615	Black fix	2024-07-18 15:48:21 -05:00
atcuno	b0a89f2109	Address feedback	2024-07-18 15:47:37 -05:00
atcuno	2a5e94a094	Black fixes	2024-07-18 15:01:10 -05:00
atcuno	a7af052509	Black fixes	2024-07-18 14:59:40 -05:00
atcuno	8da046530f	Address feedback	2024-07-18 14:57:31 -05:00
Andrew Case	1508a41499	Move registry table init into the generator function	2024-07-18 11:33:30 -05:00
David McDonald	4048d0b122	Windows: Adds shimcachemem plugin	2024-07-18 11:07:49 -05:00
David McDonald	a684e284cc	Windows: Adds shimcache symbol files + extensions	2024-07-18 11:07:49 -05:00
Mike Auty	a5cf635fd8	Windows: Fix the vadyarascan sanity check	2024-07-17 17:31:44 +01:00
Mike Auty	be5423f786	Windows: Fix up broken imports in info plugin	2024-07-17 17:08:15 +01:00
ikelosandGitHub	30dff64967	Merge pull request #1080 from gcmoreira/linux_netfilter_hooks_plugin ... Linux netfilter hooks plugin	2024-07-16 22:59:53 +01:00
ikelosandGitHub	727cd878c0	Merge pull request #1176 from volatilityfoundation/unloadedmodules ... #1175 - initial unloadedmodules plugin	2024-07-16 22:51:33 +01:00
Dave Lassalle	43e22d72bd	#118 - black formatting	2024-07-16 09:23:06 -05:00
Gustavo Moreira	cf6c7fb1f4	linux.netfilter.Netfilter: Add lsmod version requirement check on AbstractNetfilter	2024-07-16 09:38:49 +10:00
Dave Lassalle	99cf48597a	#118 - use canonicalize for offset	2024-07-15 15:46:27 -05:00
Dave Lassalle	7e3615335c	#1175 - config_path change	2024-07-15 15:40:22 -05:00
Dave Lassalle	55fe4ba47a	#118 - MR feedback	2024-07-15 15:20:10 -05:00
Mike Auty	cb6929163b	Windows: Fix vadyarascan sanity check and bad documentation	2024-07-15 18:14:50 +01:00
ikelosandGitHub	50dbeac080	Merge pull request #1190 from gcmoreira/windows_psscan_fix ... Windows - psscan plugin fixes	2024-07-15 18:09:45 +01:00
Gustavo Moreira	a6d8ba8bfa	windows eprocess validation: Make the creation and exit year checks dynamic	2024-07-15 20:22:40 +10:00
Gustavo Moreira	ac9236cb43	linux.netfilter.Netfilter: Add LinuxUtilities version requirement check on AbstractNetfilter	2024-07-15 19:59:41 +10:00
ikelosandGitHub	ccaa473972	Merge pull request #1199 from volatilityfoundation/issues/python-3.8 ... Core: Bump the version and minium python to support pip	2024-07-14 19:12:49 +01:00
Mike Auty	61e3e894ee	Core: Bump the version and minium python to support pip	2024-07-14 19:04:06 +01:00