WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,579 Commits 80 Branches 17 Tags
de2f464a71fef4d196001d60c3d2bad9a2ab88fd
Commit Graph
2579 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Auty de2f464a71 Documentation: Fix up the surjective line 
This makes #389 obsolete.
 2021-01-08 01:14:34 +00:00
ikelosandGitHub 1ea9a493a8 Merge pull request #415 from volatilityfoundation/windows_info_add_Is64Bits_and_IsPAE 
add Is64Bit and IsPAE properties to the windows.info plugin
 2021-01-06 21:10:26 +00:00
ikelosandGitHub 95c19f1676 Merge pull request #416 from volatilityfoundation/issues/intel-pae-metadata 
Layers: Ensure intel PAE reports pae in the metadata
 2021-01-06 21:09:33 +00:00
ikelosandGitHub cbe7166257 Merge pull request #411 from volatilityfoundation/issues/issue408 
Issues/issue408
 2021-01-06 21:07:26 +00:00
ikelosandGitHub cc3818391c Merge pull request #405 from volatilityfoundation/issues/mac_vpager_native_layer 
Linux: Use native_layer when constructing from a pointer offset
 2021-01-06 21:05:00 +00:00
ikelosandGitHub b3339437fb Merge pull request #404 from volatilityfoundation/issues/bad_dtb_finder_code 
Automagic: Windows DTB finder was too limited
 2021-01-06 21:04:07 +00:00
Mike Auty e1032623fe Layers: Ensure intel PAE reports pae in the metadata 2021-01-06 19:28:24 +00:00
iMHLv2 d7d176d040 add Is64Bit and IsPAE properties to the windows.info plugin 2021-01-06 11:36:56 -06:00
iMHLv2 53397117ef remove unnecessary and unused imports from the windows extensions init file 2021-01-06 10:30:01 -06:00
Mike Auty f75e77997d Layerwriter: Remove erroneous debugging statements 2021-01-03 10:38:49 +00:00
Mike Auty d1b10781d4 CLI: Parse windows file as files not URIs 
Fixes #408
 2020-12-30 18:06:41 +00:00
Mike Auty 1c2a9921ff Windows: Partial fix for #368 error messages 2020-12-27 15:21:18 +00:00
Mike Auty feefc93adc CLI: Fix inaccurate documentation 2020-12-27 15:21:18 +00:00
Mike Auty f262821924 Documentation: minor bugfix 2020-12-21 17:07:51 +00:00
Mike Auty ccef55e448 Linux: Use native_layer when constructing from a pointer offset 2020-12-21 15:57:18 +00:00
Mike Auty c45b1b3423 Automagic: Windows DTB finder was too limited 
The DTB finder test returns a full DTB, if that's over the scan chunk
size it'll get discarded, so we remove that test.
 2020-12-21 15:52:43 +00:00
Mike Auty 1abc65c2ac CLI: Fix inaccurate documentation 2020-12-11 16:04:13 +00:00
Mike Auty f9102a60b8 Release: Update the version number for this release 
Entering code-freeze
10th Dec - Bug fixes and documentation, no new features
7th Jan - Only critical fixes
21st Jan - Release date
 2020-12-10 22:42:39 +00:00
Andrew Caseandikelos 93c6a62972 Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332 2020-12-10 18:58:00 +00:00
Mike Auty d63aef566f Codebase: Yapf the codebase again 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 747fe8609f update copywrite to 2020 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 17e629a4c4 converted process_file_object into a classmethod 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos e9f870ff05 revert self.context change back to self._context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 9f977080c5 changed self._context to self.context 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos d98337cc09 added debug statements to dump_file_producer when none is returned 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 4f37a28185 dump_file_producer is now a classmethod and returns a FileInterface Object 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 49acf44302 dumpfiles.py is now consistent with master and runs correctly 2020-12-10 15:37:40 +00:00
Matt Tresslerandikelos 8e1a599203 changed PluginRequirement to VersionRequirement 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0a9e663c41 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 442f877e9a refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 20f4fbf157 add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both) 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 0c09b98318 use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 25b56b5ca4 remove the _VACB.is_valid() method - do all validity checks in the calling function 2020-12-10 15:37:40 +00:00
iMHLv2andikelos 3ac89577cc refs #197 initial commit of windows.dumpfiles 2020-12-10 15:37:40 +00:00
Mike Auty 56ff75a74b Layers: Add internal intel debugging flag 2020-12-10 12:18:14 +00:00
Mike Auty db86aeb861 Volshell: Fix up filename/location confusion 2020-12-10 12:17:39 +00:00
Mike Auty b759ff3966 Volshell: Clarify load_file to accept location and filename 2020-12-10 10:07:44 +00:00
Mike Auty dbda8998bc Volshell: Make it easier to make configurables 2020-12-10 10:07:44 +00:00
Mike Auty e28016e45b Pdbutility: Improve usability of symbol_table_from_offset 2020-12-08 16:34:59 +00:00
Janandikelos 3dea2b4187 adds os_distinguisher for 18363 2020-12-08 10:34:07 +00:00
Janandikelos b3ffddcff0 fixes wrong offset in 18363 x64 2020-12-08 10:34:07 +00:00
Janandikelos 774528206c adds new vol3 netscan profiles and fixes rare bug 2020-12-08 10:34:07 +00:00
Mike Auty 754cfcd7ac Documentation: Add more detail on writing objects 
Fixes #390
 2020-12-06 23:55:49 +00:00
Mike Auty 3b700bbee5 Documentation: Ensure non-os plugins are documented 2020-12-06 23:55:26 +00:00
Mike Auty 0d267d0d56 Codebase: Improve typing using monkeytype 2020-12-06 21:34:28 +00:00
Mike Auty 9fa107a6c0 CLI: Support MultiTypeData in JSON output. Fixes #384 2020-12-02 23:41:21 +00:00
Mike Auty 27fcd1a641 CLI: Error on non-existant output_dir 2020-12-02 23:16:17 +00:00
cecioandikelos c9c37a9b35 OS check reworked as suggested by @iMHLv2 and @ikelos 2020-12-02 14:23:12 +00:00
cecioandikelos 1cf625fc89 fix: the bounce from physical to virtual process is required only for OS < Win10. 
Added the check in the "dump" option
 2020-12-02 14:23:12 +00:00
Mike Auty f88ce55199 Automagic: Improve debugging output for linux/mac 2020-12-02 09:51:42 +00:00