 Abyss Watcher
|
de42e58bfa
|
require framework v2.21.0 for recoverfs
|
2025-02-11 17:54:19 +01:00 |
|
|
Abyss Watcher
|
999f3d0d2c
|
add superblock or device numbers path prepending
|
2025-02-11 17:48:34 +01:00 |
|
|
Abyss Watcher
|
f82fd53753
|
2.20.1 -> 2.21.0 bump
|
2025-02-11 17:46:03 +01:00 |
|
|
Abyss Watcher
|
ec61da6dac
|
add uuid property to super_block
|
2025-02-11 17:45:31 +01:00 |
|
|
Abyss Watcher
|
7732312809
|
switch property to functools.cached_property
|
2025-02-11 17:45:12 +01:00 |
|
|
Abyss Watcher
|
64d8a675a7
|
initial linux.pagecache.recoverfs
|
2025-02-10 11:49:23 +01:00 |
|
|
ikelosandGitHub
|
8dceeb2144
|
Merge pull request #1611 from Abyss-W4tcher/pre_linux_pagecache_recoverfs_2
Re-apply "Pre linux.pagecache.recoverfs support"
|
2025-02-09 18:14:24 +00:00 |
|
|
ikelosandGitHub
|
7e94d76283
|
Merge pull request #1601 from volatilityfoundation/issues/kvo-optional
Issues/kvo optional
|
2025-02-09 15:53:48 +00:00 |
|
|
Mike Auty
|
444376cbba
|
Fix typos and try setting back requirement change
|
2025-02-09 15:39:49 +00:00 |
|
|
ikelosandGitHub
|
f744d03ecc
|
Merge pull request #1610 from Abyss-W4tcher/linux_tracing_tracepoints
New plugin: linux.tracing.tracepoints
|
2025-02-09 13:04:00 +00:00 |
|
|
Abyss Watcher
|
f1b34df26b
|
2.0.2 -> 3.0.0 InodePages bump
|
2025-02-09 13:49:24 +01:00 |
|
|
Abyss Watcher
|
826281b3b9
|
add and use write_inode_content_to_stream
|
2025-02-09 13:48:59 +01:00 |
|
|
Abyss Watcher
|
223f2d69bb
|
switch to context and layer_name calling convention
|
2025-02-09 13:47:37 +01:00 |
|
|
Abyss Watcher
|
03f6fa9533
|
1.0.3 -> 1.1.0 Files bump
|
2025-02-09 13:45:46 +01:00 |
|
|
Abyss Watcher
|
8d9d0f5689
|
add and use follow_symlinks parameter
|
2025-02-09 13:45:23 +01:00 |
|
|
Abyss Watcher
|
b9d4605b8a
|
switch to InodeUser.format_symlink
|
2025-02-09 13:44:16 +01:00 |
|
|
Abyss Watcher
|
cd9ba823a1
|
add inode_size and format_symlink to InodeUser
|
2025-02-09 13:42:47 +01:00 |
|
|
Abyss Watcher
|
8d23d5b808
|
use architectures.LINUX_ARCHS
|
2025-02-09 13:41:46 +01:00 |
|
|
Abyss Watcher
|
a9691fbe77
|
remove unnecessary object creation
|
2025-02-09 12:41:23 +01:00 |
|
|
Abyss Watcher
|
83dde6aec3
|
improve prel32 comments
|
2025-02-09 12:26:42 +01:00 |
|
|
ikelosandGitHub
|
ca420d9a5d
|
Merge pull request #1607 from volatilityfoundation/issue_1475_ldrmodules
Make a generic DLL enumeration function that ensures the base address…
|
2025-02-08 19:40:56 +00:00 |
|
|
Abyss Watcher
|
0abe258765
|
initial linux.tracing.tracepoints.CheckTracepoints
|
2025-02-08 15:41:02 +01:00 |
|
|
ikelosandGitHub
|
7719d29881
|
Merge pull request #1609 from volatilityfoundation/unloaded_modules_valid_modules_only
Prevent yielding smeared/broken modules from the unloaded module list
|
2025-02-08 00:17:07 +00:00 |
|
|
Andrew Case
|
df55b7890d
|
Prevent yielding smeared/broken modules from the unloaded module list
|
2025-02-07 18:05:16 -06:00 |
|
|
Andrew Case
|
67c001ab50
|
Update for black
|
2025-02-07 15:12:06 -06:00 |
|
|
Andrew Case
|
8c617d6b3f
|
Make a generic DLL enumeration function that ensures the base address is set and we return as many entries as possible #1475
|
2025-02-07 15:06:32 -06:00 |
|
|
ikelosandGitHub
|
789081e971
|
Merge pull request #1606 from volatilityfoundation/issue_1594_dname
Catch symbolerror for when a kernel does not have ns_common #1594
|
2025-02-07 19:44:04 +00:00 |
|
|
ikelosandGitHub
|
44ae4f137e
|
Merge pull request #1596 from volatilityfoundation/vma_get_name_fixes
Fix get_name API, fix malfind
|
2025-02-07 19:35:18 +00:00 |
|
|
ikelosandGitHub
|
e5e4d30a46
|
Merge pull request #1514 from volatilityfoundation/file_descriptors_exception_handling
Add proper exception handling in file descriptor enumeration
|
2025-02-07 19:35:07 +00:00 |
|
|
Andrew Case
|
13278121e3
|
Catch symbolerror for when a kernel does not have ns_common #1594
|
2025-02-07 13:33:33 -06:00 |
|
|
Andrew Case
|
ac8eeec52e
|
Fixes for black
|
2025-02-07 13:17:10 -06:00 |
|
|
Andrew Case
|
4c2d21d086
|
bump patch number
|
2025-02-07 13:15:31 -06:00 |
|
|
Andrew Case
|
9c5b016932
|
Move all initial access into try/except block
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
968241aedd
|
Address feedback
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
d372f04eff
|
Add proper exception handling in file descriptor enumeration
|
2025-02-07 13:14:11 -06:00 |
|
|
Andrew Case
|
6100d7756f
|
Add function typing
|
2025-02-07 13:05:41 -06:00 |
|
|
ikelosandGitHub
|
bf03ecda2c
|
Merge pull request #1564 from Abyss-W4tcher/linux_tracing_ftrace
New Linux plugin: linux.tracing.ftrace
|
2025-02-05 21:49:15 +00:00 |
|
|
Abyss Watcher
|
f5e8ed2457
|
use a list comprehension for flags parsing
|
2025-02-05 21:42:13 +01:00 |
|
|
ikelosandGitHub
|
eadd6d229e
|
Merge pull request #1572 from hsarkey/hsarkey/wow64-dlllist
Windows: Allow windows.dlllist to report back DLLs from wow64 processes
|
2025-02-05 20:23:50 +00:00 |
|
|
hsarkey
|
29567a777b
|
Updates to address the dlllist wow64 upgrades
|
2025-02-05 15:10:36 -05:00 |
|
|
Abyss Watcher
|
637ff68035
|
make ftrace flags parsing more readable
|
2025-02-05 19:19:26 +01:00 |
|
|
Abyss Watcher
|
c01f3c5556
|
non inclusive upper bound address check
|
2025-02-05 19:17:25 +01:00 |
|
|
ikelosandGitHub
|
a4987b39d9
|
Merge pull request #1598 from volatilityfoundation/issue_1573_handle_iteration_traceback
Windows: Handles - catch exception in handle iteration
|
2025-02-03 22:42:27 +00:00 |
|
|
ikelosandGitHub
|
b3760ce7e5
|
Merge pull request #1599 from gcmoreira/linux_kallsyms
Linux - Introduce the Linux kallsyms API and related plugins
|
2025-02-02 23:32:01 +00:00 |
|
|
Gustavo Moreira
|
cef87e014c
|
linux: kernel_symbol object extension: move properties to getters
|
2025-02-03 07:59:57 +11:00 |
|
|
Gustavo Moreira
|
348720c89a
|
linux: module extension object: add docstring to get_symbol_type()
|
2025-02-03 07:55:11 +11:00 |
|
|
Gustavo Moreira
|
e222b069ef
|
linux: module extension object: add typing info to _get_sect_count()
|
2025-02-03 07:50:21 +11:00 |
|
|
Gustavo Moreira
|
13b8526206
|
linux: kallsyms API: reuse module_name variable
|
2025-02-03 07:40:17 +11:00 |
|
|
Gustavo Moreira
|
19fed19647
|
linux: kallsyms plugin: fix variable name typo
|
2025-02-03 07:38:43 +11:00 |
|
|
Gustavo Moreira
|
54ce358e8e
|
framework: minor version bump
|
2025-02-03 07:37:38 +11:00 |
|