Gustavo Moreira
dfd8a1f195
Linux: hidden_modules: Include kernel version and commit details
2024-10-29 17:22:48 +11:00
Gustavo Moreira
cbe071ff3e
Linux: hidden_modules: Import the whole architectures module
2024-10-29 17:19:30 +11:00
Gustavo Moreira
526007f948
Linux: hidden_modules: Use child_template
2024-10-29 16:41:47 +11:00
Gustavo Moreira
0ddd9210a8
linux: hidden_modules: Remove unused module imports
2024-10-16 15:08:59 +11:00
Gustavo Moreira
d98c7ebb1d
linux: hidden_modules: Make the fast method the default. Remove vol2 and fall back to a 1-byte alignment scan if addresses aren't aligned to the L1 cache size
2024-10-16 15:05:02 +11:00
Gustavo Moreira
f455c30e49
Linux: hidden_modules: remove missed optional heuristic_mode argument
2024-10-04 09:51:08 +10:00
Gustavo Moreira
b5948d7ec0
Linux: hidden_modules: Add @Abyss-W4tcher suggestion to optimize the fast scan method for even better performance, using the mkobj.mod self referential validation used in module.is_valid() as pre-filter
...
Removed the --heuristic-mode and the module.states validation, since the self referential check is enough by itself
2024-10-04 07:48:25 +10:00
Gustavo Moreira
e8754fadbd
Fix typo in usage help
2024-10-03 15:50:30 +10:00
Gustavo Moreira
8d925bd8ad
Added the --heuristic-mode option, which relaxes constraints to improve detection of more advanced threats
2024-10-03 15:17:02 +10:00
Gustavo Moreira
590aa9c19c
Make it callable from other plugins.
...
Additionally, classmethod helpers were added, and docstrings were enhanced for improved usability and clarity.
2024-10-03 14:50:39 +10:00
Gustavo Moreira
d5e6e7c203
Allow any module state value in both traditional and fast scan methods
2024-10-02 09:43:27 +10:00
Gustavo Moreira
5dee3aeeee
Add linux.hidden_modules plugin
2024-10-01 19:30:50 +10:00
Gustavo Moreira
6cd39c04c1
Refactor of module object. Adding function helpers to simplify the control of exceptions and errors and consolidate everything on them.
2024-10-01 12:08:22 +10:00
ikelos and GitHub
5d2a5f94d4
Merge pull request #1276 from dgmcdona/dgmcdona/windows-callbacks-validity-check
...
Windows: Callbacks - fixes bad callback validity check
2024-10-01 00:42:29 +01:00
ikelos and GitHub
c37d9eed1f
Merge pull request #1278 from dgmcdona/dgmcdona/linux-sockstat-version-bump-fix
...
Linux: Sockstat - fix incorrect version bump
2024-10-01 00:34:14 +01:00
David McDonald
db55f23070
Windows: Callbacks - fix breaking API change
...
Moves as much of the `is_parseable` check as possible back into an
`is_valid` method to avoid breaking API changes.
2024-09-30 17:03:12 -05:00
David McDonald
806f78d372
Linux: Sockstat - fix incorrect version bump
...
I erred when I bumped the version as a part of !1271 - The `SockHandlers`
class got the major version bump, not `Sockstat`. This reverts the
`SockHandlers` version bump and applies it to `Sockstat` instead.
2024-09-30 15:27:03 -05:00
David McDonald
8ad592a490
Windows: Fixes bad callback validity check
...
This fixes a bug in the callbacks plugin which causes it to miss
`IoRegisterShutdownNotification` callbacks on x86b samples. The
`header.NameInfo.Name` field was being incorrectly treated as the device
type. This fixes the issue by updating the `is_valid` method on the
`_SHUTDOWN_PACKET` extension type to take a `type_map` parameter, and
updates the method to correctly validate the object type.
2024-09-30 14:56:40 -05:00
ikelos and GitHub
495f3a92d4
Merge pull request #1277 from dgmcdona/dgmcdona/windows-netscan-missing-connections
...
Windows: Netscan - fix missing TCP connections
2024-09-30 20:51:28 +01:00
David McDonald
d9dc28d0b5
Windows: fix missing TCP connections
...
This fixes some missing TCP connections in Windows 10 20348 by adding
a scan constraint for `TTcb` pool tags.
2024-09-30 13:03:02 -05:00
ikelos and GitHub
5a6958befa
Merge pull request #1273 from dgmcdona/dgmcdona/windows-psxview-win10-bugfix
...
Windows: psxview win10 bugfix
2024-09-29 23:42:04 +01:00
David McDonald
49dc89c30c
Windows: psxview Win10+ fix
...
The current implementation of this plugin does not incorporate the
cookie on Win10+ systems, causing it to fail. This commit fixes that
issue, and also contributes a performance improvement by extracting the
call to `handles_plugin.get_type_map()` from the loop. Also replaces
for-loop with list comprehension for clarity.
2024-09-29 14:02:04 -05:00
David McDonald
3ebee83d05
Windows: psxview cleanup
...
Replaced this series of statements with a single invocation of the `all`
builtin for brevity and conciseness.
2024-09-27 17:36:50 -05:00
David McDonald
4b0ece0fc9
Windows: psxview module type-hints and cleanup
...
Adds type-hints to methods throughout the psxview module.
2024-09-27 17:36:50 -05:00
David McDonald
f1200c85b7
Windows: PsList type-hint cleanup
...
It's more appropriate to use `Iterator` than `Iterable` as a return type
here. Also updates the `Iterator` item type to be `EPROCESS` instead of
just `ObjectInterface`.
2024-09-27 17:36:50 -05:00
ikelos and GitHub
055f2e7d9b
Merge pull request #1264 from gcmoreira/linux_lsof_namespace_dentry_name
...
Linux lsof: Add namespace dentry name
2024-09-26 00:24:51 +01:00
ikelos and GitHub
e0942182c8
Merge pull request #1271 from dgmcdona/dgmcdona/linux-sockstat-procnames
...
Linux: Update sockstat to render process names
2024-09-25 23:57:30 +01:00
David McDonald
7f37135739
Linux: Update sockstat to render process names
...
Currently, process names are not displayed for sockets in the sockstat
plugin, making analysis more painful than it needs to be. This updates
the `list_sockets` classmethod and the `generator` method to return the
process name in addition to the PID.
Because this is changing the public interface, this commit includes a
major version bump for `linux.sockstat.Sockstat`.
2024-09-25 17:34:54 -05:00
ikelos and GitHub
714e987679
Merge pull request #1270 from eve-mem/windows_vadyarascan_sanity_check_warnings
...
Windows: change warnings around large memory maps to debug level as per issue #1256
2024-09-25 23:26:30 +01:00
eve
09fa859a92
Windows: change warnings around large memory maps to debug level as per issue #1256
2024-09-25 09:02:51 +01:00
ikelos and GitHub
67f8265def
Merge pull request #1261 from gcmoreira/linux_checkcreds_pointer_verification_improvements
...
Linux checkcreds pointer verification improvements
2024-09-22 15:12:46 +01:00
ikelos and GitHub
bb6ab45363
Merge pull request #1268 from gcmoreira/fix_constants_imports
...
Fix changes introduced to volatility3.framework.constants in PRs #838
2024-09-18 14:55:20 +01:00
Gustavo Moreira
f77003b670
Fix changes introduced to volatility3.framework.constants in PRs #838 and #1247
2024-09-18 12:50:58 +10:00
Mike Auty
10ac21da2c
Windows: Remove the unnecessary requirement on verinfo
...
Fixes #1267
2024-09-16 12:16:49 +01:00
ikelos and GitHub
48a770ae8a
Merge pull request #1250 from volatilityfoundation/pe_symbols_new
...
Add new pe_symbols API, debug registers plugin, unhooked system calls…
2024-09-16 09:28:09 +01:00
Andrew Case
b788733683
More comments on unhooked system calls
2024-09-15 19:48:55 -05:00
ikelos and GitHub
b5b9372d16
Merge pull request #1266 from Abyss-W4tcher/set_default_req_value
...
[configuration.py] use default req value in config_value call
2024-09-16 00:34:10 +01:00
Andrew Case
79b8ff7d05
Address final feedback
2024-09-15 18:29:05 -05:00
ikelos and GitHub
5525ce5b9b
Merge pull request #1260 from gcmoreira/linux_pidhashtable_plugin_pointer_verification_improvements
...
Linux pidhashtable plugin pointer verification improvements
2024-09-15 20:33:48 +01:00
ikelos and GitHub
6c5b838733
Merge pull request #1258 from gcmoreira/timeliner_plugin_improvements
...
Timeliner plugin `plugin-filter` improvements
2024-09-15 13:57:34 +01:00
Andrew Case
322f79fb50
Bail as early as possible
2024-09-14 17:18:26 -05:00
Andrew Case
291bc878ad
Break in a cleaner flow
2024-09-14 16:31:33 -05:00
Andrew Case
21d21cf4b8
Break properly in all paths. Help callers to ensure always lower case module name matching.
2024-09-14 16:26:38 -05:00
Andrew Case
ba0c975e73
Address all feedback
2024-09-13 18:50:47 -05:00
Abyss Watcher
67ee382c32
use default req value in config_value call
2024-09-13 18:53:33 +02:00
Gustavo Moreira
cd2af74e6d
Improve pointers address verification and return message chain
2024-09-13 17:58:21 +10:00
Gustavo Moreira
997abeda6d
Linux lsof: Add namespace dentry name
2024-09-13 17:27:02 +10:00
Gustavo Moreira
48ae43d64e
Bumping the major version since the output changed
2024-09-12 17:22:52 +10:00
Gustavo Moreira
a7dcd6d9e8
Minor: Add comment on TimeLinerInterface subclass filter
2024-09-12 16:19:13 +10:00
Gustavo Moreira
be05ace29b
Timeliner plugin: Add exception information
2024-09-12 16:06:40 +10:00
Gustavo Moreira