WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,830 Commits 80 Branches 17 Tags
e035faa32392bc27d20f4b7b0c01feb0e9da2210
Commit Graph
4830 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Gustavo Moreira e035faa323 bump framework minor version 2024-12-18 09:55:13 +11:00
Gustavo Moreira 02f17af8a6 linux: fix task parent pid in several plugins. 
It also adds a method to get the correct one in a unified way from the task object extension
 2024-12-17 12:09:29 +11:00
ikelosandGitHub dc4eedb3f9 Merge pull request #1403 from j-t-1/text_renderer 
Tiny change text_renderer.py
 2024-12-16 23:30:33 +00:00
ikelosandGitHub 71de86d19d Merge pull request #1398 from j-t-1/manual 
Update the CLI manual documentation
 2024-12-16 23:25:24 +00:00
ikelosandGitHub d2725b6a00 Merge pull request #1394 from j-t-1/linux 
Tweak the getting started linux tutorial
 2024-12-16 22:46:44 +00:00
ikelosandGitHub 2fd9dd8a52 Merge pull request #1395 from j-t-1/mac 
Tweak the getting started mac tutorial
 2024-12-16 22:45:40 +00:00
ikelosandGitHub 88537066fa Merge pull request #1396 from j-t-1/windows 
Tweak the getting started windows tutorial
 2024-12-16 22:44:32 +00:00
j-t-1andGitHub c8c39837ab Tiny change text_renderer.py 2024-12-15 19:26:22 +00:00
j-t-1andGitHub 31492f4ab8 Rectify maximum repetition of verbose flag 
From four to six (-vvvvvv).
 2024-12-14 15:50:50 +00:00
j-t-1andGitHub b235ed05b7 Update the CLI manual documentation 2024-12-12 18:50:23 +00:00
j-t-1andGitHub d77d696e2b Tweak the getting started windows tutorial 2024-12-12 17:49:25 +00:00
j-t-1andGitHub e31e13f471 Tweak the getting started mac tutorial 2024-12-12 17:44:01 +00:00
j-t-1andGitHub 6ffef285f4 Tweak the getting started linux tutorial 2024-12-12 17:36:51 +00:00
Mike Auty b6717d80d9 Windows: Fix up minor typo and CodeQL warning 2024-12-10 23:55:44 +00:00
ikelosandGitHub f00b596954 Merge pull request #1262 from volatilityfoundation/direct_indirect_system_calls 
Add detection of direct and indirect system calls
 2024-12-10 23:54:02 +00:00
ikelosandGitHub b8298a345f Merge pull request #1169 from volatilityfoundation/mftscan_updates_resident_data_plugin 
Add new resident data displaying plugin. Scan in correct layer. Condense code and remove duplication. Fix bugs
 2024-12-09 20:24:27 +00:00
Andrew Case 13eae6c3df Add capstone to test system requirements. Allow lazy type checks 2024-12-09 13:19:06 -06:00
Andrew Case af65d7e32d Address feedback 2024-12-09 13:10:34 -06:00
Andrew Case e7fca5a83f Update year 2024-12-09 13:10:34 -06:00
Andrew Case 262c7f1aa7 Make VAD API public as intended 2024-12-09 13:10:34 -06:00
Andrew Case fce2125a8e Make VAD API public as intended 2024-12-09 13:10:34 -06:00
Andrew Case 9f8e39efa0 Fix formatting problem between black versions 2024-12-09 13:10:34 -06:00
Andrew Case e66a3e929b Add detection of direct and indirect system calls 2024-12-09 13:10:34 -06:00
ikelosandGitHub ec550232ac Merge pull request #1388 from eve-mem/issue_1387 
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
 2024-12-09 18:58:40 +00:00
Andrew Case 582feccf93 Address feedback 2024-12-09 12:56:07 -06:00
eve b86e839718 Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387 2024-12-09 18:30:19 +00:00
ikelosandGitHub 2ae723513a Merge pull request #1386 from j-t-1/doc 
Cosmetic changes to documentation
 2024-12-07 17:19:38 +00:00
j-t-1andGitHub 45f9064623 Cosmetic changes to documentation 2024-12-07 17:11:49 +00:00
j-t-1andGitHub e165c78ba7 Cosmetic changes to documentation 2024-12-07 16:37:39 +00:00
j-t-1andGitHub 04d2554442 Cosmetic changes to documentation 2024-12-07 16:36:18 +00:00
j-t-1andGitHub 97698cc5ed Cosmetic changes to documentation 2024-12-07 16:29:58 +00:00
j-t-1andGitHub 9ebc0bd90d Cosmetic changes to documentation 2024-12-07 16:20:45 +00:00
Mike Auty d29c23e922 Windows: Protect against missing _MM_SESSION_SPACE symbol 2024-12-07 15:52:58 +00:00
ikelosandGitHub 78e3ee26a0 Merge pull request #1384 from j-t-1/doc 
Small documentation changes
 2024-12-07 01:04:22 +00:00
j-t-1andGitHub 93a47e811b Small documentation changes 2024-12-06 21:52:51 +00:00
j-t-1andGitHub 846403115a Small documention changes 2024-12-06 16:00:03 +00:00
ikelosandGitHub e2cdbdc2bf Merge pull request #1382 from j-t-1/PYO 
PEP 488 – Elimination of PYO files
 2024-12-06 00:26:21 +00:00
j-t-1andGitHub f11ef06c27 PEP 488 – Elimination of PYO files 
Python 3.5 implememted PEP 488, eliminating .pyo files.
 2024-12-05 21:30:20 +00:00
j-t-1andGitHub 5acf8858d9 PEP 488 – Elimination of PYO files 
Python 3.5 implememted PEP 488, eliminating .pyo files.
 2024-12-05 18:31:04 +00:00
Mike Auty 3ff304ceed Layers: Fix intel bug introduced in commit 73d4f2f 
The patch failed to mask the incoming address to the maximum physical
address.  This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.

Fixes #1374.

Thanks to @the-rectifier for quickly identifying the issue!
 2024-12-03 19:58:23 +00:00
ikelosandGitHub e4c552050c Merge pull request #1377 from gcmoreira/pytest_image_autoselection_improvement 
Testing: Enable automatic OS image selection by matching test name and image filename prefixes
 2024-12-01 11:06:46 +00:00
ikelosandGitHub fbc72d35b9 Merge pull request #1368 from gcmoreira/linux_pslist_dependencies_fix_1366 
Linux pslist dependencies fix 1366
 2024-12-01 11:00:12 +00:00
ikelosandGitHub 4d628c839b Merge pull request #1376 from gcmoreira/fix_pretty_renderer_hex_bytes_as_text 
Renderers - Fix HexBytes formatter for pretty renderer
 2024-12-01 10:52:00 +00:00
Gustavo Moreira 535ce3a22a testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment. 
For example, when using VSCode with pytest, test autodiscovery triggers pytest_generate_tests(), adding all images to each test case. This causes issues, as Linux tests end up being executed with Windows and Mac images, and vice versa.
 2024-12-01 19:34:35 +11:00
Gustavo Moreira c19a54cbd9 testcases: Minor cleanup: Renaming and reordering functions to align with the Linux/Windows test cases 2024-12-01 14:08:53 +11:00
Gustavo Moreira 7ae27c4eaa Merge branch 'develop' into linux_pslist_dependencies_fix_1366 2024-12-01 13:24:53 +11:00
Gustavo Moreira 3c20e46902 renderers: Fix HexBytes formatter to apply padding also at the end of the string, ensuring proper output alignment when the pretty renderer justifies each line to the right 2024-12-01 12:36:35 +11:00
ikelosandGitHub 9222f4915a Merge pull request #1371 from volatilityfoundation/issues/use-yara-scanner-over-handling-yara-directly 
Fix up vmayarascan and vadyarascan to use yarascan properly
 2024-12-01 01:26:04 +00:00
Mike Auty d404747de5 Tests: Add in vadyarascan tests 2024-12-01 00:04:46 +00:00
Mike Auty 2dc1686289 Windows: Protect the SERICE_RECORD is_valid function a little more 
The request to .Order could fail depending on where the structure lies
in memory.
 2024-11-30 13:36:17 +00:00