Mike Auty
e108d8a5c4
Layers: Fix typo in pae patch
2021-01-07 10:14:35 +00:00
ikelos and GitHub
782e59694a
Merge pull request #397 from japhlange/netlist
...
Netstat for x64 Windows
2021-01-07 10:09:37 +00:00
Jan
f0f5f1978d
renamed to more consistent plugin name
2021-01-07 11:00:58 +01:00
Mike Auty
bb5a63246e
Merge branch 'release/v2.0.0' into develop
2021-01-06 21:21:37 +00:00
ikelos and GitHub
1ea9a493a8
Merge pull request #415 from volatilityfoundation/windows_info_add_Is64Bits_and_IsPAE
...
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 21:10:26 +00:00
ikelos and GitHub
95c19f1676
Merge pull request #416 from volatilityfoundation/issues/intel-pae-metadata
...
Layers: Ensure intel PAE reports pae in the metadata
2021-01-06 21:09:33 +00:00
Mike Auty
8de5991812
Timerliner: Improve timeliner caching
...
This duplicates config values if the requirement are identical, which
speeds up the automagic considerably. Note that this means even the
requirement descriptions must match, but for safey that probably makes
sense.
2021-01-06 21:08:26 +00:00
Mike Auty
84aa3b5e70
Automagic: Improve vmware layer stacker diagnostics
2021-01-06 21:08:26 +00:00
ikelos and GitHub
cc3818391c
Merge pull request #405 from volatilityfoundation/issues/mac_vpager_native_layer
...
Linux: Use native_layer when constructing from a pointer offset
2021-01-06 21:05:00 +00:00
ikelos and GitHub
b3339437fb
Merge pull request #404 from volatilityfoundation/issues/bad_dtb_finder_code
...
Automagic: Windows DTB finder was too limited
2021-01-06 21:04:07 +00:00
ikelos and GitHub
a6f176ac28
Merge pull request #402 from volatilityfoundation/feature/better-object-description
...
Objects: Make repr(object) more useful
2021-01-06 21:01:18 +00:00
Mike Auty
e1032623fe
Layers: Ensure intel PAE reports pae in the metadata
2021-01-06 19:28:24 +00:00
iMHLv2
d7d176d040
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 11:36:56 -06:00
iMHLv2
53397117ef
remove unnecessary and unused imports from the windows extensions init file
2021-01-06 10:30:01 -06:00
Mike Auty
f75e77997d
Layerwriter: Remove erroneous debugging statements
2021-01-03 10:38:49 +00:00
Jan
71e48cc672
complex objects are not passed as arguments directly anymore, but rather by offset
2020-12-28 21:51:28 +01:00
Jan
f731ceba3a
optimizations as raised by #397
2020-12-28 21:22:50 +01:00
Mike Auty
1c2a9921ff
Windows: Partial fix for #368 error messages
2020-12-27 15:21:18 +00:00
Mike Auty
991a0a1091
Objects: Make repr(object) more useful
2020-12-22 17:11:46 +00:00
Jan
0e136b9437
adds partition_table type to ISFs
2020-12-22 17:18:20 +01:00
Jan
2e70a9cb45
addresses issues raised in pr #399
2020-12-22 17:11:55 +01:00
Mike Auty
ccef55e448
Linux: Use native_layer when constructing from a pointer offset
2020-12-21 15:57:18 +00:00
Mike Auty
c45b1b3423
Automagic: Windows DTB finder was too limited
...
The DTB finder test returns a full DTB, if that's over the scan chunk
size it'll get discarded, so we remove that test.
2020-12-21 15:52:43 +00:00
Jan
bcc79d4cb9
better documentation and support for more x64 Windows versions
2020-12-19 17:13:53 +01:00
Mike Auty
f9102a60b8
Release: Update the version number for this release
...
Entering code-freeze
10th Dec - Bug fixes and documentation, no new features
7th Jan - Only critical fixes
21st Jan - Release date
2020-12-10 22:42:39 +00:00
Andrew Case and ikelos
93c6a62972
Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332
2020-12-10 18:58:00 +00:00
Mike Auty
d63aef566f
Codebase: Yapf the codebase again
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
747fe8609f
update copywrite to 2020
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
17e629a4c4
converted process_file_object into a classmethod
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
e9f870ff05
revert self.context change back to self._context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
9f977080c5
changed self._context to self.context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
d98337cc09
added debug statements to dump_file_producer when none is returned
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
4f37a28185
dump_file_producer is now a classmethod and returns a FileInterface Object
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
49acf44302
dumpfiles.py is now consistent with master and runs correctly
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
8e1a599203
changed PluginRequirement to VersionRequirement
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0a9e663c41
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0c09b98318
use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
25b56b5ca4
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Mike Auty
56ff75a74b
Layers: Add internal intel debugging flag
2020-12-10 12:18:14 +00:00
Jan
972d3d7076
netlist for 16299 and 17134
2020-12-08 20:04:03 +01:00
Mike Auty
e28016e45b
Pdbutility: Improve usability of symbol_table_from_offset
2020-12-08 16:34:59 +00:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
Mike Auty