 Gustavo Moreira
|
e222b069ef
|
linux: module extension object: add typing info to _get_sect_count()
|
2025-02-03 07:50:21 +11:00 |
|
|
Gustavo Moreira
|
13b8526206
|
linux: kallsyms API: reuse module_name variable
|
2025-02-03 07:40:17 +11:00 |
|
|
Gustavo Moreira
|
19fed19647
|
linux: kallsyms plugin: fix variable name typo
|
2025-02-03 07:38:43 +11:00 |
|
|
Gustavo Moreira
|
54ce358e8e
|
framework: minor version bump
|
2025-02-03 07:37:38 +11:00 |
|
|
Gustavo Moreira
|
bf0271cd57
|
linux: kallsyms plugin: simplify argument by removing the "only-" prefix, which was also causing confusion.
|
2025-02-02 12:29:01 +11:00 |
|
|
Gustavo Moreira
|
5347926ab6
|
linux: Add pscallstack plugin testcase
|
2025-02-02 11:34:31 +11:00 |
|
|
Gustavo Moreira
|
80f6d0dad6
|
linux: Add kallsyms plugin testcase
|
2025-02-02 11:33:34 +11:00 |
|
|
Gustavo Moreira
|
1da15d1352
|
linux: pscallstack plugin: Fix canonical addresses
|
2025-02-01 20:55:54 +11:00 |
|
|
Gustavo Moreira
|
0ba331f34c
|
linux: kallsyms api: Added support for older kernels lacking mod_tree. Enhanced module address search performance by using the new module memory boundaries function
|
2025-02-01 20:55:40 +11:00 |
|
|
Gustavo Moreira
|
2af8b95ea4
|
linux: module object extension: add method to know the module memory boundaries based on its symbols addresses and sizes
|
2025-02-01 20:55:35 +11:00 |
|
|
Gustavo Moreira
|
9175c1b1e9
|
linux: kallsyms api: ensure all the addresses are in the same range
|
2025-02-01 20:55:29 +11:00 |
|
|
Gustavo Moreira
|
4469ab49c8
|
linux: kallsyms api: move the unsupport implementation message to the info log level
|
2025-02-01 18:12:51 +11:00 |
|
|
Gustavo Moreira
|
fbba4c7675
|
linux: new pscallstack plugin: add a poor man's process stack call enumeration plugin to showcase the power of the kallsyms API
|
2025-02-01 17:55:50 +11:00 |
|
|
Gustavo Moreira
|
d665fcc2b5
|
linux: kallsyms plugin: Enable filtering of symbols by subsystem
|
2025-02-01 17:55:42 +11:00 |
|
|
Gustavo Moreira
|
97135a992a
|
linux: add Kallsyms plugin
|
2025-02-01 17:55:33 +11:00 |
|
|
Gustavo Moreira
|
6174687204
|
linux: Introduce Kallsyms API
|
2025-02-01 17:55:21 +11:00 |
|
|
Gustavo Moreira
|
7e4b548e17
|
linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread
|
2025-02-01 17:55:13 +11:00 |
|
|
Gustavo Moreira
|
e2431eebdf
|
linux: bpf_prog: Add methods to get the program address and its memory regions
|
2025-02-01 17:55:05 +11:00 |
|
|
Gustavo Moreira
|
0e0daffc45
|
linux: Add kernel_symbol object extension
|
2025-02-01 17:54:55 +11:00 |
|
|
Gustavo Moreira
|
88b32b0803
|
linux: task_struct object extension: Add helper to obtain the task state
|
2025-02-01 17:54:47 +11:00 |
|
|
Gustavo Moreira
|
dba90ac217
|
linux: Add support for module symbol types
|
2025-02-01 17:54:41 +11:00 |
|
|
Gustavo Moreira
|
18a69b9417
|
linux: add latched RB-trees implementation
|
2025-02-01 17:54:27 +11:00 |
|
|
ikelosandGitHub
|
5a046ea0e4
|
Merge pull request #1590 from volatilityfoundation/mnt_parent_missing
Add mnt_parent check to kernel version validation
|
2025-02-01 01:46:46 +00:00 |
|
|
ikelosandGitHub
|
75b55c3b30
|
Merge pull request #1593 from volatilityfoundation/mountinfo_superblock_check
Add missing pointer validation check in mountinfo
|
2025-02-01 01:43:13 +00:00 |
|
|
ikelosandGitHub
|
346a5d98da
|
Merge pull request #1592 from volatilityfoundation/kthread_name_smear
Prevent backtraces when kthread full name is smeared
|
2025-02-01 00:56:10 +00:00 |
|
|
ikelosandGitHub
|
4df047beac
|
Merge pull request #1591 from volatilityfoundation/check_sock_access
Fix broken socket retrieval that causes backtrace
|
2025-02-01 00:55:08 +00:00 |
|
|
Andrew Case
|
efbc410c4d
|
Add missing pointer validation check in mountinfo
|
2025-01-31 21:43:32 +00:00 |
|
|
Andrew Case
|
644b967c62
|
Prevent backtraces when kthread full name is smeared
|
2025-01-31 21:31:07 +00:00 |
|
|
Andrew Case
|
4d43ac9a6d
|
Catch invalid address exception for invalid sock values
|
2025-01-31 20:46:16 +00:00 |
|
|
Andrew Case
|
cb3542f76a
|
Catch invalid address exception for invalid sock values
|
2025-01-31 20:40:51 +00:00 |
|
|
Andrew Case
|
1132bd9830
|
Add mnt_parent check to kernel version validation
|
2025-01-31 18:11:22 +00:00 |
|
|
Andrew Case
|
55b27a68d5
|
Add mnt_parent check to kernel version validation
|
2025-01-31 18:10:12 +00:00 |
|
|
ikelosandGitHub
|
1f983aca73
|
Merge pull request #1585 from volatilityfoundation/issues/issue1577
Expose and use `get_pefile_obj` rather than having local copies
|
2025-01-31 17:30:22 +00:00 |
|
|
ikelosandGitHub
|
b51acfd3fb
|
Merge pull request #1407 from eve-mem/WindowsCommitCharge_issue1400
Windows: Update get_commit_charge extension to handle Core.CommitCharge case
|
2025-01-31 16:44:24 +00:00 |
|
|
eve
|
e9d1831a7c
|
Windows: update get_commit_charge with CommitCharge fix by BeanBagKing
|
2025-01-31 14:45:28 +00:00 |
|
|
Mike Auty
|
68c8b2389a
|
Make error messages a little more descriptive
|
2025-01-31 10:00:16 +00:00 |
|
|
ikelosandGitHub
|
b81105f508
|
Merge pull request #1587 from gcmoreira/intel_translation_performance_improvement
intel: address translation: performance improvements caching by page address
|
2025-01-31 09:55:06 +00:00 |
|
|
ikelosandGitHub
|
702257fb4e
|
Merge pull request #1586 from gcmoreira/framework_improve_conversion_to_strings
Framework improve conversion to strings
|
2025-01-31 09:04:33 +00:00 |
|
|
Gustavo Moreira
|
815b2fe918
|
Fix bug in address_to_string() helper
|
2025-01-31 19:49:04 +11:00 |
|
|
Gustavo Moreira
|
c82ef0cfd2
|
intel: address translation: performance improvements caching by page address
|
2025-01-31 19:29:33 +11:00 |
|
|
Gustavo Moreira
|
b91724c3ef
|
Replace *_to_string() for a block reader implementation for better performance. Add new address_to_string() helper
|
2025-01-31 18:48:52 +11:00 |
|
|
Gustavo Moreira
|
9218e0e07f
|
fix double null-termination search
|
2025-01-31 18:47:11 +11:00 |
|
|
ikelosandGitHub
|
ad0000e36a
|
Merge pull request #1509 from gcmoreira/linux_module_symbols_improvements
linux: module symbols: Fixes and code improvements
|
2025-01-30 10:48:28 +00:00 |
|
|
ikelosandGitHub
|
9b532ad307
|
Merge branch 'develop' into linux_module_symbols_improvements
|
2025-01-30 10:37:46 +00:00 |
|
|
ikelosandGitHub
|
8a4f344c26
|
Merge pull request #1332 from gcmoreira/linux_vmcoreinfo_aslr_and_plugin
Linux: Address limitations in determining KASLR shifts by introducing VMCoreInfo support
|
2025-01-30 10:25:25 +00:00 |
|
|
Gustavo Moreira
|
981e097567
|
linux: module object extension: Revert the changes to get the ELF symbol index
|
2025-01-30 21:03:33 +11:00 |
|
|
Gustavo Moreira
|
67a83871ad
|
linux: module object extension: Add a function to return the extended ELF symbol information (symbol object and its index) so that doesn't change the get_symbols() interface
|
2025-01-30 20:54:38 +11:00 |
|
|
Gustavo Moreira
|
f3095513a1
|
linux: elf_sym: use a class attribute for the symbol max length
|
2025-01-30 20:26:51 +11:00 |
|
|
Gustavo Moreira
|
5d2819a98d
|
linux: elf: fix imports
|
2025-01-30 20:25:22 +11:00 |
|
|
Gustavo Moreira
|
e8934e94ce
|
Merge branch 'develop' into linux_module_symbols_improvements
|
2025-01-30 19:53:50 +11:00 |
|