ikelos and GitHub
e2cdbdc2bf
Merge pull request #1382 from j-t-1/PYO
...
PEP 488 – Elimination of PYO files
2024-12-06 00:26:21 +00:00
j-t-1 and GitHub
f11ef06c27
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 21:30:20 +00:00
j-t-1 and GitHub
5acf8858d9
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 18:31:04 +00:00
Mike Auty
3ff304ceed
Layers: Fix intel bug introduced in commit 73d4f2f
...
The patch failed to mask the incoming address to the maximum physical
address. This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.
Fixes #1374 .
Thanks to @the-rectifier for quickly identifying the issue!
2024-12-03 19:58:23 +00:00
ikelos and GitHub
e4c552050c
Merge pull request #1377 from gcmoreira/pytest_image_autoselection_improvement
...
Testing: Enable automatic OS image selection by matching test name and image filename prefixes
2024-12-01 11:06:46 +00:00
ikelos and GitHub
fbc72d35b9
Merge pull request #1368 from gcmoreira/linux_pslist_dependencies_fix_1366
...
Linux pslist dependencies fix 1366
2024-12-01 11:00:12 +00:00
ikelos and GitHub
4d628c839b
Merge pull request #1376 from gcmoreira/fix_pretty_renderer_hex_bytes_as_text
...
Renderers - Fix HexBytes formatter for pretty renderer
2024-12-01 10:52:00 +00:00
Gustavo Moreira
535ce3a22a
testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment.
...
For example, when using VSCode with pytest, test autodiscovery triggers pytest_generate_tests(), adding all images to each test case. This causes issues, as Linux tests end up being executed with Windows and Mac images, and vice versa.
2024-12-01 19:34:35 +11:00
Gustavo Moreira
c19a54cbd9
testcases: Minor cleanup: Renaming and reordering functions to align with the Linux/Windows test cases
2024-12-01 14:08:53 +11:00
Gustavo Moreira
7ae27c4eaa
Merge branch 'develop' into linux_pslist_dependencies_fix_1366
2024-12-01 13:24:53 +11:00
Gustavo Moreira
3c20e46902
renderers: Fix HexBytes formatter to apply padding also at the end of the string, ensuring proper output alignment when the pretty renderer justifies each line to the right
2024-12-01 12:36:35 +11:00
ikelos and GitHub
9222f4915a
Merge pull request #1371 from volatilityfoundation/issues/use-yara-scanner-over-handling-yara-directly
...
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-12-01 01:26:04 +00:00
Mike Auty
d404747de5
Tests: Add in vadyarascan tests
2024-12-01 00:04:46 +00:00
Mike Auty
2dc1686289
Windows: Protect the SERICE_RECORD is_valid function a little more
...
The request to .Order could fail depending on where the structure lies
in memory.
2024-11-30 13:36:17 +00:00
Mike Auty
56f6ef0add
Include a test developed by @gcmoreira and @eve-mem
2024-11-30 11:52:16 +00:00
Mike Auty
3df385369c
Ensure the VAD/VMA gets scanned in a single block
2024-11-30 11:28:09 +00:00
ikelos and GitHub
ba98b088cb
Merge pull request #1369 from gcmoreira/logging_producer_information
...
Linux/Mac: Log producer metadata information
2024-11-29 10:27:32 +00:00
Mike Auty
393db1050f
Windows: protect again mz_offsets being None
2024-11-29 08:51:06 +00:00
Mike Auty
0030129ff8
Make suggested fixes to reduce loops and ignore insane sections
2024-11-29 08:43:04 +00:00
Gustavo Moreira
77778ee6f6
Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys
2024-11-29 19:35:18 +11:00
Gustavo Moreira
b8023f0c97
Linux/Mac: Address code review suggestions
...
- Add getters for Linux/Mac ISF sources
- Avoid using internal attributes
- Use the dict repr instead of walking the dict to simplify code
2024-11-29 19:05:27 +11:00
Mike Auty
bec6bc6594
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-11-28 16:59:52 +00:00
Mike Auty
3748cb89b8
Windows: Improve debugging output for pdbscan
2024-11-28 10:22:49 +00:00
Gustavo Moreira
8ecd7e2ddd
Linux/Mac: Log producer information
2024-11-28 15:17:22 +11:00
Gustavo Moreira
aaeec80fdf
linux: library_list testcase: Optimize testing performance by limiting the number of processes to just one. This change will reduce execution time and speed up the test
2024-11-28 13:53:11 +11:00
Gustavo Moreira
9048cd1ab8
linux: boottime: Minor, removed unnecessary blank line
2024-11-28 13:47:03 +11:00
Gustavo Moreira
fb4ab9d477
linux: test cases: remove unused variables
2024-11-28 13:45:26 +11:00
Gustavo Moreira
63ac0abe64
linux: Add 15 new test cases for plugins dependent on pslist
2024-11-28 13:25:08 +11:00
Gustavo Moreira
fa06064635
linux plugins: Update pslist major version and its 18 dependent plugins
2024-11-28 13:16:33 +11:00
Gustavo Moreira
97534f02de
linux: sockstat: It should import and verify the pslist version directly, instead of relying on lsof
2024-11-28 12:19:56 +11:00
Gustavo Moreira
7c559c53f4
test_cases: underscore unused variables
2024-11-28 12:11:14 +11:00
ikelos and GitHub
0233193c9d
Merge pull request #1335 from gcmoreira/linux_prot_none_L1TF_and_layer_addr_translation_fixes
...
Linux - PROT_NONE, L1TF mitigation and layer address translation fix
2024-11-27 10:31:18 +00:00
Gustavo Moreira
eff2a529c8
Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation
2024-11-27 18:10:14 +11:00
Gustavo Moreira
641e008caf
Linux: intel: The non-present mapping shouldn't be inverted
2024-11-27 15:06:33 +11:00
ikelos and GitHub
bdd3e1e48e
Merge pull request #1365 from volatilityfoundation/issues/pr1343
...
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:58:04 +00:00
Mike Auty
523a6e92fc
CLI: Apply black to recent changes
2024-11-24 09:33:30 +00:00
lesander and Mike Auty
1a0d1a238d
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:31:26 +00:00
ikelos and GitHub
47baec8bba
Merge pull request #1363 from volatilityfoundation/issues/fix-linuxstacker-to-use-cache-interface
...
Core: Add in generic cache-manager chooser function
2024-11-24 09:19:02 +00:00
ikelos and GitHub
15f2011eed
Merge pull request #1342 from lesander/improvement/remove-requirements-and-setup
...
Update pyproject.toml and remove requirements and setup files
2024-11-23 18:58:21 +00:00
Mike Auty
4bc6e1001d
Windows: Improve logging of slowscan to show possible PDB entries
2024-11-22 19:45:15 +00:00
ikelos and GitHub
4c55c0fe43
Merge pull request #1353 from eve-mem/regex_plugins
...
Add first version of regex scanning plugins
2024-11-22 12:26:34 +00:00
Mike Auty
76ecfc0883
Core: Add in generic cache-manager chooser function
2024-11-22 12:16:14 +00:00
ikelos and GitHub
fb101de6fc
Merge pull request #1362 from c0rydoras/fix/cache-dir
...
Follow XDG Base Directory Specification for cache directory
2024-11-22 11:32:57 +00:00
Arthur Deierlein
a2b96c0dc0
fix: dont use / for compat
2024-11-22 11:46:59 +01:00
Arthur Deierlein
b93d5b7c13
update docs
2024-11-22 11:23:56 +01:00
Arthur Deierlein
1abb4cc881
comply with xdg base directory spec by using XDG_CACHE_HOME if its set
2024-11-22 11:13:21 +01:00
ikelos and GitHub
ac482e3e13
Merge pull request #1359 from eve-mem/windows_svcscan_remove_yara_dep
...
Windows: Remove dep on vadyarascan from svcscan plugin
2024-11-18 22:29:15 +00:00
eve
1ba5b04b7d
Windows: Remove dep on vadyarascan from svcscan plugin
2024-11-18 21:20:04 +00:00
eve
e374ca9647
Windows.vadregexscan: update imports, revert vadyarascan changes
2024-11-18 21:15:06 +00:00
eve
07701fc4cf
windows.vadregexscan: remove dependency on vadyarascan
2024-11-18 18:32:51 +00:00
