Mike Auty
e9a6f3214c
Add comment for where to apply the fix
2025-02-23 20:29:29 +00:00
ikelos and GitHub
2ffb3ac6b1
Merge pull request #1623 from volatilityfoundation/issues/issue1618
...
Layers: Reduce double bounds test and simplify intel translation
2025-02-21 19:54:33 +00:00
Mike Auty
3ea563bde8
Windows: Use built-in libraries where possible (idea from #1627 )
2025-02-19 18:48:32 +00:00
ikelos and GitHub
e0902ad7df
Merge pull request #1621 from volatilityfoundation/issue_1487_driver_handling
...
Stop reporting terminated/smeared drivers. Enforce names present. Add…
2025-02-16 21:24:13 +00:00
Andrew Case
7a533054f7
Address feedback
2025-02-16 21:24:33 +00:00
Mike Auty
346e58e798
Layers: Reduce double bounds test and simplify intel translation
2025-02-16 18:50:44 +00:00
Mike Auty
d5976146fb
Layers: Restore get_valid_table caching
...
Partially restore performance as per #1618
2025-02-16 18:24:23 +00:00
Andrew Case
ca5f811405
Stop reporting terminated/smeared drivers. Enforce names present. Add kernel start checking in all places
2025-02-15 21:26:54 +00:00
ikelos and GitHub
81bac4db11
Merge pull request #1613 from Abyss-W4tcher/linux_pagecache_recoverfs
...
New plugin: linux.pagecache.recoverfs
2025-02-15 16:26:17 +00:00
Abyss Watcher
2bf0a26c73
typos
2025-02-15 15:28:23 +01:00
Abyss Watcher
b86e54e427
extra checks and debug messages
2025-02-15 15:25:26 +01:00
Abyss Watcher
c2f8697cc5
normalize symlinks by relying on purepath
2025-02-15 15:24:53 +01:00
Abyss Watcher
51b66f7573
add symlink details in description
2025-02-15 14:14:02 +01:00
Abyss Watcher
9484430036
convert private classmethods to simple methods
2025-02-15 13:16:58 +01:00
ikelos and GitHub
a982939122
Merge pull request #1608 from volatilityfoundation/issue_1319_dumpfiles
...
Switch virtual and physical addresses to lists to support dumping mul…
2025-02-15 10:29:42 +00:00
Andrew Case
49b40eb30a
Make black happy
2025-02-15 00:36:12 +00:00
Andrew Case
6babe158f0
Address feedback
2025-02-15 00:35:31 +00:00
ikelos and GitHub
0ea766a0ad
Merge pull request #1620 from volatilityfoundation/issue_1474_orphan_threads
...
Enforce kernel boundaries correctly. Fix bugs. Closes #1474
2025-02-14 20:38:48 +00:00
Andrew Case
92db0e3f08
Address feedback
2025-02-14 20:42:00 +00:00
Andrew Case
9b78099a08
Enforce kernel boundaries correctly. Fix bugs. Closes #1474
2025-02-14 19:24:26 +00:00
ikelos and GitHub
575e645f4f
Merge pull request #1615 from volatilityfoundation/dgmcdona/envars_unbound_locals
...
Windows Envars: Fix unbound locals
2025-02-13 22:49:19 +00:00
ikelos and GitHub
3f2a514cc2
Merge pull request #1616 from volatilityfoundation/dgmcdona/windows_cmdline_output
...
Windows Cmdline: Clean up output
2025-02-13 22:47:40 +00:00
ikelos and GitHub
4172a574d5
Merge pull request #1617 from volatilityfoundation/dgmcdona/windows_envars_silent_vars
...
Windows Envars: Remove extra config check
2025-02-13 22:36:45 +00:00
David McDonald
4712cafa4b
Windows Envars: Remove extra config check
...
Tiny bit of cleanup here - there's no need to re-check the config for
`SILENT` for each variable. We can just initialize it once as either an
empty list or the calculated list of silent vars depending on the config
value.
2025-02-12 10:23:46 -06:00
David McDonald
bcbfc27d4f
Windows Cmdline: Clean up output
...
The strings being used as return values here would (IMO) be better as
debug statements, with the plugin returning
`renderers.UnreadableValue()` for any of the `InvalidAddressException`
code paths.
2025-02-12 10:11:23 -06:00
David McDonald
443cfd2515
Windows Envars: Fix unbound locals
...
Technically, these were protected against `UnboundLocalError` exceptions
through the use of the `sys` and `ntuser` boolean variables, but this
really isn't the best way to prevent that from happening, and
type-checkers still warn about the potentially unbound locals. This fix
instead uses the `sys` and `ntuser` variables to hold the registry keys,
preinitializing them to `None` and checking their value before
attempting to access instance methods.
2025-02-12 10:02:31 -06:00
Abyss Watcher
1530e62a86
typo
2025-02-11 17:59:19 +01:00
Abyss Watcher
de42e58bfa
require framework v2.21.0 for recoverfs
2025-02-11 17:54:19 +01:00
Abyss Watcher
999f3d0d2c
add superblock or device numbers path prepending
2025-02-11 17:48:34 +01:00
Abyss Watcher
f82fd53753
2.20.1 -> 2.21.0 bump
2025-02-11 17:46:03 +01:00
Abyss Watcher
ec61da6dac
add uuid property to super_block
2025-02-11 17:45:31 +01:00
Abyss Watcher
7732312809
switch property to functools.cached_property
2025-02-11 17:45:12 +01:00
Abyss Watcher
64d8a675a7
initial linux.pagecache.recoverfs
2025-02-10 11:49:23 +01:00
ikelos and GitHub
8dceeb2144
Merge pull request #1611 from Abyss-W4tcher/pre_linux_pagecache_recoverfs_2
...
Re-apply "Pre linux.pagecache.recoverfs support"
2025-02-09 18:14:24 +00:00
ikelos and GitHub
7e94d76283
Merge pull request #1601 from volatilityfoundation/issues/kvo-optional
...
Issues/kvo optional
2025-02-09 15:53:48 +00:00
Mike Auty
444376cbba
Fix typos and try setting back requirement change
2025-02-09 15:39:49 +00:00
ikelos and GitHub
f744d03ecc
Merge pull request #1610 from Abyss-W4tcher/linux_tracing_tracepoints
...
New plugin: linux.tracing.tracepoints
2025-02-09 13:04:00 +00:00
Abyss Watcher
f1b34df26b
2.0.2 -> 3.0.0 InodePages bump
2025-02-09 13:49:24 +01:00
Abyss Watcher
826281b3b9
add and use write_inode_content_to_stream
2025-02-09 13:48:59 +01:00
Abyss Watcher
223f2d69bb
switch to context and layer_name calling convention
2025-02-09 13:47:37 +01:00
Abyss Watcher
03f6fa9533
1.0.3 -> 1.1.0 Files bump
2025-02-09 13:45:46 +01:00
Abyss Watcher
8d9d0f5689
add and use follow_symlinks parameter
2025-02-09 13:45:23 +01:00
Abyss Watcher
b9d4605b8a
switch to InodeUser.format_symlink
2025-02-09 13:44:16 +01:00
Abyss Watcher
cd9ba823a1
add inode_size and format_symlink to InodeUser
2025-02-09 13:42:47 +01:00
Abyss Watcher
8d23d5b808
use architectures.LINUX_ARCHS
2025-02-09 13:41:46 +01:00
Abyss Watcher
a9691fbe77
remove unnecessary object creation
2025-02-09 12:41:23 +01:00
Abyss Watcher
83dde6aec3
improve prel32 comments
2025-02-09 12:26:42 +01:00
ikelos and GitHub
ca420d9a5d
Merge pull request #1607 from volatilityfoundation/issue_1475_ldrmodules
...
Make a generic DLL enumeration function that ensures the base address…
2025-02-08 19:40:56 +00:00
Abyss Watcher
0abe258765
initial linux.tracing.tracepoints.CheckTracepoints
2025-02-08 15:41:02 +01:00
ikelos and GitHub
7719d29881
Merge pull request #1609 from volatilityfoundation/unloaded_modules_valid_modules_only
...
Prevent yielding smeared/broken modules from the unloaded module list
2025-02-08 00:17:07 +00:00
Mike Auty