Mike Auty
eb38756dbe
CLI: Add deprecation warning to --write-config
2022-03-16 01:35:47 +00:00
Mike Auty
fa723ec134
CLI: Implement specifying a config name to write
2022-03-16 01:29:20 +00:00
ikelos and GitHub
7d17c191e5
Merge pull request #675 from paulkermann/bugfix/is_vad_empty
...
Windows Malfind is_vad_empty error
2022-03-15 12:31:56 +00:00
Paul Kermann
7c89fc3f07
bug fix :(
2022-03-15 14:22:36 +02:00
ikelos and GitHub
e1c157eb71
Merge pull request #673 from volatilityfoundation/feature/better-csv-support
...
Renderers: Use built-in python CSV support
2022-03-15 09:01:28 +00:00
ikelos and GitHub
6c84568031
Merge pull request #660 from volatilityfoundation/feature/better-dtb-detection
...
Feature/better dtb detection
2022-03-13 22:05:31 +00:00
Mike Auty
0de8c645a4
Renderers: Add column headers for CSV
2022-03-13 21:20:04 +00:00
Mike Auty
eba7ad1c0d
Renderers: Use built-in python CSV support
2022-03-13 21:13:25 +00:00
ikelos and GitHub
9aa0b5d6f7
Merge pull request #666 from volatilityfoundation/issues/issue631
...
Layers: Better checks on PAE page tables
2022-03-09 09:03:11 +00:00
ikelos and GitHub
b191626b0a
Merge pull request #669 from Digitalisx/fix/typo-error
...
Fix Typo Error for some plugins, documents
2022-03-08 19:58:31 +00:00
Donghyun Kim
18770d0cd3
Fix glossary.rst Typo Error
2022-03-09 02:09:47 +09:00
Donghyun Kim
6c1fe42a37
Fix Docs, Framework, Windows Plugin Typo Error
2022-03-09 01:53:04 +09:00
Donghyun Kim
34a732a4f0
Fix Object Typo Error
2022-03-07 14:00:03 +09:00
Donghyun Kim
a1023e51f5
Fix Renderes, Scanners, MFT Symbol Typo Error
2022-03-07 13:54:35 +09:00
Mike Auty
244751e9ae
Layers: Better checks on PAE page tables
...
This checks that the very top level table points to the next four pages,
as we'd expected in general. This relies on the same assumptions as the
existing PAE detection did, ie that the PAE page_map maps the next four
pages immediately.
Previously we didn't check that the top page was valid, once we found
the self-referential pointer. This adds in an appropriate check to
reduce false positives.
Closes #631 .
2022-03-06 18:48:00 +00:00
Donghyun Kim
639f87a0a4
Remove Tab
2022-03-05 16:29:40 +09:00
Donghyun Kim
f060562b27
Rebase
2022-03-05 16:29:09 +09:00
Donghyun Kim
ad1ef807e7
Context Typo Error, MFT Symbol JSON Prettier
2022-03-05 16:27:07 +09:00
Donghyun Kim and GitHub
6cb2b2bf84
Merge branch 'volatilityfoundation:develop' into develop
2022-03-05 15:43:38 +09:00
Mike Auty
670401eac7
Windows: Test unicode strings for length 0
...
In some tests we were checking whether asking for the string value threw
an InvalidAddressException through an error as to whether we should look
elsewhere for the data. As of commit 265b2825#652 ), meaning we need to check for length 0
as well as invalid pointers.
If this crops up often, we may need to revisit the decision to make sure
its in keeping with how windows treats zero length strings, but for now
we only did it once for registry keys.
Closes #665
2022-03-03 20:35:39 +00:00
Donghyun Kim
49308eb18d
Restore PR
2022-03-03 02:03:31 +09:00
Donghyun Kim
dae8860577
Restore PR
2022-03-03 02:02:43 +09:00
Donghyun Kim
58782fcfe1
Typo Error Fix - Context module object Args code comment
2022-03-03 02:00:32 +09:00
Donghyun Kim
9868aeb906
Add Error Raise point
2022-02-28 14:12:25 +09:00
Donghyun Kim
f156d237a4
Add 'ImportError' handling of the capstone module on malfind plugin.
2022-02-28 13:36:54 +09:00
ikelos and GitHub
9f8f6b2899
Merge pull request #658 from volatilityfoundation/feature/workaround-python-46654
...
Layers: Fix opening UNC paths on windows
2022-02-26 13:26:48 +00:00
ikelos and GitHub
03b2efa58f
Merge pull request #659 from volatilityfoundation/issues/issue652-2
...
Objects: Don't try to read 0 bytes when unmarshalling
2022-02-26 13:26:09 +00:00
Mike Auty
1b09f20b5c
Windows: Raise PE extraction size and make it a constant
2022-02-26 13:21:34 +00:00
Mike Auty
78b3553b2a
Objects: Implement minor code optimization by @paulkermann
2022-02-25 16:33:54 +00:00
Mike Auty
265b282569
Objects: Don't try to read 0 bytes when unmarshalling
2022-02-23 22:53:54 +00:00
ikelos and GitHub
9a0ba988ab
Merge pull request #609 from volatilityfoundation/issues/issue599
...
Automagic: Warn when multiple symbol files match a banner
2022-02-23 21:44:28 +00:00
Mike Auty
579a0b8735
Layers: More documentation and don't break correct URLs
2022-02-23 00:08:10 +00:00
Mike Auty
58697479bb
Layers: Fix opening UNC paths on windows
2022-02-23 00:00:07 +00:00
ikelos and GitHub
aa198f2709
Merge pull request #657 from paulkermann/bugfix/get_guid_from_mz
...
Fix read whole module
2022-02-22 01:09:13 +00:00
Paul Kermann
f2e3df27f4
fix read whole module
2022-02-21 14:57:31 +02:00
ikelos and GitHub
c024c2eecb
Merge pull request #644 from paulkermann/bugfix/object_info
...
Object information ChainMap invalid order
2022-02-20 23:22:56 +00:00
ikelos and GitHub
4a1c701ff4
Merge pull request #651 from volatilityfoundation/feature/volshell-kernel-requirement
...
Volshell: Update to use KernelRequirement
2022-02-20 22:59:28 +00:00
Paul Kermann
bfc4c50e67
related
2022-02-20 14:49:06 +02:00
ikelos and GitHub
a2b0bdfe25
Merge pull request #653 from paulkermann/feature/fast_pdb_scanning
...
Improve slow pdb scanning
2022-02-17 14:13:31 +00:00
Paul Kermann
3036875136
run optimized scan before slow scan
2022-02-17 16:10:44 +02:00
Paul Kermann
da7dd32271
Improve slow pdb scanning
2022-02-17 15:31:48 +02:00
Mike Auty
e6c3c94a10
Volshell: Update docs slightly
2022-02-17 01:46:54 +00:00
Mike Auty
9fb59e4714
Volshell: Further improvements for mac/linux
2022-02-17 01:43:50 +00:00
Mike Auty
094a3c0a47
Volshell: Update to use KernelRequirement
2022-02-17 00:21:59 +00:00
ikelos and GitHub
96d4aafd6c
Merge pull request #647 from volatilityfoundation/issues/issue646
...
Fix infinite loop in mftscan and timeliner body file updates
2022-02-14 20:35:24 +00:00
ikelos and GitHub
f5ecdbe28d
Merge pull request #645 from pudii/issues/issue313
...
Implement LDRmodules plugin
2022-02-14 01:12:21 +00:00
Mike Auty
22a7328e4c
Windows: Prevent infinite loop in mftscan
2022-02-13 20:45:42 +00:00
pudii
12c3f34037
Add comments and fix minor code issues
2022-02-13 18:29:35 +01:00
Mike Auty
9cabf5362b
Timeliner: Write out directly to the body file
...
Since the body file doesn't need sorting, we can output it immediately,
and this also means that partial results can be recorded even in the run
is terminted before it compeletes.
Goes someway to improving #646
2022-02-13 00:19:32 +00:00
pudii
cf11de174a
Implement LDRmodules plugin
2022-02-11 18:19:53 +01:00
Mike Auty