ikelos and GitHub
efa4959517
Merge pull request #1300 from Abyss-W4tcher/dirty_ioc_windows_malfind
...
[plugin] Add dirty state IoC detection to malfind
2024-11-07 13:44:56 +00:00
Abyss Watcher
a5253ac276
re-trigger black
2024-11-07 13:40:18 +01:00
ikelos and GitHub
130d1188e8
Merge pull request #1307 from dgmcdona/dgmcdona/windows-scheduled-tasks
...
Windows: Adds scheduled tasks plugin
2024-11-06 22:58:25 +00:00
ikelos and GitHub
a00a59cd23
Merge pull request #1329 from gcmoreira/linux_fix_merge_hidden_modules
...
linux: hidden_modules: Fix mess with merge #1283
2024-10-30 22:17:59 +00:00
Gustavo Moreira
e183f81de6
linux: hidden_modules: Fix mess with merge #1283
2024-10-31 08:28:07 +11:00
ikelos and GitHub
0ee0f4488e
Merge pull request #1283 from gcmoreira/linux_hidden_modules
...
Add linux hidden_modules plugin
2024-10-30 20:46:36 +00:00
Gustavo Moreira
4f86b3f1c0
Merge branch 'develop' into linux_hidden_modules
2024-10-31 07:26:11 +11:00
ikelos and GitHub
73f8ddbf47
Merge pull request #1328 from gcmoreira/linux_module_mod_mem_type_cache
...
Linux refactory module extension object mod_mem_type cache
2024-10-30 15:32:55 +00:00
ikelos and GitHub
efe1e1e579
Merge pull request #1326 from gcmoreira/linux_pagecache_fix_typing
...
Linux: PageCache API: Fix typing
2024-10-30 15:31:24 +00:00
ikelos and GitHub
6414c66804
Merge pull request #1327 from gcmoreira/linux_vfsmount_fix_type_comparison
...
Linux: vfsmount type: Fix type comparison
2024-10-30 15:30:43 +00:00
Gustavo Moreira
b098596687
Linux: module extension object: Add type annotation to the mod_mem_type property
2024-10-30 19:50:13 +11:00
Gustavo Moreira
aecf8d4327
Linux: module extension object: Refactor to replace custom property cache with functools.cached_property that's available from Python 3.8
2024-10-30 18:53:20 +11:00
Gustavo Moreira
84a2233d04
Linux: vfsmount type: Fix type comparison
2024-10-30 16:25:28 +11:00
Gustavo Moreira
cf94b078cd
Linux: PageCache API: Fix typing
2024-10-30 16:11:03 +11:00
Gustavo Moreira
722ccd527e
Linux: Extensions: Clean up the Linux constants imports in the object extension file
2024-10-30 12:56:09 +11:00
Gustavo Moreira
4b76b699ad
Linux: hidden_modules: Add docstrings and comments to enhance the documentation of the module verification process. Move the hardcoded values to the linux constants file.
2024-10-30 09:56:05 +11:00
Gustavo Moreira
f537c4a7e0
Merge branch 'develop' into linux_hidden_modules
2024-10-30 09:24:51 +11:00
Gustavo Moreira
8960bdab08
Linux: hidden_modules: Add a symbol table check for a recent dwarf2json version
2024-10-29 17:33:06 +11:00
Gustavo Moreira
1c6a548017
Linux: hidden_modules: Simplify symbols type checks
2024-10-29 17:30:47 +11:00
Gustavo Moreira
dfd8a1f195
Linux: hidden_modules: Include kernel version and commit details
2024-10-29 17:22:48 +11:00
Gustavo Moreira
cbe071ff3e
Linux: hidden_modules: Import the whole architectures module
2024-10-29 17:19:30 +11:00
Gustavo Moreira
526007f948
Linux: hidden_modules: Use child_template
2024-10-29 16:41:47 +11:00
David McDonald
efdbc27b95
Windows: Scheduled tasks - removes special time type
...
Removes the TaskSchedulerTime dataclass and discards the
is_localized value parsed with the timestamp.
2024-10-25 14:15:06 -05:00
David McDonald
0413cc5e26
Windows: Scheduled tasks - code review fixes
2024-10-25 12:56:18 -05:00
ikelos and GitHub
a1961401d5
Merge pull request #1320 from dgmcdona/dgmcdona/linux_pagecache_missing_iter_implementation
...
Linux: Extensions - removes abc.Iterable definition
2024-10-25 00:35:24 +01:00
David McDonald
4c2d2f98da
Removes collections.abc.Iterable superclass
...
Per @gcmoreira this is the correct fix vs the one previously proposed,
since self.vol.member_name cannot be used as the member name to
iterate this type.
2024-10-24 15:39:15 -05:00
David McDonald
388a3e6458
Linux: Adds missing abc.Iterable implementation
...
`hlist_head` is missing an implementation for
`collections.abc.Iterable`, resulting in a crash at runtime. This fixes
the issue by providing the required `__iter__` implementation for
`hlist_head`.
2024-10-24 14:39:22 -05:00
ikelos and GitHub
62aa9c1e12
Merge pull request #1318 from Abyss-W4tcher/use_volshell_additional_locals
...
Allow to import external locals in volshell environment
2024-10-24 00:05:32 +01:00
Abyss Watcher
7f2d8eabb7
set correct locals priority
2024-10-23 21:39:57 +02:00
Abyss Watcher
708d933021
use additional_locals in run method
2024-10-23 21:23:14 +02:00
ikelos and GitHub
1500d2ecf6
Merge pull request #1314 from gcmoreira/linux_add_hlist_head_object_extension_fix_1313
...
Linux adds hlist_head object extension
2024-10-22 23:21:04 +01:00
Gustavo Moreira
db8667f88a
Linux - Fix hlist_head object extension by dropping the iterator since it can't determine the correct member_name
2024-10-23 08:55:44 +11:00
Mike Auty
65daab6cfa
Linux: Fix minor coding style transgression
2024-10-22 21:47:13 +01:00
ikelos and GitHub
3e6ea7bb0e
Merge pull request #1290 from dgmcdona/dgmcdona/windows-unloadedmodules-traceback
...
Windows: unloadedmodules bugfix
2024-10-22 21:38:31 +01:00
ikelos and GitHub
b0a30c0652
Merge pull request #1238 from gcmoreira/linux_fix_mnt_namespace_issue_1187
...
Linux: Add support for the mount namespace in kernels 6.8+
2024-10-22 21:22:50 +01:00
ikelos and GitHub
51ac7600f5
Merge pull request #1315 from Abyss-W4tcher/rust_type_confusion_warning
...
dwarf2json rust type confusion sanity check
2024-10-22 21:20:22 +01:00
ikelos and GitHub
028502d772
Merge pull request #1288 from gcmoreira/linux_ptrace
...
Add Linux ptrace plugin
2024-10-22 21:11:44 +01:00
Gustavo Moreira
0ddd9210a8
linux: hidden_modules: Remove unused module imports
2024-10-16 15:08:59 +11:00
Gustavo Moreira
d98c7ebb1d
linux: hidden_modules: Make the fast method the default. Remove vol2 and fall back to a 1-byte alignment scan if addresses aren't aligned to the L1 cache size
2024-10-16 15:05:02 +11:00
Abyss Watcher
e739d96a33
dwarf2json rust type confusion sanity check
2024-10-14 14:03:38 +02:00
Gustavo Moreira
f00c4c3c39
Allows to create objects when using the same symbol table
2024-10-14 16:35:43 +11:00
Gustavo Moreira
15a51cf1ec
Linux - Add hlist_head object extension. Fix #1313
2024-10-14 16:13:56 +11:00
ikelos and GitHub
7b0cb4facd
Merge pull request #1304 from volatilityfoundation/feature/column-select-cli-only
...
Support hiding columns in the CLI
2024-10-13 22:32:14 +01:00
ikelos and GitHub
d1d45ca22f
Merge pull request #1311 from gcmoreira/linux_threads_support_from_6.7
...
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 22:31:33 +01:00
Gustavo Moreira
e3521147d6
Linux - Add support for task threads in kernels >= 6.7
2024-10-13 09:26:37 +11:00
ikelos and GitHub
a10fb5b4b6
Merge pull request #1308 from dgmcdona/dgmcdona/linux-netfilter-fix
...
Linux: Netfilter - fix traceback on missing module name
2024-10-11 18:28:34 +01:00
David McDonald
fb4dd924ce
Linux: Netfilter - fix traceback on missing module name
...
When the module name can't be found, `None` ends up in this field,
causing a traceback when rendering. This fixes it by replacing `None`
with `renderers.NotAvailableValue()`.
This occurred in the context of a netfilter hook from a hidden module.
2024-10-11 10:15:43 -05:00
David McDonald
57ef3f587e
Windows: Adds scheduled tasks plugin
...
This adds a plugin 'ScheduledTasks' that can decode binary-encoded
scheduled tasks from the Windows registry's SOFTWARE hive using a custom
reader that extends the `io.BytesIO` class. Decoding operations are
intended to be as fault tolerant as possible, swallowing exceptions and
returning `None` to account for smear or missing data.
Because each task can have mulitple triggers and multiple actions, a
single entry is generated for each trigger + action pair. In the event
that the either the actions could not be parsed or the triggers could
not be parsed due to missing or smeared data, an entry will still be
generated using the available information from the other registry value,
since trigger and action data is stored separately.
Much more information is decoded than is rendered, this was done
intentionally to avoid overpopulating the TreeGrid with less pertinent
data and to avoid an explosion of trigger and action-specific fields that
may not apply to most other entries.
2024-10-09 17:27:06 -05:00
Mike Auty
e817e72bc2
Support hiding columns in the CLI
2024-10-08 22:52:44 +01:00
Gustavo Moreira
620dd4e67d
Linux: ptrace: version patch number back to zero
2024-10-08 21:55:21 +11:00
