ikelos and GitHub
f33e9daa48
Merge pull request #1707 from volatilityfoundation/1471-registry-plugins-spread-across-directories-needs-standardization
...
1471 registry plugins spread across directories needs standardization
2025-03-27 16:36:58 +00:00
70e101ff90
Potential fix for code scanning alert no. 407: First argument to super() is not enclosing class
...
Think this is more correct
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-03-27 14:13:25 +00:00
Dave Lassalle
bfc7e01d75
fix merge conflicts
2025-03-27 08:25:34 -05:00
Dave Lassalle
ef29008cc8
#1471 - fix class deprecation and update other plugins
2025-03-26 17:53:19 -05:00
ikelos and GitHub
8de46033d7
Merge pull request #1737 from Abyss-W4tcher/additional_windows_testing
...
Windows: Additional testing
2025-03-26 20:30:15 +00:00
Abyss Watcher
dca182dc72
trigger tests
2025-03-26 15:59:35 +01:00
ikelos and GitHub
f74082ec36
Merge pull request #1742 from volatilityfoundation/1741-consoles-requirements
...
Consoles: Fix requirement versions
2025-03-26 14:50:15 +00:00
David McDonald
1c21b3cd04
Consoles: Fix requirement versions
...
When I updated the requirements for `Consoles` in #1738 , I bumped the
version number on the `VerInfo` requirement instead of on the `Info`
requirement.
closes #1741
2025-03-26 09:07:32 -05:00
Abyss-W4tcher and GitHub
ff8d6dbd42
Merge branch 'develop' into additional_windows_testing
2025-03-26 14:42:14 +01:00
Abyss Watcher
b80a34110e
adjust thrdscan
2025-03-26 14:41:05 +01:00
Dave Lassalle
f431f519b6
#1471 - black and ruff fixes
2025-03-26 08:22:37 -05:00
Dave Lassalle
67533b034a
#1471 - deprecation class for moving
2025-03-26 08:21:28 -05:00
ikelos and GitHub
4fd0f20ff9
Merge pull request #1739 from volatilityfoundation/fix_thrdscan_checks
...
Fix checks in thrdscan that broke tests
2025-03-26 00:55:32 +00:00
Andrew Case
444305afc2
Handle kernel processes properly this time
2025-03-26 00:55:48 +00:00
Andrew Case
43ab95f4c5
Change thrdscan from looking for kernel processes
2025-03-26 00:50:34 +00:00
Andrew Case
e52aea886e
Fix checks in thrdscan that broke tests
2025-03-26 00:41:26 +00:00
ikelos and GitHub
2ebda44482
Merge pull request #1738 from volatilityfoundation/framework/missing_version_requirements
...
Framework: Missing `VersionRequirement`s
2025-03-25 23:16:25 +00:00
David McDonald
66992a5d9a
Requirements: Insert missing version requirements
...
This audits the entire codebase for missing `VersionRequirements` and
adds them as needed.
2025-03-25 17:44:35 -05:00
David McDonald
d5fc050224
Timeliner: add VersionableInterface superclass
...
This adds `interfaces.configuration.VersionableInterface` as a
superclass to `TimelinerInterface` in order to be consistent with other
versioned interfaces such as `PluginInterface`.
2025-03-25 17:44:35 -05:00
Abyss Watcher
d70d8820a9
use winxp against scanner plugins (performances)
2025-03-25 11:41:28 +01:00
ikelos and GitHub
b881fa1fac
Merge pull request #1731 from volatilityfoundation/process_ghosting_update_with_delete_on_close
...
Add delete on close detection to process ghosting. Update plugin to c…
2025-03-25 09:15:23 +00:00
ikelos and GitHub
d0e32e593a
Merge pull request #1735 from volatilityfoundation/issue_1732_pe_symbols
...
Fix issue when pe_symbols limited to searching one process. Remove ne…
2025-03-25 09:13:52 +00:00
ikelos and GitHub
4ac8599d17
Merge pull request #1730 from volatilityfoundation/threads_useful_columns
...
Add win32 start address listing. Add paths for both thread starting a…
2025-03-25 09:12:57 +00:00
Andrew Case
3a4e622854
Change pending checking and OS version
2025-03-24 20:19:59 -05:00
Andrew Case
1a2427b54b
Change column order
2025-03-24 20:18:54 -05:00
Andrew Case
0f098fc160
Address feedback
2025-03-24 20:13:10 -05:00
Andrew Case and GitHub
19520799bb
Merge branch 'develop' into threads_useful_columns
2025-03-24 20:03:07 -05:00
ikelos and GitHub
083dae71b4
Merge pull request #1733 from volatilityfoundation/add-script-only-volshell-feature
...
Add a --script-only flag that exits after the given volshell script i…
2025-03-25 00:51:50 +00:00
ikelos and GitHub
e527f76a2d
Merge pull request #1734 from volatilityfoundation/plugin_requirement_deprecation
...
Framework: Replace PluginRequirements
2025-03-25 00:48:31 +00:00
ikelos and GitHub
46561dd664
Merge pull request #1728 from volatilityfoundation/add_perf_events
...
Add performance event plugin to detect eBPF malware
2025-03-25 00:17:55 +00:00
ikelos and GitHub
6dc0157841
Merge pull request #1729 from the-rectifier/volshell_byteorder
...
Volshell: Add byteorder argument for display_* functions
2025-03-25 00:10:19 +00:00
Abyss Watcher
6a28d1432f
adjust curl cmds
2025-03-24 20:39:44 +01:00
Andrew Case
166d0e0c14
Fix issue when pe_symbols limited to searching one process. Remove need to track symbol indexes. Provide much more useful debugging information. Fixes #1732
2025-03-24 19:37:59 +00:00
Abyss Watcher
f80b207aab
download symbols_win-10_19041-2025_03.zip
2025-03-24 20:36:25 +01:00
David McDonald
a6f9a0e95b
Framework: Replace PluginRequirements
...
This replaces all uses of `requirements.PluginRequirements` with
`requirements.VersionRequirement`.
2025-03-24 11:30:17 -05:00
Andrew Case
003c139597
Add a --script-only flag that exits after the given volshell script is completed
2025-03-24 15:10:37 +00:00
Andrew Case
36b66f00fe
Add delete on close detection to process ghosting. Update plugin to current coding flow
2025-03-24 05:05:08 +00:00
Andrew Case
e3d35aa425
update from feedback
2025-03-24 02:49:31 +00:00
Andrew Case
57c07631b0
Add win32 start address listing. Add paths for both thread starting address types
2025-03-23 21:23:42 -05:00
Odysseas Stavrou
bb39081e33
Volshell: Add byteorder argument for display_* functions
2025-03-23 22:29:16 +02:00
Andrew Case
6763031df8
Add performance event plugin to detect eBPF malware
2025-03-21 20:28:23 +00:00
ikelos and GitHub
0ddec14cf9
Merge pull request #1724 from volatilityfoundation/dgmcdona/windows_timers_raw_dpc_offset
...
Windows: Fix raw Dpc offset calculation
2025-03-20 20:28:18 +00:00
David McDonald
d097d6abeb
Timers: convert general Exception to InvalidAddressException
2025-03-20 15:18:08 -05:00
David McDonald
c4589a51d5
Timers: Adds debug log statement to catch-all exception
2025-03-20 15:13:26 -05:00
David McDonald
1e175b5d3b
Objects: rework new get_raw_value() method
...
Per code review recommendations, splits the `_unmarshall` classmethod
into two components, one of which retrieves the raw value, and the other
that returns the masked pointer. The `get_raw_value` method now calls
the `_get_raw_value` classmethod using its instance information.
2025-03-20 15:11:37 -05:00
David McDonald
144fd3139a
Framework: Minor version bump
...
Made an additive change to `Pointer` by adding the `get_raw_value()`
method, so bumping the minor version here. The `get_raw_dpc()` method
was removed from the `KTIMER` extension class, which is currently
unversioned.
2025-03-20 14:38:19 -05:00
David McDonald
a8ea3aae01
Extensions: Removes the get_raw_dpc method from KTIMER
...
This removes the `get_raw_dpc` method from the `KTIMER` extension class.
This method was inaccurate in that it actually returns the masked
pointer value instead of the full 64-bit value encoded in that member,
which is required in order to correctly decode the 'real' pointer.
The invocation of `get_raw_dpc()` was replaced with
`self.Dpc.get_raw_value()`, which was added in the previous commit.
2025-03-20 14:32:04 -05:00
David McDonald
7b9fb91672
Objects: create get_raw_value() method for Pointer
...
This creates a `get_raw_value()` method for the `Pointer` class that
allows users to access the raw (unmasked) value of a pointer. This was
required in order to decode the encoded `Dpc` pointer that is part of
the `_KTIMER` Windows type. Addition of this type was favored over a
cast to `unsigned long` or `unsigned long long` due to the potential for
future instability of this type due to compiler changes.
See https://github.com/volatilityfoundation/volatility3/issues/1041 for
further discussion around the conversion of `log unsigned int` to
`unsigned long` in `clang`.
See https://github.com/volatilityfoundation/volatility3/pull/1177#discussion_r1650049299
for the original discussion around how to access this pointer in the
`Timers` plugin.
2025-03-20 14:23:24 -05:00
ikelos and GitHub
369f37ec43
Merge pull request #1727 from volatilityfoundation/kallsyms_fixes_round2
...
Hopefully final round of kallsym fixes
2025-03-20 18:26:23 +00:00
Andrew Case
548657c309
Change None check to remove False booleans
2025-03-20 15:02:22 +00:00
