WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-25 15:42:24 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,453 Commits 80 Branches 17 Tags
f3e77ad645efcbfa3e3d2fb6284f85f9b1de59aa
Commit Graph
1929 Commits
Author SHA1 Message Date
Mike Auty f3e77ad645 Windows: Minor typos and JSON name change in sids plugins 2020-09-22 19:38:36 +01:00
memoryforensics1andikelos d1264e0134 Update __init__.py 2020-09-22 18:30:54 +01:00
memoryforensics1andikelos 30be4ee2ec fix get_sids function 
fix get_sids function in broken images
 2020-09-22 18:30:54 +01:00
memoryforensics1andikelos 31080ad416 fix 2020-09-22 18:21:58 +01:00
memoryforensics1andikelos a5d5ff2bda getsids getservicesids 2020-09-22 18:21:58 +01:00
Mike Auty 77312e193a Plugins: Update the banner plugin filename. 2020-09-22 00:25:20 +01:00
Mike Auty 0ac26d40a1 Plugins: Support mac banners as well 2020-09-22 00:21:13 +01:00
Mike Auty 0a57a49572 Plugins: Add LinuxBanners plugin 2020-09-22 00:21:13 +01:00
Andrew Caseandikelos e58e55b433 Update code for better variable names and minor version bump 2020-09-16 17:35:49 +01:00
Andrew Caseandikelos afe39eee1b Add new method for safe walking of generic list heads. Convert pslist to use it. 2020-09-16 17:35:49 +01:00
Mike Auty c82ad2fbd0 Windows: Fix callbacks is_vista_or_later 2020-09-15 01:28:48 +01:00
Andrew Caseandikelos 5e53440b43 Add the socket filters plugin for OSX 2020-09-13 22:06:09 +01:00
Andrew Caseandikelos 40eafa03e6 Change bad copy/descriptions for Mac that say Linux 2020-09-11 01:37:56 +01:00
Andrew Caseandikelos 98d6844ac0 Address ikelos's review comments 2020-09-11 01:28:14 +01:00
Andrew Caseandikelos 6673d4774c Add cached file listing plugin for Mac 2020-09-11 01:28:14 +01:00
lyles6andikelos 85775239b5 changed back to same format as get_parent 2020-09-10 09:13:31 +01:00
slyles1001andikelos 720f46a962 provides for vadnode and core 2020-09-10 09:13:31 +01:00
Mike Auty 8bf7ab9218 Bugfix: Vadinfo invalid exception 2020-09-10 01:39:10 +01:00
Mike Auty 00dcddbeb8 Framework: Prep master for additional commits 2020-09-10 00:07:00 +01:00
cecioandikelos 6972ae1cc8 in vadinfo.py, modified an exception handling and maxsize comparison 2020-09-08 23:32:54 +01:00
cesareandikelos d74032fd53 Added maxsize option to vadinfo as optional parameter, as in Vol2. 
Right now the default is set to 0 (no limit) as opposed to Vol2 where it is
set to 1GB.
 2020-09-08 23:32:54 +01:00
cecioandikelos 61d4ee3c0e some mods in comments 2020-09-08 22:36:09 +01:00
cecioandikelos 9c5dcda6e9 "pe" imported directly and little modification to comment 2020-09-08 22:36:09 +01:00
cecioandikelos d060a5cbdb dump of processes extracted by psscan (Issue #318) 2020-09-08 22:36:09 +01:00
Mike Auty 6b9ec5a079 Poolscanner: More native_layer validity checks 2020-09-08 02:45:20 +01:00
Mike Auty b04329e2e9 Poolscanner: Ensure File.Buffer checks right layer 2020-09-08 02:23:32 +01:00
Mike Auty 4a8ce9f104 Plugins: Relent on not allow default to be Optional 2020-09-02 11:27:53 +01:00
Mike Auty 752a62a216 Windows: Convert pstree to non-inheritted plugin 2020-09-02 11:13:39 +01:00
Mike Auty 96b68b9cdc Plugins: Don't ever insert an invalid value 2020-09-02 11:13:39 +01:00
memoryforensics1andikelos 37de4d45e7 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 74f1492097 fix 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 2408f26f1f fix, add cross_thread_flags to ETHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6be5716195 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 489dd0cf77 add KTHREAD struct 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 6487eb5596 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct 
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
 2020-09-02 10:52:53 +01:00
memoryforensics1andikelos 8a3ee4f0b7 add token object 
_TOKEN struct added
 2020-09-02 10:52:53 +01:00
Mike Auty 6c3176b32c Linux: Improve lengths for name_as_str 2020-09-01 23:36:21 +01:00
Mike Auty eb02ee1b81 Configuration: Give PluginRequirements simple type values 2020-09-01 15:44:57 +01:00
Mike Auty 7ea2340d31 Automagic: Refactor valid kernels to valid kernel 2020-09-01 09:02:13 +01:00
Mike Auty 4610be52f0 Automagic: PDBscan use one codepath for kvo setting 2020-09-01 09:02:13 +01:00
Mike Auty 1fc0a9d8d5 Automagic: PDBscan condensing of methods 2020-09-01 09:02:13 +01:00
Mike Auty 88214527ab PdbUtility: Fixes from npetroni (and restore progress) 2020-09-01 09:02:13 +01:00
Mike Auty b9e0670e90 PDBUtility: Refactor this to a more central place 2020-09-01 09:02:13 +01:00
Mike Auty c61edb54fb PDBUtility: Minor fixes 2020-09-01 09:02:13 +01:00
Mike Auty 613ae30893 Automagic: Heavily refactor pdbscan 
This separates out a new PDBUtility class that can take a (contiguous) layer and MZ
offset, and produce identify, download if necessary and load the
appropriate symbol table (if any).
 2020-09-01 09:02:13 +01:00
Mike Auty 6caebee079 Plugins: Populate optional defaults in plugin initialization 
Fixes issue #324.
 2020-08-31 23:10:22 +01:00
AsafEitaniandikelos 7ab72a1066 yapf and some corrections 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos 81d346438a Revert "changed config['dump'] to config.get('dump')" 
This reverts commit 0d3017f16c.
 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos 5a20f7e5bf Update dlllist.py 2020-08-31 17:05:20 +01:00
AsafEitaniandikelos c29f384f55 changed config['dump'] to config.get('dump') 
The config['dump'] caused some trouble in dlllist.
 2020-08-31 17:05:20 +01:00