WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,150 Commits 80 Branches 17 Tags
fbcaeccf7d5870be5f845da02aad32647d4f74e1
Commit Graph
4150 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
ikelosandGitHub fbcaeccf7d Merge pull request #857 from volatilityfoundation/driverirp_hidden_module_support 
Report IRP entries that point inside a hidden module. This is a commo…
 2024-03-04 14:58:45 +00:00
ikelosandGitHub d4b92db446 Merge pull request #960 from RuBublik/poolscanner-thread-support 
Add threads pool tag scanning
 2024-03-04 14:58:04 +00:00
ikelosandGitHub 110d9bef4a Merge pull request #1101 from gcmoreira/linux_library_list_plugin 
Linux: Add linux.library_list.LibraryList plugin
 2024-03-04 12:33:13 +00:00
Gustavo Moreira cb6f8c5072 Rename methods to be private 2024-03-04 20:47:49 +11:00
ikelosandGitHub 0fac32465f Merge branch 'develop' into poolscanner-thread-support 2024-03-03 23:48:24 +00:00
ikelosandGitHub cd81dfc8a5 Merge pull request #1106 from volatilityfoundation/feature/python3.12 
Documentation: Fix up syntax errors involving * character
 2024-03-03 23:21:48 +00:00
Gustavo Moreira b681438ddc Remove unnecessary 'pass' statement. 2024-02-29 16:21:34 +11:00
Gustavo Moreira 3c9af096e1 Add missing PAGE_SHIFT replacement 2024-02-29 16:17:47 +11:00
Gustavo Moreira 9b0915dc85 Add logging for unknown ELF types 2024-02-29 15:36:46 +11:00
Gustavo Moreira e6bc0c4100 Update author and modification time 2024-02-29 15:34:48 +11:00
Gustavo Moreira d5a0543a2d Use the ELF class constant instead of hardcoding a value. Fixed some f-strings 2024-02-29 15:34:20 +11:00
Gustavo Moreira 338106dfe8 Move the memory page parameters to the Intel layer 2024-02-29 14:46:35 +11:00
Mike Auty 0899ba8d7f Documentation: Fix up syntax errors involving * character 2024-02-28 23:09:46 +00:00
ikelosandGitHub 887747e3ce Merge pull request #1098 from volatilityfoundation/feature/output-filter 
Implement CLI support for filtering out rows during output
 2024-02-22 11:00:14 +00:00
ikelosandGitHub 90de493f78 Merge pull request #1100 from adiego8/windows-psscan-offset 
Windows: Add filtering by offset to psscan
 2024-02-22 10:59:47 +00:00
ikelosandGitHub 0cfc466924 Merge pull request #1093 from eve-mem/linux_issue_1089_module_memory 
Linux: fix issue 1089 module memory
 2024-02-22 10:56:36 +00:00
ikelosandGitHub 499f70d339 Merge pull request #1103 from eve-mem/linux_psscan_memory_layer_name_optimisation 
Linux: psscan tiny update so that  memory_layer_name is reused
 2024-02-22 10:26:23 +00:00
Eve a82b93523d Linux: psscan tiny update so that memory_layer_name is reused 2024-02-22 09:47:23 +00:00
Eve 77675d584d Update patch version 2024-02-21 14:26:48 +00:00
Eve 3b5fde9420 Linux: update module extension logic for choosing the correct values for different kernel versions 2024-02-21 12:58:24 +00:00
Eve e10cff979a Linux: update module extension with memoization for _mod_mem_type 2024-02-21 12:50:05 +00:00
EveandGitHub abbfa7d295 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory 2024-02-21 11:51:54 +00:00
Alejandro Diego 42c6a9ede6 Remove unnecessary import and correctly filter_func var 2024-02-20 20:19:02 -05:00
ikelosandGitHub 1ccbf33c04 Merge pull request #1096 from eve-mem/linux_update_mm_extension 
Linux update mm extension
 2024-02-20 21:01:23 +00:00
Alejandro Diego 5e38ffa811 Added support for virtual address filtering and validation of ph/v space 2024-02-20 15:07:15 -05:00
Eve a597ee1776 Linux: update minor version number due to API changes with linux extension for mm_struct 2024-02-20 06:48:16 +00:00
Eve 437a91375d Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0 2024-02-20 06:39:42 +00:00
Alejandro Diego cd08cb95fd Windows: Add filtering by offset to psscan 
Add capability to the psscan plugin to filter by specific offset.
The filter would be used by other plugins to find specific offset using the psscan capabilities, like find
hidden processes as a result of some dkom for example.
The `--offset`  flag argument should represent a physical address space.

The flag is included in the following plugins:
  - dlllist
  - handles
 2024-02-19 13:35:31 -05:00
ikelosandGitHub 3703e119ce Merge pull request #1084 from volatilityfoundation/feature/table-check 
Symbols: Add support for metadata verification of symbol tables
 2024-02-18 22:19:14 +00:00
Gustavo Moreira cf81ceda82 Fix CodeQL suggestion 2024-02-13 20:20:25 +11:00
Gustavo Moreira 6e7b5b5941 Linux: Add linux_library_list test case 2024-02-13 19:41:30 +11:00
Gustavo Moreira cc35fecf91 Linux: Add library_list plugin and other ELF related code enhacements. 
- Add library_list plugin
- Add ELF dynamic table enum types in elf.json
- Update missing program header enum types in elf.json
- Add PAGE constants
- Add ELF ident and class enums
- Replace ELF hardcoded type numbers for enum description matching
- Fix unmanaged ValueError exception issue in Elf64Layer::_load_segments()
 2024-02-13 19:40:37 +11:00
Eve 53d4ec66eb Linux: Remove unnecessary import from linux extension. 2024-02-12 09:36:33 +00:00
Eve 0e75140ec5 Linux: update module extension with mod_mem_type property and add try/except for get methods 2024-02-12 09:35:06 +00:00
Eve 683319bd7f Linux: add deprecation warning for get_maple_tree_iter and get_mmap_iter mm_struct extensions. 2024-02-12 08:47:02 +00:00
Mike Auty 865f004f5c CLI: Ensure no filters still returns results 2024-02-09 00:00:21 +00:00
Mike Auty d8d3e157af CLI: Don't forget the core text filter class 2024-02-08 23:46:30 +00:00
Mike Auty 63a325c515 CLI: Add support for filtering lines from output 2024-02-08 23:44:12 +00:00
ikelosandGitHub 6d34e43667 Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy 
CLI: Add support for a configuration options file
 2024-02-08 12:05:24 +00:00
Mike Auty 7b42ef0a9f Documentation: Add in more information about overriding configuration values 2024-02-08 11:59:50 +00:00
Mike Auty a66a446190 CLI: Reblack after updating PR - take 2 2024-02-08 11:16:41 +00:00
Mike Auty 9127509db9 CLI: Reblack after updating PR 2024-02-08 11:13:14 +00:00
ikelosandGitHub da06d2e55a Merge branch 'develop' into feature/cli-config-hierarchy 2024-02-08 11:10:28 +00:00
Eve 18220498ae Linux: update linux.pslist plugin to use task.mm.get_vma_iter() so that it works correctly on newer kernels 2024-02-07 09:08:25 +00:00
Eve 6a384c197c Linux: update mm_struct extension so that _get_maple_tree_iter and _get_mmap_iter are more clearly identified, showing that get_vma_iter should be used instead 2024-02-07 09:04:55 +00:00
ikelosandGitHub 795477e24b Merge pull request #1094 from iyassou/feature/windows-truecrypt 
Windows: add TrueCrypt plugin
 2024-02-04 09:28:55 +00:00
Iyassou Shimels d44c0fef36 run Black formatter 2024-02-04 11:21:14 +03:00
ikelosandGitHub bee98efd96 Merge pull request #1063 from forensicxlab/feature/IAT 
Feature: Import Address Table
 2024-02-03 23:50:11 +00:00
k1nd0ne cf9029fd85 Fixing the year in the Copyright 2024-02-04 00:43:33 +01:00
Iyassou Shimels 41cbfbfa34 add license 2024-02-03 11:58:25 +03:00