Gustavo Moreira
fe105dc4a7
Add doc strings and typing info everywhere.
...
Improve some variable names
2021-12-21 15:01:29 +11:00
Gustavo Moreira
7099a7a52e
Fix. We should call the net type method here.
2021-12-21 14:54:38 +11:00
Gustavo Moreira
a7520a377d
Supporting socket and reuseport filters in all the socket families.
2021-12-21 14:53:13 +11:00
Gustavo Moreira
7dc33b8314
fix typo
2021-12-14 17:28:38 +11:00
Gustavo Moreira
a1ff8d7809
Fix comment. This was related to netlink_sock not packer_sock
2021-12-14 17:25:58 +11:00
Gustavo Moreira
34176a8066
Moving log lines from warning to LOGLEVEL_V
2021-12-14 17:10:45 +11:00
Gustavo Moreira
f4e1f4729f
Added type annotations
2021-12-14 16:56:27 +11:00
Gustavo Moreira
8af7422928
Parameterized generator
2021-12-14 16:52:47 +11:00
Gustavo Moreira
b4bcdd0856
Minor changes
2021-12-14 16:51:02 +11:00
Gustavo Moreira
7ed5739e24
socket is no longer imported in this file. Remove the underscore
2021-12-14 16:24:57 +11:00
Gustavo Moreira
52181c7e8f
Improvements to the parameterized generator changes
2021-12-14 16:22:30 +11:00
Gustavo Moreira
c54818e630
Remove redundancies around array_to_string(). It returns a str() already.
2021-12-14 16:00:11 +11:00
Gustavo Moreira
a386a7a948
Removed underscore from unused arguments
2021-12-14 15:40:51 +11:00
Gustavo Moreira
86676cf4e8
Changing BPF_PROG_TYPE_UNSPEC constant in favor of a literal 0 and a comment.
2021-12-14 15:37:55 +11:00
Gustavo Moreira
6970776c4c
Renaming function to use single underscore and name from extra to extended
2021-12-14 15:37:48 +11:00
Gustavo Moreira
2e93db9b57
Adding versioning to SockHandlers
2021-12-14 15:37:43 +11:00
Gustavo Moreira
9766327433
Parameterized generator
2021-12-14 15:37:37 +11:00
Gustavo Moreira
5c507f5ae8
Plugins versioning fixes
2021-12-14 15:37:19 +11:00
Gustavo Moreira
6456e55ddc
Added Sockstat linux plugin to enumerate all processes sockets.
...
The output format is based on the `ss` tools. It supports:
* Unix socket
* Inet/Inet6 sockets
* Netlink sockets
* VSock sockets
* Packet sockets
* XDP sockets (eBPF)
* Bluetooth sockets (When the respective symbols are present)
Changes to the linux Lsof plugin were required to be able to reuse its filedescriptor listing capability.
2021-12-10 17:51:27 +11:00
Gustavo Moreira
02bf609fd1
Prepare linux.lsof.Lsof plugin to work as a helper library for other plugin.
2021-12-10 17:50:52 +11:00
Mike Auty
581251cb05
Linux: Fix long standing typo (thanks to @gcmoreira)
2021-12-08 23:34:53 +00:00
ikelos and GitHub
32ec4afed3
Merge pull request #586 from volatilityfoundation/issues/qemu-speed-up
...
Layers: Speed up qemu by not bisecting
2021-12-08 23:08:32 +00:00
ikelos and GitHub
8f083ed1dd
Merge pull request #476 from japhlange/issues/issue474_netscan_win8sp1x64
...
adds netstat symbols to Win8x64 ISF files
2021-12-06 20:10:25 +00:00
Jan
125658ee0d
re-adds accidentally deleted file
2021-12-06 21:09:39 +01:00
Jan
be4d014f1a
improves decision making when to inspect driver pe header based on version_dict
2021-12-06 17:18:39 +01:00
Jan
6cd2d940f3
adds proper version requirement for verinfo
2021-12-06 17:18:38 +01:00
Jan
3aac7b228e
adds a few clarifying comments and handles errors better
2021-12-06 17:16:23 +01:00
Jan
ee65793fd8
adds new ISF for tcpip.sys 6.3.9600.19935 + distinguisher
2021-12-06 17:16:20 +01:00
Jan
90ad7b1609
reverts pointless createtime offset change
2021-12-06 17:14:40 +01:00
Jan
fffb375909
adds netstat symbols to Win8x64 ISF files
2021-12-06 17:14:40 +01:00
Mike Auty
96820e2804
Plugins: Bump skeleton_key_check to 2.0.0
2021-12-03 16:02:06 +00:00
ikelos and GitHub
da1216a747
Merge pull request #594 from a5hlynx/develop
...
update version to 2.0.0
2021-12-03 15:58:15 +00:00
a5hlynx
680349016e
update version to 2.0.0
2021-12-04 00:29:00 +09:00
Mike Auty
f821ac6072
Layers: Comment out unused code in AVML
2021-11-17 20:42:11 +00:00
Mike Auty
8d48faa0d9
Layers: Close file on layer destruction to prevent ResourceWarning
2021-11-17 13:52:25 +00:00
Mike Auty
3cb2bf9fac
Core: Fix up python 3.10 support
...
Fixes #589
2021-11-17 13:41:09 +00:00
Mike Auty
a1cbea27a8
Layers: Speed up qemu by not bisecting
2021-11-08 22:56:06 +00:00
ikelos and GitHub
23453f5d8c
Merge pull request #580 from volatilityfoundation/issues/large-page-fix
...
Layers: Fix bug where PAT flag is treated as address
2021-11-03 19:20:38 +00:00
ikelos and GitHub
bcdec8a480
Merge pull request #584 from CaptWake/issue-449
...
issue-449 - add --physical flag
2021-10-27 23:21:50 +01:00
ikelos and GitHub
0c603a20ba
Merge pull request #579 from volatilityfoundation/feature/vad-maxsize
...
Windows: Set a 100Gb VAD max size for vadinfo
2021-10-27 23:19:57 +01:00
Mike Auty
20ca165d0f
Windows: Lower the vadlimit on MHL's advice
2021-10-27 23:19:30 +01:00
Stefano
6979a6d2ee
psscan: Remove usage of PHYSICAL_DEFAULT variable
2021-10-25 17:56:33 +02:00
Stefano
2d3d133c0e
issue-449 - add --physical flag
2021-10-24 19:02:14 +02:00
ikelos and GitHub
a7ad0dbc0e
Merge pull request #582 from garanews/develop
...
fix some typo
2021-10-19 09:02:14 +01:00
garanews
449c2aaddf
fix some typo
2021-10-18 14:38:12 +02:00
Mike Auty
2a7831466c
Layers: Fix bug where PAT flag is treated as address
2021-10-17 13:29:32 +01:00
Mike Auty
7cac1a98fd
Core: Update documentation for RegExScanner
2021-10-13 15:03:17 +01:00
Mike Auty
5f3e519cae
Core: Make the regex scanner default to DOTALL
...
This will have no impact on the existing core use of the regex scanner,
and therefore does not require a version bump.
2021-10-13 15:00:27 +01:00
Mike Auty
adfb0de187
Windows: Set a 100Gb VAD max size for vadinfo
2021-10-13 14:50:42 +01:00
Mike Auty
daef7df46f
Windows: Improve PDB scanning regex
...
The regular expression for finding PDB signatures didn't have an
apprioriate flag to treat newline characters like normal characters,
meaning that if a newline character occurred between the RSDS header
and the name of the pdb file, the pdb signature would be missed.
Also updated the filenames so that they're escaped, meaning it must be
an actual dot for the extension rather than any character.
Fixes #577
2021-10-13 14:18:25 +01:00
Gustavo Moreira