Commit Graph

  • 499f70d339 Merge pull request #1103 from eve-mem/linux_psscan_memory_layer_name_optimisation ikelosandGitHub 2024-02-22 10:26:23 +00:00
  • a82b93523d Linux: psscan tiny update so that memory_layer_name is reused Eve 2024-02-22 09:47:23 +00:00
  • 77675d584d Update patch version Eve 2024-02-21 14:26:48 +00:00
  • 3b5fde9420 Linux: update module extension logic for choosing the correct values for different kernel versions Eve 2024-02-21 12:58:24 +00:00
  • e10cff979a Linux: update module extension with memoization for _mod_mem_type Eve 2024-02-21 12:50:05 +00:00
  • abbfa7d295 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory EveandGitHub 2024-02-21 11:51:54 +00:00
  • 42c6a9ede6 Remove unnecessary import and correctly filter_func var Alejandro Diego 2024-02-20 20:07:17 -05:00
  • 1ccbf33c04 Merge pull request #1096 from eve-mem/linux_update_mm_extension ikelosandGitHub 2024-02-20 21:01:23 +00:00
  • 5e38ffa811 Added support for virtual address filtering and validation of ph/v space Alejandro Diego 2024-02-20 15:07:15 -05:00
  • a597ee1776 Linux: update minor version number due to API changes with linux extension for mm_struct Eve 2024-02-20 06:48:16 +00:00
  • 437a91375d Linux: add TODO for mm_struct for methods that should be removed when moving to version 3.0.0 Eve 2024-02-20 06:39:42 +00:00
  • cd08cb95fd Windows: Add filtering by offset to psscan Alejandro Diego 2024-02-06 09:26:49 -05:00
  • ac0c8ee5d9 Renderers: Convert column to dataclass feature/column-select Mike Auty 2024-02-18 23:59:08 +00:00
  • 3703e119ce Merge pull request #1084 from volatilityfoundation/feature/table-check ikelosandGitHub 2024-02-18 22:19:14 +00:00
  • 262642ee37 Core: Bump to allow a third value when creating columns Mike Auty 2024-02-18 22:14:25 +00:00
  • e381a00780 Core: Support hidden by default columns in plugins Mike Auty 2024-02-18 21:58:26 +00:00
  • 4c7528fcae CLI: Add in support for selective column output Mike Auty 2024-01-15 00:55:57 +00:00
  • cf81ceda82 Fix CodeQL suggestion Gustavo Moreira 2024-02-13 20:20:25 +11:00
  • 6e7b5b5941 Linux: Add linux_library_list test case Gustavo Moreira 2024-02-13 19:41:30 +11:00
  • cc35fecf91 Linux: Add library_list plugin and other ELF related code enhacements. Gustavo Moreira 2024-02-13 19:40:37 +11:00
  • 53d4ec66eb Linux: Remove unnecessary import from linux extension. Eve 2024-02-12 09:36:33 +00:00
  • 0e75140ec5 Linux: update module extension with mod_mem_type property and add try/except for get methods Eve 2024-02-12 09:35:06 +00:00
  • 683319bd7f Linux: add deprecation warning for get_maple_tree_iter and get_mmap_iter mm_struct extensions. Eve 2024-02-12 08:47:02 +00:00
  • 865f004f5c CLI: Ensure no filters still returns results Mike Auty 2024-02-09 00:00:21 +00:00
  • d8d3e157af CLI: Don't forget the core text filter class Mike Auty 2024-02-08 23:46:30 +00:00
  • 63a325c515 CLI: Add support for filtering lines from output Mike Auty 2024-02-08 23:44:12 +00:00
  • 6d34e43667 Merge pull request #754 from volatilityfoundation/feature/cli-config-hierarchy ikelosandGitHub 2024-02-08 12:05:24 +00:00
  • 7b42ef0a9f Documentation: Add in more information about overriding configuration values Mike Auty 2024-02-08 11:59:50 +00:00
  • a66a446190 CLI: Reblack after updating PR - take 2 Mike Auty 2024-02-08 11:16:35 +00:00
  • 9127509db9 CLI: Reblack after updating PR Mike Auty 2024-02-08 11:13:14 +00:00
  • da06d2e55a Merge branch 'develop' into feature/cli-config-hierarchy ikelosandGitHub 2024-02-08 11:10:28 +00:00
  • 18220498ae Linux: update linux.pslist plugin to use task.mm.get_vma_iter() so that it works correctly on newer kernels Eve 2024-02-07 09:07:19 +00:00
  • 6a384c197c Linux: update mm_struct extension so that _get_maple_tree_iter and _get_mmap_iter are more clearly identified, showing that get_vma_iter should be used instead Eve 2024-02-07 09:04:55 +00:00
  • 795477e24b Merge pull request #1094 from iyassou/feature/windows-truecrypt ikelosandGitHub 2024-02-04 09:28:55 +00:00
  • d44c0fef36 run Black formatter Iyassou Shimels 2024-02-04 11:21:14 +03:00
  • bee98efd96 Merge pull request #1063 from forensicxlab/feature/IAT ikelosandGitHub 2024-02-03 23:50:11 +00:00
  • cf9029fd85 Fixing the year in the Copyright k1nd0ne 2024-02-04 00:43:33 +01:00
  • 41cbfbfa34 add license Iyassou Shimels 2024-02-03 11:58:25 +03:00
  • ab8ed049a4 Windows: add TrueCrypt plugin Iyassou Shimels 2024-02-03 11:32:00 +03:00
  • 130621a2e7 Changing comment when Type error is occuring k1nd0ne 2024-02-02 20:04:36 +01:00
  • 4a2a9dabd6 Merge branch 'volatilityfoundation:develop' into linux_issue_1089_module_memory EveandGitHub 2024-02-02 14:12:29 +00:00
  • 261d7ffbf2 Linux: include all mod mem types in size calculations Eve 2024-02-02 14:03:55 +00:00
  • ecf20d99b4 Linux: fix typo in error message in module.get_module_init extension Eve 2024-02-02 13:28:57 +00:00
  • d1c7f14a75 Linux: attempt to fix issue 1089 Eve 2024-02-02 13:28:04 +00:00
  • 828b688232 Fix issue with net namespace id and improve code Gustavo Moreira 2024-02-02 21:29:10 +11:00
  • 5219e8aaae Remove lowercase matching from linux.ip.Addr test Gustavo Moreira 2024-02-02 21:03:03 +11:00
  • 8b6bd0f74e Add linux.ip.Link test using linux-sample-1.bin image Gustavo Moreira 2024-02-02 21:02:05 +11:00
  • 7b1c75cc87 Linux: Add the linux.ip.Link plugin by @eve-mem Gustavo Moreira 2024-02-02 20:57:26 +11:00
  • 260fbd8d24 Python os.path module precisely does that by checking the current platform and, based on it, utilizes either the posixpath or ntpath modules Gustavo Moreira 2024-02-02 17:03:14 +11:00
  • 6f1e7c2145 Add test for linux.ip.Addr and linux-sample-1.bin Gustavo Moreira 2024-02-02 16:43:58 +11:00
  • 18dd23a6b1 Merge pull request #1076 from ckusek15/windows-pstree ikelosandGitHub 2024-02-01 11:16:24 +00:00
  • 9b281c478b Merge pull request #1071 from hsarkey/hsarkey/windows-malfind ikelosandGitHub 2024-02-01 09:18:41 +00:00
  • e436328e88 Merge pull request #1092 from volatilityfoundation/stable ikelosandGitHub 2024-01-31 21:43:57 +00:00
  • f95be04305 Documentation: Bump the copyright here to 2024 Mike Auty 2024-01-31 21:13:00 +00:00
  • d2f7b416de Merge pull request #1091 from volatilityfoundation/release/v2.5.2 v2.5.2 ikelosandGitHub 2024-01-31 21:21:20 +00:00
  • ba488c78cd Documentation: Bump the copyright here to 2024 Mike Auty 2024-01-31 21:13:00 +00:00
  • 86b0fd431a Core: Apply black 24.1.0 across the whole codebase Mike Auty 2024-01-31 21:09:48 +00:00
  • 7de7dfdabf Documentation: Update copyright in README.md for 2024 Mike Auty 2024-01-31 21:04:16 +00:00
  • 6d093a4e43 Documentation: Update copyright in README.md for 2024 Mike Auty 2024-01-31 21:04:16 +00:00
  • 470c750d82 Updated to use dictionary for refined criteria and BaseAbsentValue for when criteria is not met hsarkey 2024-01-31 16:00:29 -05:00
  • 2b15f3fd87 Merge pull request #1069 from dgmcdona/dgmcdona/windows_svcscan ikelosandGitHub 2024-01-30 16:49:18 +00:00
  • 1b153cc567 Manage net_device flag default value & error Gustavo Moreira 2024-01-30 13:13:19 -03:00
  • c72fa7544d Convert IF_OPER_STATES to enum Gustavo Moreira 2024-01-30 12:55:16 -03:00
  • 5a8a0def35 Fix docstring typos Gustavo Moreira 2024-01-30 12:53:09 -03:00
  • 43e8e01daf Removes unnecessary pass and deindents return stmt David McDonald 2024-01-30 09:26:17 -06:00
  • 4192e8a711 Fix condition in OsDistinguisher David McDonald 2024-01-18 12:22:23 -06:00
  • 42c2a86a37 Add logging for when a Services key cannot be retrieved David McDonald 2024-01-16 10:11:16 -06:00
  • c517a44cde Add type hints/casts to _get_service_key method David McDonald 2024-01-16 10:10:54 -06:00
  • f5c1bf0f1f Remove argument that matches default David McDonald 2024-01-16 10:10:20 -06:00
  • 5541378afe Create unique config path David McDonald 2024-01-16 10:09:59 -06:00
  • 4b400b6df6 Refactor out code duplication in OS version checks David McDonald 2024-01-16 10:09:36 -06:00
  • 86d6b4f724 Bump plugin version David McDonald 2024-01-16 10:08:14 -06:00
  • 77b0110635 Windows: Fixes svc symbols and OS version detection David McDonald 2023-12-14 14:16:40 -06:00
  • 837d3b7b9f Windows: Add parsing of service binary/dll David McDonald 2023-12-14 13:47:00 -06:00
  • 497d291ef4 Windows: Fix black on dumpfiles Mike Auty 2024-01-29 00:07:40 +00:00
  • b211dc17b0 Merge pull request #1083 from brandon-barnacle/bbarnacle/windows-dumpfiles ikelosandGitHub 2024-01-28 23:58:16 +00:00
  • 4dc6f637b0 Core: Apply black 24.1.0 to the whole codebase Mike Auty 2024-01-28 23:50:45 +00:00
  • cd867bf5d2 Merge branch 'volatilityfoundation:develop' into linux_ifconfig_plugin gcmoreiraandGitHub 2024-01-27 20:32:33 -03:00
  • 620b9b4183 Fix: Explicit returns mixed with implicit (fall through) returns Gustavo Moreira 2024-01-27 17:52:26 -03:00
  • 97007e8b86 Minor fixes Gustavo Moreira 2024-01-27 17:48:09 -03:00
  • 6e0ffc9d62 Plugin renamed. Added net iface status and other improvements from @eve #1029 Gustavo Moreira 2024-01-27 17:39:34 -03:00
  • ae5375a622 PR comment changes Brandon Barnacle 2024-01-17 09:49:39 -05:00
  • a50ebb6014 Windows: Display additional process info for windows.pstree Calvin Kusek 2024-01-02 12:00:41 -05:00
  • ef36cb5a6c Updated windows.malfind to have a "Notes" column to indicate if a process meets "refined" criteria, which includes common headers like MZ,PE or function prologues. Fixed black formatting issue. hsarkey 2024-01-17 17:51:27 -05:00
  • e6e138f12d Updated windows.malfind to have a "Notes" column which will indicate if a process meets a "refined criteria", meaning it has a common header type (MZ, PE, or a function prologue). hsarkey 2024-01-17 17:24:26 -05:00
  • 4e89040dad Updated changes to the windows.malfind plugin. Eliminated --refined as a command line option and instead added an additional column called "Notes" to provide info on common headers. hsarkey 2024-01-14 13:20:56 -05:00
  • 4b86b9ea89 Plugins: Remove unnecessary variable from windows.mftscan Mike Auty 2024-01-17 20:40:27 +00:00
  • 01ffcd9634 Core: Fixing None equality test in MapleTree implementation Mike Auty 2024-01-17 20:37:26 +00:00
  • 614d4d6f2b Layers: Fix cloudstorage unnecessary import Mike Auty 2024-01-17 20:35:54 +00:00
  • 269058021d Plugins: Fix up kmsg code issues Mike Auty 2024-01-17 20:34:39 +00:00
  • 7c8f4ca4ac Schemas: As of 6.3.0 we require a producer metadata, not just format Mike Auty 2024-01-14 22:44:29 +00:00
  • 62366d4f6f Symbols: Add support for metadata verification of symbol tables Mike Auty 2024-01-14 22:37:56 +00:00
  • 52dcfb45f4 Windows: Add regex filtering to dumpfiles bbarnacle 2023-11-28 11:20:51 -05:00
  • da6c2d863d Fix netdev egress hooks Gustavo Moreira 2024-01-10 16:43:36 -03:00
  • 5b5012d08a Fix. Use the global lists. DEC hooks were wrong Gustavo Moreira 2024-01-10 16:42:34 -03:00
  • 5ad7dd3bbc Update netdev class names as it now supports both netdev hooks; ingress and egress Gustavo Moreira 2024-01-10 16:06:55 -03:00
  • abc448009e Linux: Add netfilter hooks enumeration plugin. Gustavo Moreira 2024-01-10 15:56:00 -03:00
  • b395815eb0 Merge branch 'poolscanner-thread-support' of https://github.com/RuBublik/volatility3 into poolscanner-thread-support RuBublik 2024-01-09 21:32:46 +02:00
  • b0d84e55ab fix indentation (typo) RuBublik 2024-01-09 21:32:29 +02:00
  • 6b3bbad537 Fix exception. Although it will be auto-instantiated it's better to explicitily use the exception instance Gustavo Moreira 2024-01-09 16:13:33 -03:00