Commit Graph

  • 14fa5ad771 Documentation: Add in a CITATION.cff file Mike Auty 2023-10-17 16:27:22 +01:00
  • 63ace60995 Core: Add (optional) sanitization to the FileHandler class Mike Auty 2023-10-17 15:54:10 +01:00
  • 57924c5da1 Merge pull request #1001 from xabrouck/oldkernel ikelosandGitHub 2023-10-17 15:34:10 +01:00
  • 15ad1db01b Merge pull request #1016 from eve-mem/vmem_warnings ikelosandGitHub 2023-10-17 15:02:11 +01:00
  • e45380f4f5 Update vmware layer metadata file warning to be less doom and gloom. Eve 2023-10-13 09:29:46 +01:00
  • 95c468c4f8 issue #1019 - for subkeys, return the modified time of the subkey itself, not its parent key Dave Lassalle 2023-10-12 10:16:56 -05:00
  • 9cc73b6a03 issue #1017 - check for valid root node type Dave Lassalle 2023-10-12 09:57:24 -05:00
  • 310b6508db vmware: Add warning when no metadata file is found for a vmem file. Eve 2023-10-11 09:09:15 +01:00
  • faa8b2eaa9 Merge branch 'volatilityfoundation:develop' into vmayarascan EveandGitHub 2023-10-09 17:16:56 +01:00
  • 93b2972832 Renderers: Allow nodes to be turned into dictionaries Mike Auty 2023-10-08 22:19:17 +01:00
  • 6e5d41c38b manually instantiate queue_entry for tasks symbol Abyss Watcher 2023-10-08 03:37:17 +02:00
  • 57d995a81d manually instantiate queue_entry for tasks symbol Abyss Watcher 2023-10-08 03:15:23 +02:00
  • 62466c7953 fixed merge conflicts with 'volatilityfoundation:develop' branch - bumped VERSION_PATCH RuBublik 2023-10-03 21:35:37 +03:00
  • 40d993b1a0 Merge branch 'volatilityfoundation:develop' into layer_debug_info EveandGitHub 2023-10-03 07:43:13 +01:00
  • 41a02fbf5b Linux: use try/except in linux elf extension to catch paged and invalid addresses rather than crashing Eve 2023-10-03 07:13:28 +01:00
  • a46c9d9d8e Linux: add padded read when getting magic for elf extension to help with smear and missing pages Eve 2023-09-29 10:16:20 +01:00
  • 87cdf87100 Merge pull request #1004 from ShutdownRepo/test-workflow ikelosandGitHub 2023-09-28 17:17:48 +01:00
  • cb6d6e3a8e Merge pull request #1008 from volatilityfoundation/release/v2.5.0 v2.5.0 ikelosandGitHub 2023-09-27 20:45:48 +01:00
  • 56cb5ea93b Revert "Linux: Rename linux.envars to linux.envvars" Mike Auty 2023-09-27 20:37:51 +01:00
  • 43bef641dc Revert "Linux: Fix slight issue in envvars renaming" Mike Auty 2023-09-27 20:37:38 +01:00
  • 370b6774ea Remove macOS from matrix hosts Shutdown 2023-09-17 23:21:56 +02:00
  • 47ddf5d0e5 Core: Bump the version after 2.5.0 release branch Mike Auty 2023-09-06 20:34:13 +01:00
  • b5b9c8ac41 Merge pull request #1003 from volatilityfoundation/issues/issue1002 ikelosandGitHub 2023-09-06 00:54:04 +01:00
  • 5e8dfc0af2 Merge branch 'develop' into issues/issue1002 ikelosandGitHub 2023-09-06 00:50:32 +01:00
  • 803c56e3c4 Core: include the volatility3 package and all volatility3 subpackages Mike Auty 2023-09-05 23:51:17 +01:00
  • 9d2fd40517 Revert "Core: Include only volatility3 in distributions packages" Mike Auty 2023-09-05 23:07:57 +01:00
  • ef341d54d6 Fixing fail-fast strategy Shutdown 2023-09-05 22:37:45 +02:00
  • 9982a44131 Adding matrix strategy for hosts and python version Shutdown 2023-09-05 22:36:40 +02:00
  • 2a67aa639a Removing Python version Shutdown 2023-09-05 22:29:25 +02:00
  • 627e2fbab9 Adding install.yml workflow Shutdown 2023-09-05 22:27:53 +02:00
  • 05df365936 Core: Fix missing packages in setup.py Mike Auty 2023-09-05 18:23:48 +01:00
  • 455487dbb6 Making cred optional as it didn't exist in old 2.6 kernels xabrouck 2023-09-05 16:20:46 +02:00
  • 52207e0933 Add extra debug information for layer stacker to show file size of the physical file Eve 2023-09-04 17:44:24 +01:00
  • da203f7d68 Documentation: Improve library documentation Mike Auty 2023-09-03 21:33:32 +01:00
  • 3ff4f015c4 Merge pull request #899 from cstation/feature/linux_elf_dump ikelosandGitHub 2023-09-03 21:59:36 +01:00
  • c8a85e11b2 Merge pull request #995 from xabrouck/dirty ikelosandGitHub 2023-09-03 21:56:25 +01:00
  • c72129203b Merge pull request #996 from eve-mem/Linux-Change-get_process_memory_sections-to-use-get_vma_iter ikelosandGitHub 2023-09-03 21:41:43 +01:00
  • b4c6b661f0 Core: Include only volatility3 in distributions packages Mike Auty 2023-09-03 21:11:36 +01:00
  • 5c80a66d6d Windows: Update pslist.py, add friendly option 616c696365 2023-08-30 20:12:12 +01:00
  • 9b5c4b0415 fix comment typo Gustavo Moreira 2023-08-22 15:56:18 +10:00
  • 7dc74f14b6 Merge branch 'volatilityfoundation:develop' into issue_985 gcmoreiraandGitHub 2023-08-22 15:51:42 +10:00
  • 6f7f1284ad Fix bug with PAGE_SHIFT that wasn't shifted, also greatly increases performance Use black Better logging xabrouck 2023-08-18 11:37:04 +02:00
  • 804d68d94d Linux: fix bug where get_process_memory_sections fails with 6.1+ kernels EveandGitHub 2023-08-17 13:38:23 +01:00
  • 581c493f4f Add in action to make old tickets stale. Mike Auty 2023-08-16 21:35:11 +01:00
  • 7c82da4f50 check IoC of dirty bit in PTEs from executable VMAs. this can for example detect code injected using ptrace(). this can also detect injected code that was reset to the original code (malware uninstalled before memory dump happened). xabrouck 2023-08-14 11:53:14 +02:00
  • 5d4c70d517 Documentation: Fix requirements -> get_requirements #993 Mike Auty 2023-08-03 15:16:36 +01:00
  • b050b108e4 Merge pull request #988 from xabrouck/avml-fix2 ikelosandGitHub 2023-07-27 14:08:35 +01:00
  • a226b90b4d previous commit would break linux snappy support xabrouck 2023-07-27 09:37:57 +02:00
  • d872abaf30 fix bug in snappy lib loading and make it work on macOS. xabrouck 2023-07-27 09:28:53 +02:00
  • d53714fac8 Fix linting cstationandGitHub 2023-07-22 17:03:57 +00:00
  • fca4c5db4b Merge branch 'develop' into feature/linux_elf_dump cstationandGitHub 2023-07-22 17:00:12 +00:00
  • 8373b5ed5a Push ELF export limit to a constant cstation 2023-07-22 18:52:39 +02:00
  • 0a6deae6bd This will fix #985. It requires the changes in dwarf2json mentioned in this ticket. Gustavo Moreira 2023-07-21 12:52:21 +02:00
  • 6f71781405 Merge pull request #984 from gcmoreira/linux_capabilities_fixes ikelosandGitHub 2023-07-20 11:02:56 +01:00
  • 90da6298e0 Added further details to the kernel_cap_struct::cap comments Gustavo Moreira 2023-07-20 00:29:52 +02:00
  • 9ba3d9ba4e Several fixes: * The capabilities array was to have a 64bit bitwise. * Capabilities set has to be tested with the kernel maximum. We can't use the plugin capabilities set, otherwise we can have wrong interpretations when we tried to compress the list of capabilities to "all" * Supports kernels >= 6.3. They changed the kernel_cap_struct::cap type again to a u64 type. Gustavo Moreira 2023-07-19 22:48:06 +02:00
  • 338238c639 fixed build number - resets when MINOR version goes up RuBublik 2023-07-16 00:10:31 +03:00
  • 373d769690 Merge pull request #978 from volatilityfoundation/feature/parameterized_object_from_symbol ikelosandGitHub 2023-07-12 22:17:53 +01:00
  • 89b6c090b3 Merge pull request #952 from cpuu/mac_pslist ikelosandGitHub 2023-07-12 22:16:55 +01:00
  • f8fc5d5e58 Update pslist.py cpuuandGitHub 2023-07-12 14:43:38 +09:00
  • 6907575d77 Merge branch 'volatilityfoundation:develop' into mac_pslist cpuuandGitHub 2023-07-12 14:37:30 +09:00
  • 74e8582360 Merge pull request #957 from gcmoreira/linux_capabilities ikelosandGitHub 2023-07-10 07:49:44 +01:00
  • 42fe37ed52 Adjust docstring to the new retuned type. Gustavo Moreira 2023-07-10 01:12:20 +02:00
  • 38e9b6baa8 Removed Dict type from the imports Gustavo Moreira 2023-07-10 01:08:46 +02:00
  • 63c7719763 Fixed returned types. An empty string is now returned when no capability is enabled. Gustavo Moreira 2023-07-10 01:01:30 +02:00
  • 239e164ce6 Windows: Fix strings plugin missing kernel pages Mike Auty 2023-07-09 23:50:13 +01:00
  • 241cf832f9 Plugin parameters removed. Instead, it now shows each capability set in their textual representation. The dictionary was replaced by a dataclass. Last but not leas, CAP_FULL moved to constants. Gustavo Moreira 2023-07-10 00:07:40 +02:00
  • abf1c2e03d fixed typos RuBublik 2023-07-07 20:25:02 +03:00
  • 524ff59107 bumped MINOR_VERSION to 2.5.2 after changes, and updated dependent thrdscan plugin's required version to this RuBublik 2023-07-07 20:22:58 +03:00
  • 6c0ce1d130 Volshell: Typo Fixes #958 Mike Auty 2023-07-01 20:58:36 +01:00
  • 66598f5b63 Core: Second fix is the charm... Mike Auty 2023-07-01 19:05:22 +01:00
  • c8e53ff16a Core: Fix small typing issue in previous patch Mike Auty 2023-07-01 19:02:51 +01:00
  • 50b5d2232b Core: Add type parameter to object_from_symbol Mike Auty 2023-07-01 19:00:03 +01:00
  • 1ff2d80b44 Documentation: Update basics - memory layer information Mike Auty 2023-07-01 17:01:57 +01:00
  • a9698e4e73 Documentation: minor fixes/updates Mike Auty 2023-07-01 16:31:48 +01:00
  • 5aa0a64cfa Merge pull request #884 from eve-mem/linux_proc_dump ikelosandGitHub 2023-06-18 15:07:19 +01:00
  • fa5af08c81 Merge branch 'develop' into linux_proc_dump EveandGitHub 2023-06-18 07:34:45 +01:00
  • e17cb1532b Merge pull request #970 from volatilityfoundation/issues/issue969 ikelosandGitHub 2023-06-16 19:01:21 +01:00
  • aa04b8ca3d Windows: Fix VAD offset canonicalization #969 Mike Auty 2023-06-16 18:03:07 +01:00
  • 2e577790d2 Merge pull request #962 from gcmoreira/fix_dentry_mem_smear_issue_961 ikelosandGitHub 2023-05-30 17:51:05 +01:00
  • 5d32ca542c fix black formatting RuBublik 2023-05-28 20:52:26 +03:00
  • b9e5cfb393 Core: Protect from clearing a non-existant cache Mike Auty 2023-05-22 15:05:39 +01:00
  • 5072728e89 formated with black RuBublik 2023-05-22 15:50:22 +03:00
  • 9bdd249aad added _version to ThrdScan RuBublik 2023-05-22 15:39:12 +03:00
  • c6c501ecb5 implemented generate_timeline method in ThrdScan RuBublik 2023-05-22 15:31:25 +03:00
  • bef5149ba6 changed TreeGrid yielded types to specific simpletypes instead of str RuBublik 2023-05-22 11:39:38 +03:00
  • 950a76d1e0 fixed typo RuBublik 2023-05-22 11:17:23 +03:00
  • 0f42f0eaf1 fix typo Gustavo Moreira 2023-05-22 01:39:14 +01:00
  • bea981180d Prevent potential dentry pointer memory smear Gustavo Moreira 2023-05-22 01:32:00 +01:00
  • 5749b3ef52 added test for thrdscan plugin RuBublik 2023-05-21 19:22:22 +03:00
  • fab818b48d added thrdscan plugin to utilize added support for ethread pool tag scanning RuBublik 2023-05-21 18:24:01 +03:00
  • 046c8e4d1e fix of is_valid - removed reliace on owning _eprocess and added exclusion for system process (does not have creation time) RuBublik 2023-05-21 18:18:02 +03:00
  • 601870829e twicked thread constraint for edge cases RuBublik 2023-05-21 18:12:46 +03:00
  • 0fd475e10b added permanent implementation for 'ETHREAD.is_valid' RuBublik 2023-05-20 15:49:09 +03:00
  • 550d1096eb temporary fix to ETHREAD class, add 'is_valid' method RuBublik 2023-05-20 14:20:15 +03:00
  • f0bd978716 Fix typo Gustavo Moreira 2023-05-20 12:17:09 +02:00
  • 7469872c8b added 'PoolConstraint' of Thread objects to 'PoolScanner.default_constraints' as part of adding support for thread pool tag scanning RuBublik 2023-05-17 21:41:37 +03:00
  • 4f5ca6116c Add black recommendations Gustavo Moreira 2023-05-17 16:07:56 +01:00
  • d5d318d3cf Fix wrong constants module Gustavo Moreira 2023-05-17 15:26:24 +01:00
  • 3d9efc3b34 Added linux capabilities plugin Gustavo Moreira 2023-05-17 14:14:33 +01:00