Commit Graph

  • cd03c52fd3 Linux: Update linux.vmayarascan to use task.mm.get_vma_iter() which means it will work on linux kernels 6.1 and above Eve 2023-05-12 13:37:15 +01:00
  • 09b0c8e406 Linux: Update linux.vmayarascan and yarascan so that command line options are taken from the base yarascan plugin Eve 2023-05-12 13:30:32 +01:00
  • 860c947e17 Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan Eve 2023-05-12 11:10:02 +01:00
  • d0d30dc87f Merge branch 'volatilityfoundation:develop' into vmayarascan EveandGitHub 2023-05-12 11:09:51 +01:00
  • 8624e01644 Merge branch 'vmayarascan' of github.com:eve-mem/volatility3 into vmayarascan Eve 2023-05-12 11:08:41 +01:00
  • b54bbfb88f Update linux.vmayarascan to pull requirements from the generic yarascan plugin Eve 2023-02-01 11:27:44 +00:00
  • 57e8234e6c remove unused variable in linux.vmayarascan Eve 2023-01-04 09:36:20 +00:00
  • 2279a83e3b liniting for linux.vmayarascan Eve 2023-01-04 09:32:39 +00:00
  • 1a7ec07c28 add linux.vmayarascan based on windows.vadtarascan Eve 2022-12-13 16:09:57 +00:00
  • 8e56cb39d1 Docs: Fix the documentation dependencies Mike Auty 2023-05-10 22:07:38 +01:00
  • 3f1797f7e5 Core: Change readthedocs build platform Mike Auty 2023-05-10 21:57:50 +01:00
  • e28b42731e Core: Change readthedocs python version Mike Auty 2023-05-10 21:55:16 +01:00
  • 2149231bb7 Merge pull request #949 from cpuu/mac-tutorial ikelosandGitHub 2023-05-10 11:11:21 +01:00
  • 534f9be127 Merge pull request #928 from eve-mem/linux_maple_tree ikelosandGitHub 2023-05-10 11:06:44 +01:00
  • e4db77d20a Merge pull request #942 from gcmoreira/mountinfo_fixes ikelosandGitHub 2023-05-10 11:03:32 +01:00
  • 7516346b64 Adjust framework versioning Gustavo Moreira 2023-05-10 10:55:19 +02:00
  • b3c348820f Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/__init__.py Eve 2023-05-10 09:18:05 +01:00
  • 834372a6f8 Linux: apply black v23.3.0 formating to volatility3/framework/symbols/linux/extensions/__init__.py Eve 2023-05-10 09:12:03 +01:00
  • 7f9afccf6f Linux: apply black formating to maple tree parsing Eve 2023-05-10 08:49:46 +01:00
  • 396daa528c Apply Black Python linter to mac.pslist plugin cpuu 2023-05-10 10:07:09 +09:00
  • 186b1ed1c2 Add more process information to mac.pslist plugin cpuu 2023-05-10 09:49:11 +09:00
  • 89ed65cc56 Improve filter warning implementation Gustavo Moreira 2023-05-09 09:59:21 +02:00
  • 6c5db21ae7 Undo mnt_ns_id cast to str Gustavo Moreira 2023-05-09 09:22:02 +02:00
  • d367b973a5 Renamed get_vmlinux_from_volobj() to get_module_from_volobj_type() Gustavo Moreira 2023-05-09 09:05:37 +02:00
  • a2906ad270 Linux: Update comments and var names for maple tree depth warnings Eve 2023-05-09 07:07:39 +01:00
  • 8594824459 Linux: Ensure that objects made when parsing maple tree use the native_layer_name Eve 2023-05-09 06:47:07 +01:00
  • de28b5ab70 Rollback explicit context Gustavo Moreira 2023-05-08 19:59:53 +02:00
  • 7d65c20cc0 Fix f-string Gustavo Moreira 2023-05-08 14:59:58 +02:00
  • 200099f8b3 Improve support for socket filters in kernels < 4.1.52 Gustavo Moreira 2023-05-08 14:58:51 +02:00
  • ced6ff346c Apply 'Black' suggestions Gustavo Moreira 2023-05-08 11:54:48 +02:00
  • 6b2ae6bd65 Update getting-started-mac-tutorial.rst cpuuandGitHub 2023-05-08 17:44:17 +09:00
  • e86ff963e2 Update getting-started-mac-tutorial.rst cpuuandGitHub 2023-05-08 17:43:24 +09:00
  • ea09c47328 Update getting-started-mac-tutorial.rst cpuuandGitHub 2023-05-08 17:32:14 +09:00
  • 778df1a550 Merge pull request #948 from paulkermann/feature/modules_name_flag ikelosandGitHub 2023-05-08 08:47:05 +01:00
  • c40b3a043f CR fixes Paul Kermann 2023-05-08 05:07:19 +03:00
  • a09f77897b sockstat improvements: + Fixes issues with netlink sockets for older kernels, supporting now kernels < 3.7.10 + Fixes issue with network namespace id for older kernels. Gustavo Moreira 2023-05-06 14:21:58 +02:00
  • 2d922a8cd6 Improves the way the mount points and the namespaces are filtered. Previously, it was filtering by mount namespaces id. Even that approach was working as expected, it's not viable for older kernels were there was not a mount namespace ID. With this changes we filtered the mount points individually by the mount ID which is unique system wide, no mather the namespace to which it belongs to. Gustavo Moreira 2023-05-06 14:18:33 +02:00
  • 7063e60944 mountinfo improvements: + Fixes issue with repeated path suffixes. + Adds support for older kernels (<3.3.8) and + Adds a function which simplify the way the framework internally can gets a context and a vmlinux. This is obtaining the context and symbol space from the same vol object instead of drag a context everywhere. This changes also affects other plugins such as elfs, malfind and proc.maps. It also adds doc strings to some of the existent functions. Gustavo Moreira 2023-05-06 14:12:09 +02:00
  • 093fc9ab79 Add tutorial for macOS Analysis cpuu 2023-05-05 23:39:33 +09:00
  • 8952c6c985 formatting Paul Kermann 2023-05-04 15:18:37 +03:00
  • 9249758dde formatting Paul Kermann 2023-05-04 15:15:23 +03:00
  • 1ad8c950da Added modules name flag Paul Kermann 2023-05-04 13:47:57 +03:00
  • 8788390424 Merge pull request #947 from cpuu/bug-fix ikelosandGitHub 2023-05-04 10:00:44 +01:00
  • c9e0b6695f Update index.rst cpuuandGitHub 2023-05-04 12:52:16 +09:00
  • 14f449367d Delete getting-started-macos-tutorial.rst cpuuandGitHub 2023-05-04 12:52:00 +09:00
  • 159e5a2fbd Fix requirements.URLRequirement to requirements.URIRequirement cpuuandGitHub 2023-05-04 11:59:30 +09:00
  • da6f2cf850 Merge branch 'volatilityfoundation:develop' into develop cpuuandGitHub 2023-05-04 10:56:34 +09:00
  • b6af37af2d Merge pull request #938 from volatilityfoundation/issues/issue937 ikelosandGitHub 2023-05-03 00:45:50 +01:00
  • 73cd54cf8a Merge pull request #945 from digitalisx/fix/code-comment ikelosandGitHub 2023-05-03 00:45:23 +01:00
  • c06836e45d Lint: black issue for windows.ldrmodules Donghyun Kim 2023-05-02 05:58:57 +09:00
  • 79cd3fe2fe Lint: black issue for windows.statistics Donghyun Kim 2023-05-02 05:57:56 +09:00
  • 77081d3f68 Add: code comment for plugins Donghyun Kim 2023-05-02 05:51:24 +09:00
  • 317f565685 Core: Renable the import protection for volatility3.framework.plugins Mike Auty 2023-04-30 08:28:22 +01:00
  • b2d33c2cb0 Check if 'mnt_namespace' has the 'ns' member before using it Gustavo Moreira 2023-04-26 00:36:58 +10:00
  • 33f54f8cf7 Replace LinuxUtilities._do_get_path() with the new mountinfo _do_get_path() avoiding duplicate code. It also fixes issue #930 Gustavo Moreira 2023-04-26 00:33:35 +10:00
  • a5e6c550e3 Automagic: Handle file swap locations and throw a warning if they don't exist Mike Auty 2023-04-16 13:30:55 +01:00
  • 58af80df3c Requirements: Shift location_from_file to the requirement from the CLI class Mike Auty 2023-04-16 13:29:41 +01:00
  • 900ab70452 Volshell: Mark the script as executable in the repo Mike Auty 2023-04-14 08:08:27 +01:00
  • cbc745d5a8 Merge pull request #936 from volatilityfoundation/release/v2.4.1 v2.4.1 ikelosandGitHub 2023-04-12 20:22:23 +01:00
  • 1b5a6b6267 Core: Bump the copyright year of the README Mike Auty 2023-04-12 19:57:15 +01:00
  • ebb74e2f92 Core: Bump the copyright year of the README Mike Auty 2023-04-12 19:57:15 +01:00
  • 66c37c3945 Merge pull request #898 from volatilityfoundation/feature/xen-coredump-support ikelosandGitHub 2023-04-09 14:10:56 +01:00
  • 467462ea0e Merge pull request #935 from digitalisx/fix/typo ikelosandGitHub 2023-04-09 14:08:35 +01:00
  • 2e0ecdd770 Fix: typo for linux iomem plugin Donghyun Kim 2023-04-07 18:04:56 +09:00
  • 3c31de8847 Merge pull request #934 from volatilityfoundation/issues/issue931 ikelosandGitHub 2023-04-06 09:22:57 +01:00
  • 2ed7d0d45c Merge pull request #933 from volatilityfoundation/issues/issue932 ikelosandGitHub 2023-04-05 14:12:51 +01:00
  • f33ea67e86 Automagic: Update clear-cache and do removals first Mike Auty 2023-04-04 23:57:35 +01:00
  • 41edab2309 Plugins: Support yara-4.3.0 and above Mike Auty 2023-04-04 23:23:27 +01:00
  • 8d47f89edd Linux.proc: Add debug msg when task has no mm member. Eve 2023-03-30 08:57:43 +01:00
  • 90b9157dcf Linux.proc: Fix broken variable in debug msg. Eve 2023-03-30 08:54:56 +01:00
  • 60292c2da1 Linux: Fix slight issue in envvars renaming Mike Auty 2023-03-29 20:46:06 +01:00
  • 61a2f78baa fix black linting in linux.proc plugin Eve 2023-03-29 10:05:37 +01:00
  • 18a9f89832 update logic for checking if a vma should be saved to disk in linux.proc plugin Eve 2023-03-29 10:00:55 +01:00
  • 089234671c Remove checks for leaf node in linux maple tree parsing, node type is enough. Eve 2023-03-27 06:29:30 +01:00
  • 89e477a068 Remove _parse_maple_tree_entry function and make parsing easier to read Eve 2023-03-24 20:07:32 +00:00
  • 5207cfcb93 Modify linux plugins to support both mmap and mm_mt Eve 2023-03-24 15:10:34 +00:00
  • 3d51b4a41a Add basic support for linux maple tree struct Eve 2023-03-24 15:08:59 +00:00
  • a77a1ae301 Merge pull request #920 from volatilityfoundation/issues/issue886 ikelosandGitHub 2023-03-19 19:29:41 +00:00
  • c7e28eaf29 Merge branch 'volatilityfoundation:develop' into feature/linux_elf_dump cstationandGitHub 2023-03-14 21:28:29 +00:00
  • 3386a4fdc0 Remove broad try-except clause cstation 2023-03-14 22:22:51 +01:00
  • d9a365d96f Linux: Rename linux.envars to linux.envvars Mike Auty 2023-03-11 17:33:20 +00:00
  • 9216bab61b Core: Improve import exception reporting Mike Auty 2023-03-11 17:32:46 +00:00
  • b5ef7248ab Linux: Fix psscan task native_layer Mike Auty 2023-03-11 15:17:24 +00:00
  • cfec8e4b12 Core: Pointer is_readable should check the native layer Mike Auty 2023-03-11 15:18:58 +00:00
  • 46f56770af Core: Pointer is_readable should check the native layer Mike Auty 2023-03-11 15:18:58 +00:00
  • 36ec516470 Linux: Fix psscan task native_layer Mike Auty 2023-03-11 15:17:24 +00:00
  • 99417cdfcc Linux: Psscan check parent pointer is valid Mike Auty 2023-03-11 14:17:37 +00:00
  • 85e86d45c5 Linux: fix black lint issues Mike Auty 2023-03-08 20:42:24 +00:00
  • b8755ac574 Linux: fix black lint issues Mike Auty 2023-03-08 20:42:24 +00:00
  • a35afd4f34 Core: Bump framwork version after release branch Mike Auty 2023-03-08 20:40:04 +00:00
  • 97347efff3 Merge pull request #915 from 0xThiebaut/pstree ikelosandGitHub 2023-03-08 19:51:48 +00:00
  • cd2e07da27 Merge pull request #881 from eve-mem/linux_envars ikelosandGitHub 2023-03-08 18:59:05 +00:00
  • f028b0a4dc Merge pull request #894 from eve-mem/linux_iomem ikelosandGitHub 2023-03-08 18:58:35 +00:00
  • fff64b6071 Merge pull request #921 from eve-mem/linux_psscan ikelosandGitHub 2023-03-08 18:56:16 +00:00
  • 32db4c0e5f Fix black linting for linux.psscan. Eve 2023-03-08 14:08:44 +00:00
  • abfe104eb9 Fix linux.pscan to find memory layer to scan using kernel layers dependencies rather than hard coded value. Eve 2023-03-08 14:02:13 +00:00
  • bdf57f0716 Add extra debug messages to linux.psscan when finding symbol locations Eve 2023-03-08 13:44:08 +00:00
  • a34fb84976 Fix linux.psscan to use kernel offset when finding symbol location Eve 2023-03-08 13:31:37 +00:00
  • 21e34ec605 Windows: Fix up double adding the symbol from context.module Mike Auty 2023-03-05 23:25:42 +00:00
  • f3dea3619c Windows: Memoize part of the pool handling code Mike Auty 2023-03-05 23:14:09 +00:00