mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
147 lines
3.5 KiB
Markdown
147 lines
3.5 KiB
Markdown
API Changes
|
|
===========
|
|
|
|
When an addition to the existing API is made, the minor version is bumped.
|
|
When an API feature or function is removed or changed, the major version is bumped.
|
|
|
|
2.25.0
|
|
======
|
|
Pointer class now supports `get_raw_value()`.
|
|
`KTIMER` no longer supports `get_raw_dpc()`.
|
|
|
|
2.24.0
|
|
======
|
|
Support `encoding` parameter for `objects.utility.array_to_string`
|
|
|
|
2.23.0
|
|
======
|
|
Add support for windows GUI classes and OS distinguishers.
|
|
Add a symbol_table_name for `ExecutiveObject.get_object_header()`/
|
|
|
|
2.22.0
|
|
======
|
|
Linux net constants added.
|
|
Network objects moved to separate versionable module.
|
|
|
|
2.21.0
|
|
======
|
|
`uuid` method added to `linux.extensions`.
|
|
|
|
2.20.0
|
|
======
|
|
NM_TYPES_DESC constants added to linux.
|
|
`latch_tree_root` and `kernel_symbol` added to linux extensions.
|
|
Linux `module` class additions:
|
|
* `get_module_address_boundaries`
|
|
* `section_typetab`
|
|
Linux `task_struct` class additions:
|
|
* `get_address_space_layer`
|
|
* `state`
|
|
Linux `bpf_prog` class additions:
|
|
* `bpf_jit_binary_hdr_address`
|
|
|
|
2.19.0
|
|
======
|
|
Introduction of `Modules` versionable linux extension module.
|
|
Deprecation of some `LinuxUtilities` functions relating to modules.
|
|
|
|
2.18.0
|
|
======
|
|
Addition of `scatterlist` linux extension.
|
|
|
|
2.17.0
|
|
======
|
|
The addition of a `types` member to `SymbolInterface`
|
|
|
|
2.16.0
|
|
======
|
|
Addition of TAINT_FLAG constants, `TaintFlag` dataclass
|
|
Addition of linux `tainting` versionable module
|
|
|
|
2.15.0
|
|
======
|
|
Addition of `convert_fourcc_code` to `LinuxUtilities` class
|
|
|
|
2.14.0
|
|
======
|
|
No significant changes (part of the 2.16.0 PR which took time in development)
|
|
|
|
2.13.0
|
|
======
|
|
Linux `task` object extension addition of `getppid`
|
|
|
|
2.12.0
|
|
======
|
|
Changes to the Intel layer to support `PROT_NONE` pages.
|
|
|
|
2.11.0
|
|
======
|
|
Addition of `get_type` method to windows `CM_KEY_NODE` registry structure
|
|
|
|
2.10.0
|
|
======
|
|
No significant API changes (CLI changes to the JSONL text renderer)
|
|
|
|
2.9.0
|
|
=====
|
|
No significant API changes (change to call `linux.LinuxUtilities.get_module_from_volobj_type` to get the kernel)
|
|
|
|
2.8.0
|
|
=====
|
|
Addition of the `BinOrAbsent`, `HexOrAbsent`, `HexBytesOrAbsent` and `MultiTypeDataOrAbsent` data type renderers
|
|
|
|
2.7.0
|
|
=====
|
|
Addition of `is_valid`, `get_create_time` and `get_exit_time` to ETHREAD structure
|
|
|
|
2.6.0
|
|
=====
|
|
No significant changes (again, the version got bump twice in the PR straight to 2.7.0)
|
|
|
|
2.5.0
|
|
=====
|
|
Add in support for specifying a type override for object_from_symbol
|
|
|
|
2.4.0
|
|
=====
|
|
Add a `get_size()` method to Windows VAD structures and fix several off-by-one issues when calculating VAD sizes.
|
|
|
|
2.3.1
|
|
=====
|
|
Update in the windows `_EPROCESS.owning_process` method to support Windows Vista and later versions.
|
|
|
|
2.3.0
|
|
=====
|
|
Add in `child_template` to template class
|
|
|
|
2.2.0
|
|
=====
|
|
Changes to linux core calls
|
|
|
|
2.1.0
|
|
=====
|
|
Add in the linux `task.get_threads` method to the API.
|
|
|
|
2.0.3
|
|
=====
|
|
Add in the windows `DEVICE_OBJECT.get_attached_devices` and `DRIVER_OBJECT.get_devices` methods to the API.
|
|
|
|
2.0.2
|
|
=====
|
|
Fix the behaviour of the offsets returned by the PDB scanner.
|
|
|
|
2.0.0
|
|
=====
|
|
Remove the `symbol_shift` mechanism, where symbol tables could alter their own symbols.
|
|
Symbols from a symbol table are now always the offset values. They can be added to a Module
|
|
and when symbols are requested from a Module they are shifted by the module's offset to get
|
|
an absolute offset. This can be done with `Module.get_absolute_symbol_address` or as part of
|
|
`Module.object_from_symbol(absolute = False, ...)`.
|
|
|
|
1.2.0
|
|
=====
|
|
* Added support for module collections
|
|
* Added context.modules
|
|
* Added ModuleRequirement
|
|
* Added get\_symbols\_by\_absolute\_location
|