mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-25 15:42:24 +02:00
Jack Wengerandikelos
53c36d91c3
Added documentation and logging added cachedump and lsadump Fixed requested issues fixed encoding issues added requirement Framework: Move cache_clear function to the framework Documentation: Document self.config slightly better Linux/Mac: Refactor *nix Utilities classes Automagic: Fix issue in recent refactor Add elf parsing and symbol retrieval for linux kernel modules Fixes on coding style Linux: Restore accidentally dropped kobject definition Core: Rerun yapf across the codebase. First attempt and better DTB and ASLR validation. Debugging statements left in. Mac: Stash the verified ASLR shift and improve logging Linux: Support stashing the KASLR Remove extra debug prints added hashdump Added documentation and logging Linux - stash the Linux kernel virtual address Hashdump: Reformat and convert to proper byte handling Registry: Fix error message Caching: Only cache remote files Yarascan: Move most of yarascanning into a versionable plugin This refactors common yara tasks, so we can use the plugin versioning to keep track of changes to the YaraScanner class. Core: Refactor versioning and associated requirements Configuration: Improve the VersionableInterface documentation Plugins: Remove unnecessary dependency for yarascan Objects: Add a convenience function for validating enum values Objects: Update enumeration method to is_valid_choice Core: Maintain 3.5.3 compatibility created tty_check.py; edited automagic/linux.py to add kernel tracking abilities fixed some formatting for tty_check.py Fixed tty_check not finding the ttyhook module added some documentation Removed unnecessary code from tty_check.py added docs to automagic methods, fixed missing return types, changed parameters to be more specific added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods added parameter type to generate_kernel_handler_info Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at removed debugging print statements fixed bug causing no output when tty_check is run Windows.info: Refactor windows.info as classmethods Linux: Fix plugin case and re-run yapf created keyboard_notifiers removed extra whitespace Yapf: Minor reformats for recent plugins Codebase: Ensure all conversions to bytes handle unicode All conversions using `latin-1` have been converted to `raw_unicode_escape` which is like `latin-1`, but handles unicode characters appropriately (with a `\u` prefix). Since this is like `latin-1` it should have no impact on things that ran previously, but those that would fail with a unicode error now will present an encoded unicode string. There may be situations where the binary representation of unicode would be better (timeliner file output?), but those can be changed when/if it's determined necessary. Fixes #274. Linux: Fix keyboard_notifiers copyright year Renderers: Fix the pretty renderer when no rows are emitted Timeliner: Sort results and provide a filter Sorts the results (as stated). Note that user interfaces may decide to sort their results in an order of their choosing. Also added a parameter that can be provided multiple times to only allow plugins that match (any of) the parameters provided. Timeliner: Actually make use of the TextIoWrapper Windows: Add a version to the info plugin now its got classmethods CLI: Add additional help about 'vol.py plugin --help' created linux_check_idt; plugin currently is not finding the module names for each entry in idt table fix copyright year fixed poor variable name, removed unnecessary code added address mask to fix issue with kernel tracking CLI: Revert epilog changes Update lsadump.py I'm not sure why your are getting this error since it works fine for me, but this may fix it