 Andrew Case
|
328a178ede
|
Update README.txt for Volatility 2 archiving
|
2025-05-16 08:40:55 -05:00 |
|
|
iMHLv2
|
a438e76819
|
Merge pull request #765 from volatilityfoundation/win10_19041
add Win10 19041 support
|
2020-12-11 08:52:02 -06:00 |
|
|
Dave Lassalle
|
bdb2b4d1c7
|
add Win10 19041 support
|
2020-12-02 13:51:18 -06:00 |
|
|
Andrew Case
|
703b29be24
|
Linux - fix bug in file enumeration code
|
2020-08-16 15:04:55 -05:00 |
|
|
Andrew Case
|
3076ca09d9
|
Add proper support for non-raw memory samples where the page at offset 0 is missing
|
2020-08-16 15:03:51 -05:00 |
|
|
Andrew Case
|
a1f7d198b4
|
Remove unneeded translation override in the Lime address space
|
2020-08-16 15:02:54 -05:00 |
|
|
Andrew Case
|
5f685e5670
|
Second update to dwarf.py
|
2020-05-28 15:12:59 -05:00 |
|
|
Andrew Case
|
7b3f52b669
|
update dwarf parsing for missing DW_AT_byte_size
|
2020-05-28 14:59:57 -05:00 |
|
|
Andrew Case
|
2e48f2dc07
|
Add 64bit address printing to malfind
|
2020-05-13 18:09:21 -05:00 |
|
|
Andrew Case
|
794d25e1f7
|
Merge pull request #633 from iSmellPowder/patch-1
Update tty_check.py to support unified output
|
2020-05-13 18:06:30 -05:00 |
|
|
Andrew Case
|
fb0e09974a
|
Merge pull request #625 from pagabuc/kuid_t
Handling kuid_t/kgid_t types in struct inode
|
2020-05-13 18:04:22 -05:00 |
|
|
Andrew Case
|
809b5d7f69
|
Merge pull request #559 from demoray/master
prevent infinite looping handling fops
|
2020-05-13 17:59:51 -05:00 |
|
|
Andrew Case
|
a7671739d3
|
Mac - check file header address and dyld info address before processing them
|
2020-04-23 11:57:48 -05:00 |
|
|
Andrew Case
|
abd18c8a62
|
Mac - provide proper symbol resolution when linkedit present
|
2020-04-22 13:55:19 -05:00 |
|
|
Andrew Case
|
69e02431a6
|
Mac - better filter for the main apps vnode
|
2020-04-22 13:49:16 -05:00 |
|
|
Andrew Case
|
7c0e805f9a
|
detect smear in bash artifact enumeration
|
2020-04-22 13:48:21 -05:00 |
|
|
Andrew Case
|
fa1c0b9da1
|
Mac - handle smear in shadow walking
|
2020-03-26 12:13:35 -05:00 |
|
|
atcuno
|
805a6a377c
|
Update mac_dump_maps
|
2020-03-03 12:21:49 -06:00 |
|
|
Andrew Case
|
1004fd8839
|
Updated supported Mac and Linux versions
|
2020-02-20 10:09:37 -06:00 |
|
|
Jamie Levy
|
050dab6dab
|
small fix
for some reason this was deleted in commit
3235757bd2
|
2019-10-08 10:20:03 -05:00 |
|
|
Andrew Case
|
a631894e0b
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2019-10-07 12:31:43 -05:00 |
|
|
Andrew Case
|
0249172dc2
|
Mac - add file extraction support for 10.14+
|
2019-10-07 12:31:23 -05:00 |
|
|
Andrew Case
|
62aa820f1b
|
Windows - update mapped file filter for rare smear instance
|
2019-10-06 11:42:27 -05:00 |
|
|
Andrew Case
|
f8b4df2842
|
Windows - update timeliner to report network sockets and connections more clearly
|
2019-10-02 16:37:47 -05:00 |
|
|
iMHLv2
|
4cafa31ca3
|
Merge pull request #650 from volatilityfoundation/windows_18362
add Win10_18362, May 2019 Update support
|
2019-10-02 15:42:14 -05:00 |
|
|
Michael Ligh
|
c808681ca9
|
update the readme for 18362
|
2019-10-02 15:41:01 -05:00 |
|
|
superponible
|
cde27bb359
|
add Win10_18362, May 2019 Update support
|
2019-10-02 13:34:11 -05:00 |
|
|
Andrew Case
|
e9fccc2db2
|
Mac - list_files smear protection
|
2019-10-01 10:20:28 -05:00 |
|
|
Michael Ligh
|
ce246c87fd
|
update some registry offsets
|
2019-08-28 16:41:46 -05:00 |
|
|
superponible
|
459d529b2e
|
fix registry BlockAddress for Win10
|
2019-08-14 18:36:47 -05:00 |
|
|
Andrew Case
|
861837051e
|
update mount for smear protection
|
2019-07-26 12:26:34 -05:00 |
|
|
iSmellPowder
|
370cb98342
|
Update tty_check.py to support unified output
Added in codes to support JSON/unified output
|
2019-07-23 10:55:57 +08:00 |
|
|
Andrew Case
|
8769579a83
|
Update check_afinfo for 4.18+
|
2019-07-10 11:22:51 -05:00 |
|
|
Andrew Case
|
d1e3c41ff0
|
Update pidhashtable for 4.18+
|
2019-07-10 11:22:39 -05:00 |
|
|
Fabio
|
d5b5ad8ed9
|
Handling kuid_t/kgid_t types in struct inode
|
2019-07-08 17:50:30 +02:00 |
|
|
Andrew Case
|
73cc683ab8
|
Mac - prevent smeared process memory ranges from being reported
|
2019-06-12 13:15:45 -05:00 |
|
|
Andrew Case
|
019b0f9fdc
|
Linux - add file extraction support for 4.18-4.20
|
2019-05-22 13:30:12 -05:00 |
|
|
Andrew Case
|
f44fe060a4
|
Mac - route cache smear protection
|
2019-05-21 14:37:01 -05:00 |
|
|
Andrew Case
|
74f1134865
|
Linux - more smear protection
|
2019-05-21 14:33:24 -05:00 |
|
|
Andrew Case
|
781d74acf3
|
Mac - fix bug in list_files
|
2019-04-30 14:16:02 -05:00 |
|
|
Andrew Case
|
56c491b499
|
Mac - better protect notifiers from smear
|
2019-04-30 08:41:03 -05:00 |
|
|
Andrew Case
|
17a2dfa952
|
Mac - add more sources of vnodes for cached file enumeration
|
2019-04-29 14:20:34 -05:00 |
|
|
Andrew Case
|
c87f60b514
|
Filter out invalid macho headers from AS loading
|
2019-04-29 10:33:29 -05:00 |
|
|
Andrew Case
|
b87c4648ed
|
Update mount enumeration v2
|
2019-04-22 14:07:38 -05:00 |
|
|
Andrew Case
|
1cd33e071c
|
Update mount enumeration v1
|
2019-04-22 14:01:20 -05:00 |
|
|
Michael Ligh
|
63f31e7359
|
handle cases where a service's ImagePath is REG_MULTI_SZ
in the observed case, the ImagePath was REG_MULTI_SZ but all strings except the first were blank/empty, so they should be safe to discard
|
2019-04-02 08:37:31 -05:00 |
|
|
Michael Ligh
|
76685dbf95
|
patch the windows handles() plugin for older no PAT systems
|
2019-04-01 11:05:37 -05:00 |
|
|
Michael Ligh
|
2c2fad914f
|
add an additional sanity check to windows services, exclude those without valid service type values
|
2019-04-01 10:18:03 -05:00 |
|
|
Andrew Case
|
794d15e4ad
|
Mac - update full path calc with smear protection
|
2019-02-27 20:47:24 -06:00 |
|
|
Andrew Case
|
e2712e586f
|
Mac - protect against list_files smearing
|
2019-02-27 18:02:43 -06:00 |
|