admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,688 Commits 11 Branches 10 Tags
80fc44f0505ea6af7e77d491e4c46ec79b3e2cf3
Commit Graph

2688 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Ligh 80fc44f050 Fixing the ssdt plugin on Windows 10.0.10586.x 2018-01-16 19:20:01 -06:00
Andrew Case 8bb09e01dd Windows - add tighter contstraints to Idle process scanning 2018-01-16 10:53:26 -06:00
Michael Ligh e9047178ed Add big page table magic offsets for 10.0.16299.192 (windows 10 64-bit) 2018-01-10 12:05:47 -06:00
atcuno afd684e441 Windows - Add profiles for Windows 7 build 24000 - commit 2 2018-01-10 10:13:10 -06:00
atcuno 4fc4a4b02d Windows - Add profiles for Windows 7 build 24000 2018-01-10 10:12:11 -06:00
atcuno 049d1ff2b9 Mac - add collision set for 10.13.1 2018-01-08 21:00:13 -06:00
atcuno ce100d39bc Mac - update get_profile for new High Sierra profiles 2018-01-08 20:45:34 -06:00
Andrew Case f74d0312c4 Linux - protect against corrupt inode pointers 2018-01-08 10:41:42 -06:00
Andrew Case b39d99392e Windows - add tighter constraints to SSDT validation 2017-12-26 14:28:15 -06:00
Michael Ligh f3c9dfee93 The WinPeb32 profile modification wasn't being applied properly to some 64-bit server-based profiles 2017-11-30 10:44:03 -06:00
Michael Ligh 5cc5d2a2b8 Add another condition to the WinPeb32 profile modification (profile must be windows) 2017-11-15 21:40:43 -06:00
Michael Ligh 9b34586c95 Merge branch 'wow64support-2' 2017-11-15 14:07:32 -06:00
Michael Ligh 1e337dfb71 In some cases, a PicoContext may be nonzero but still invalid (i.e. a terminated process) 2017-11-14 13:13:09 -06:00
Michael Ligh 6c6d403933 Before win10, Wow64Process points to user land, so is_valid() fails 2017-11-14 10:10:19 -06:00
Michael Ligh 9dfa58d424 Update impscan to be more backwards compatible for plugins that call impscan's methods (is_wow64 is now an optional keyword arg with a default of False) 2017-11-14 09:49:51 -06:00
Michael Ligh dda318a012 Add back the bool() cast on IsWow64() 2017-11-14 08:19:05 -06:00
Michael Ligh dd0da529ab Move wow64 code to windows64.py and don't apply wow64 types globally 2017-11-14 08:03:36 -06:00
Michael Ligh b4c70ff6db Dynamically load the PEB32 structures from the 32-bit version of the 64-bit profile being analyzed 2017-11-14 07:24:02 -06:00
Michael Ligh bb3fc2f186 Fixes for wow64 support on windows 10 2017-11-13 22:35:35 -06:00
Andrew Case b51e3d912a Mac - update get_profile for new debug kits 2017-11-13 10:23:01 -06:00
Andrew Case e8201c666a Merge branch 'master' of https://github.com/volatilityfoundation/volatility 2017-11-13 10:09:04 -06:00
Andrew Case deb328d74b Merge branch 'master' of https://github.com/volatilityfoundation/volatility 2017-11-13 10:08:26 -06:00
Andrew Case 6157f32b69 Mac - Update profile generation for high sierra 2017-11-13 10:05:18 -06:00
Andrew Case fc127ca626 Mac - add support for vme_offset in vm_map_entry 2017-11-13 08:48:09 -06:00
Michael Ligh 179d206d3d Update the ssdt plugin for Windows 10 profiles 2017-11-13 07:59:34 -06:00
Michael Ligh 2377c25139 Add additional offsets for win32k gui support on creators and fall creators 2017-11-10 21:01:44 -06:00
Michael Ligh 71233acd84 Merge branch 'fall-creators-16299' 2017-11-10 13:15:10 -06:00
Michael Ligh 715387c6eb Add initial profile modifications for win32k plugins on win10 creators / fall creators 2017-11-10 13:14:10 -06:00
Michael Ligh 6d24b05f86 Merge branch 'pico2' 2017-11-10 12:53:14 -06:00
Michael Ligh f14757f444 Fixing netscan TCP endpoints on Windows 10 Creators and Fall Creators 2017-11-10 08:48:44 -06:00
Michael Ligh f1d1ed283f Add support for windows fall creators (16299) 2017-11-09 16:29:44 -06:00
Michael Ligh cb9e3e69ec Updates for WSL support (process names only) 2017-11-09 14:03:45 -06:00
Andrew Case 3e145527ec force boolean evaluation 2017-11-08 14:41:07 -06:00
Michael Ligh 9c91f54127 Move unstable plugins, plugins still under development, and plugins maintained/supported by members of the community to the community repository 2017-10-23 10:13:02 -05:00
Andrew Case 1476136618 Windows - add property for wow64process due to member rename 2017-10-18 13:46:24 -05:00
Andrew Case 370839a661 Add support for impscan 64 2017-09-14 12:43:10 -05:00
gleeda 7e6718ad95 Merge pull request #431 from blschatz/master 
AFF4 Support for Volatility
 2017-09-13 09:02:40 -04:00
bradley d5b8a19ddf Revert changes to basic.py 2017-09-13 22:57:24 +10:00
bradley c4fb8de58e Merge branch 'master' of https://github.com/volatilityfoundation/volatility.git 2017-09-13 22:35:32 +10:00
bradley 458f3354f0 Shift AFF4 volatility support to contrib 2017-09-13 22:27:20 +10:00
gleeda 4ac6c836cc added missing definition for wchar 2017-09-08 16:07:50 -04:00
gleeda f5aabe2368 drivermodule fixes: 
crashed when supplying a base address due to missing data that
was not yielded.

also made the "ADDR" arg clearer
 2017-09-08 15:42:48 -04:00
Andrew Case 49566255c9 Add support for enumerating the 32bit modules in a wow64 process 2017-09-08 12:42:05 -05:00
Andrew Case f07a3119ac Mac - protect against stale Catfish entries in DTB scanning 2017-09-07 17:20:11 -05:00
Andrew Case 4dd0ab7496 Merge branch 'master' of https://github.com/volatilityfoundation/volatility 2017-08-24 12:18:18 -05:00
Andrew Case 375ab769bb Mac - update get_profile with latest profiles 2017-08-24 12:17:56 -05:00
Andrew Case 8a8de36549 Merge branch 'master' of https://github.com/volatilityfoundation/volatility 2017-08-23 16:22:42 -05:00
Andrew Case 8edf2c64be Mac - update threads_simple to print the current priority instead of the base 2017-08-18 16:10:44 -05:00
Andrew Case 108c2052a3 Mac - update vm_map alias member mapping 2017-08-18 16:03:50 -05:00
Andrew Case cd979ae113 Mac - update zone enumeration and handling 2017-08-18 15:57:48 -05:00