Commit Graph

Select branches

Hide Pull Requests

bitmap_crashdumps

freebsd_support

gh-pages

issue-205

malfindupdates

master

mftparser

multiproc

picowork

win10_19041

win10_ssdt_indexes

#109

#109

#110

#117

#131

#131

#141

#152

#163

#163

#165

#171

#171

#172

#172

#173

#180

#181

#185

#186

#187

#188

#195

#203

#204

#207

#208

#208

#209

#212

#215

#216

#222

#224

#227

#228

#228

#236

#239

#239

#243

#252

#252

#260

#262

#265

#270

#288

#294

#294

#296

#297

#300

#301

#303

#303

#304

#305

#307

#308

#317

#318

#335

#345

#352

#357

#357

#362

#362

#369

#369

#370

#370

#371

#375

#375

#377

#385

#385

#390

#390

#394

#394

#396

#398

#403

#407

#409

#409

#415

#415

#420

#420

#421

#431

#433

#445

#449

#450

#468

#468

#480

#480

#481

#481

#483

#483

#495

#500

#500

#501

#507

#511

#521

#521

#530

#549

#553

#553

#559

#561

#561

#562

#563

#563

#566

#569

#572

#574

#575

#576

#577

#577

#579

#593

#625

#626

#631

#631

#633

#634

#634

#635

#635

#636

#636

#637

#637

#641

#641

#642

#642

#650

#652

#652

#660

#660

#669

#678

#678

#679

#679

#689

#689

#694

#694

#726

#726

#729

#729

#762

#762

#765

#767

#767

#781

#782

#784

#784

#80

#80

#800

#800

#801

#801

#81

#81

#813

#813

#825

#829

#829

#838

#838

#839

#839

#852

#852

#853

#854

#854

#88

#88

#886

#886

#90

#90

#95

#95

2.0

2.1

2.2

2.3

2.3.1

2.4

2.4.1

2.5

2.6

2.6.1

Mono Color

• 328a178ede Update README.txt for Volatility 2 archiving master Andrew Case 2025-05-16 08:40:55 -05:00
• a438e76819 Merge pull request #765 from volatilityfoundation/win10_19041 iMHLv2 2020-12-11 08:52:02 -06:00
• bdb2b4d1c7 add Win10 19041 support win10_19041 Dave Lassalle 2020-12-02 13:51:18 -06:00
• 703b29be24 Linux - fix bug in file enumeration code Andrew Case 2020-08-16 15:04:55 -05:00
• 3076ca09d9 Add proper support for non-raw memory samples where the page at offset 0 is missing Andrew Case 2020-08-16 15:03:51 -05:00
• a1f7d198b4 Remove unneeded translation override in the Lime address space Andrew Case 2020-08-16 15:02:54 -05:00
• 5f685e5670 Second update to dwarf.py Andrew Case 2020-05-28 15:12:59 -05:00
• 7b3f52b669 update dwarf parsing for missing DW_AT_byte_size Andrew Case 2020-05-28 14:59:57 -05:00
• 2e48f2dc07 Add 64bit address printing to malfind Andrew Case 2020-05-13 18:09:21 -05:00
• 794d25e1f7 Merge pull request #633 from iSmellPowder/patch-1 Andrew Case 2020-05-13 18:06:30 -05:00
• fb0e09974a Merge pull request #625 from pagabuc/kuid_t Andrew Case 2020-05-13 18:04:22 -05:00
• 809b5d7f69 Merge pull request #559 from demoray/master Andrew Case 2020-05-13 17:59:51 -05:00
• a7671739d3 Mac - check file header address and dyld info address before processing them Andrew Case 2020-04-23 11:57:48 -05:00
• abd18c8a62 Mac - provide proper symbol resolution when linkedit present Andrew Case 2020-04-22 13:55:19 -05:00
• 69e02431a6 Mac - better filter for the main apps vnode Andrew Case 2020-04-22 13:49:16 -05:00
• 7c0e805f9a detect smear in bash artifact enumeration Andrew Case 2020-04-22 13:48:21 -05:00
• fa1c0b9da1 Mac - handle smear in shadow walking Andrew Case 2020-03-26 12:13:35 -05:00
• 805a6a377c Update mac_dump_maps atcuno 2020-03-03 12:21:49 -06:00
• 1004fd8839 Updated supported Mac and Linux versions Andrew Case 2020-02-20 10:09:37 -06:00
• 5703572483 initial commit of freebsd support freebsd_support Michael Ligh 2019-11-15 10:52:58 -06:00
• 3df9f77870 fix bitmap crashdump vtype and add 32-bit support bitmap_crashdumps superponible 2019-11-06 10:25:58 -06:00
• 050dab6dab small fix Jamie Levy 2019-10-08 10:20:03 -05:00
• a631894e0b Merge branch 'master' of https://github.com/volatilityfoundation/volatility Andrew Case 2019-10-07 12:31:43 -05:00
• 0249172dc2 Mac - add file extraction support for 10.14+ Andrew Case 2019-10-07 12:31:23 -05:00
• 62aa820f1b Windows - update mapped file filter for rare smear instance Andrew Case 2019-10-06 11:42:27 -05:00
• f8b4df2842 Windows - update timeliner to report network sockets and connections more clearly Andrew Case 2019-10-02 16:37:47 -05:00
• 4cafa31ca3 Merge pull request #650 from volatilityfoundation/windows_18362 iMHLv2 2019-10-02 15:42:14 -05:00
• c808681ca9 update the readme for 18362 Michael Ligh 2019-10-02 15:41:01 -05:00
• cde27bb359 add Win10_18362, May 2019 Update support superponible 2019-10-02 13:34:11 -05:00
• e9fccc2db2 Mac - list_files smear protection Andrew Case 2019-10-01 10:20:28 -05:00
• ce246c87fd update some registry offsets Michael Ligh 2019-08-28 16:41:46 -05:00
• 459d529b2e fix registry BlockAddress for Win10 superponible 2019-08-14 18:36:47 -05:00
• 861837051e update mount for smear protection Andrew Case 2019-07-26 12:26:34 -05:00
• 370cb98342 Update tty_check.py to support unified output iSmellPowder 2019-07-23 10:55:57 +08:00
• 8769579a83 Update check_afinfo for 4.18+ Andrew Case 2019-07-10 11:22:51 -05:00
• d1e3c41ff0 Update pidhashtable for 4.18+ Andrew Case 2019-07-10 11:22:39 -05:00
• d5b5ad8ed9 Handling kuid_t/kgid_t types in struct inode Fabio 2018-07-04 17:40:44 +02:00
• 73cc683ab8 Mac - prevent smeared process memory ranges from being reported Andrew Case 2019-06-12 13:15:45 -05:00
• 019b0f9fdc Linux - add file extraction support for 4.18-4.20 Andrew Case 2019-05-22 13:30:12 -05:00
• f44fe060a4 Mac - route cache smear protection Andrew Case 2019-05-21 14:37:01 -05:00
• 74f1134865 Linux - more smear protection Andrew Case 2019-05-21 14:33:24 -05:00
• 781d74acf3 Mac - fix bug in list_files Andrew Case 2019-04-30 14:16:02 -05:00
• 56c491b499 Mac - better protect notifiers from smear Andrew Case 2019-04-30 08:41:03 -05:00
• 17a2dfa952 Mac - add more sources of vnodes for cached file enumeration Andrew Case 2019-04-29 14:20:34 -05:00
• c87f60b514 Filter out invalid macho headers from AS loading Andrew Case 2019-04-29 10:33:29 -05:00
• 9b71e9e4e0 fix ssdt indexes on windows 10 x64 win10_ssdt_indexes Michael Ligh 2019-04-26 10:22:08 -05:00
• b87c4648ed Update mount enumeration v2 Andrew Case 2019-04-22 14:07:38 -05:00
• 1cd33e071c Update mount enumeration v1 Andrew Case 2019-04-22 14:01:20 -05:00
• 63f31e7359 handle cases where a service's ImagePath is REG_MULTI_SZ Michael Ligh 2019-04-02 08:37:31 -05:00
• 76685dbf95 patch the windows handles() plugin for older no PAT systems Michael Ligh 2019-04-01 11:05:37 -05:00
• 2c2fad914f add an additional sanity check to windows services, exclude those without valid service type values Michael Ligh 2019-04-01 10:18:03 -05:00
• 794d15e4ad Mac - update full path calc with smear protection Andrew Case 2019-02-27 20:47:24 -06:00
• e2712e586f Mac - protect against list_files smearing Andrew Case 2019-02-27 18:02:43 -06:00
• 1e2a985861 Mac - smear protection on process maps walking and task enumeration Andrew Case 2019-02-27 13:51:49 -06:00
• c618b165ef Merge pull request #593 from volatilityfoundation/copy_data_block_order superponible 2019-02-26 10:01:26 -06:00
• 753bfa87b6 Linux - fix smear issue in check_fop Andrew Case 2019-02-11 18:47:58 -06:00
• 975b557847 Linux - update pidhashtable to fix bug Andrew Case 2019-02-11 17:37:34 -06:00
• ef758329d4 Linux - update check_idt for new data structure Andrew Case 2019-02-11 14:15:01 -06:00
• 82cfd41b4b Mac - fix smearing corruption in route cache gathering Andrew Case 2019-02-11 13:45:49 -06:00
• 5c728c8d2b Linux - fix the 1000th iteration mount list corruption Andrew Case 2019-02-11 13:31:30 -06:00
• 34267585fe force ordering of copy_data_block offsets superponible 2019-02-06 22:22:05 -06:00
• f1ac0b1e90 Merge pull request #574 from ant1/fix-yarascan-R iMHLv2 2019-01-30 09:19:36 -06:00
• 60c2907562 Merge pull request #579 from volatilityfoundation/windows_17763 iMHLv2 2019-01-30 08:44:01 -06:00
• 5865a1539f add Win10 17763 profiles, October 2018 Update superponible 2019-01-29 14:37:30 -06:00
• 569b7b971a Linux - add further smear protection Andrew Case 2019-01-21 21:25:32 -06:00
• 355773b9bb Linux - update process hash table enumeration for 4.20 Andrew Case 2019-01-15 09:56:04 -06:00
• 79b61a9cea Linux - update cached file extraction for 4.20 Andrew Case 2019-01-15 09:55:40 -06:00
• 8c05ce05a0 Linux - update check syscall Andrew Case 2019-01-15 09:54:57 -06:00
• 99d1de83e4 Linux - Update check_fops for 4.20 Andrew Case 2019-01-15 09:52:08 -06:00
• 61a77adc33 Linux - update pidhashtable with more smear protection Andrew Case 2019-01-07 11:33:53 -06:00
• 73077d6fe6 Fix the offset printed when using linux_yarascan -R Antoine 2018-12-24 07:40:16 +00:00
• df6c40aa1b Fix the offset printed when using mac_yarascan -R Antoine 2018-12-24 07:31:10 +00:00
• 68aeefbf64 Fix the offset printed when using yarascan -R Antoine 2018-12-21 10:12:23 +00:00
• c67017651e Merge pull request #572 from atoptsoglou/patch-1 2.6.1 gleeda 2018-12-18 11:23:04 -06:00
• 530588f2f4 Bump to 2.6.1 atoptsoglou 2018-12-18 18:10:40 +01:00
• 9c1c613be2 Merge pull request #501 from mutedmouse/master gleeda 2018-12-06 10:22:54 -06:00
• 0335b6faa2 Merge pull request #549 from pagabuc/apihooks_refactor gleeda 2018-12-06 10:20:15 -06:00
• 2a69fab1cc Merge pull request #562 from mattura/master gleeda 2018-12-06 10:16:23 -06:00
• 4d44a45290 Merge pull request #569 from mifrazmurthaja/master gleeda 2018-12-06 10:14:31 -06:00
• ec395d7ed9 add registry offsets for recent windows 10 updates Michael Ligh 2018-12-05 12:06:33 -06:00
• 9df8aa6daa Linux - update heap processing code to find correct regions Andrew Case 2018-11-29 13:53:11 -06:00
• cd9a76e1f2 Merge pull request #1 from mifrazmurthaja/shellbags-json Mifraz Murthaja 2018-11-24 15:03:58 +05:30
• ca5bee5690 Bug on shellbags command when the output is json Mifraz Murthaja 2018-11-24 15:02:38 +05:30
• 99bf82a21d Merge pull request #566 from xtrm0/patch-1 gleeda 2018-11-13 15:09:35 -05:00
• 720edbd8c1 Fix #565 xtrm0 2018-11-13 15:27:13 +00:00
• 6e3b2e8100 Fix updated pyinstaller "empty DEST" issue mattura 2018-11-06 14:06:01 +00:00
• 4821ab67df Fix updated pyinstaller "empty DEST" issue mattura 2018-11-06 14:05:26 +00:00
• 13c6343e84 Fix updated pyinstaller "empty DEST" issue mattura 2018-11-06 14:04:48 +00:00
• d2bdef1858 prevent infinite looping handling fops Brian Caswell 2018-10-30 16:37:50 -04:00
• 57c69e5ae1 Linux - skip smeared vm_area_struct instances atcuno 2018-10-10 23:12:12 -05:00
• 343753c64f Linux - update operations member checking to avoid RedHat stupidity atcuno 2018-10-10 22:43:57 -05:00
• 725ae29b35 Linux - prevent enumerating memory mappings of smeared processes atcuno 2018-10-09 20:39:17 -05:00
• 49896432af Linux - update types to support ssizetype atcuno 2018-10-08 09:11:03 -05:00
• 2ce4c7f039 Add support for the new process tracking radix tree in kernels 4.15+ atcuno 2018-10-01 12:41:25 -05:00
• 4eb70b302a Fix DTB finding to account for multiple copies of the init_task structure atcuno 2018-09-27 13:22:16 -05:00
• 1ed98b827b add a good amount of new big pool offsets (for registry analysis of win10 samples) Michael Ligh 2018-09-24 10:16:04 -05:00
• 76c3f09ee4 refactor in plt_hook_info to avoid to gather the mappings of the process for every elf relocation Fabio 2018-09-24 14:06:37 +02:00
• 1159a217ca additional bigpagepool offset Dave Lassalle 2018-09-05 16:08:57 -05:00
• 8615b01c46 Update for Linux scanning to support thread_info member of task_struct atcuno 2018-08-24 20:36:59 -05:00
• c374159750 update full_key_name() for version of win10 Dave Lassalle 2018-08-17 11:59:46 -05:00