admin/volatilityfoundation-volatility
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility synced 2026-06-08 18:04:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 8284cbdf5e add additional registry offsets for recent windows 10 patches Michael Ligh 2018-08-13 16:40:19 -05:00
  • ce39efd207 additional Win10 17134 updates Dave Lassalle 2018-07-20 12:23:19 -05:00
  • dc389a370c dumpfiles: Jamie Levy 2018-07-03 10:45:33 -05:00
  • aa6b960c10 Add is_valid method to route enumeration atcuno 2018-06-14 12:43:52 -05:00
  • cbb24d78c8 Add is_valid method to route enumeration atcuno 2018-06-14 12:43:02 -05:00
  • a48aa66856 Linux - sanity check height member atcuno 2018-06-12 13:38:15 -05:00
  • be4dad1131 Linux - add sanity checks to uid/gid atcuno 2018-06-11 17:57:37 -05:00
  • 0e41cc5db6 Linux - speed up bash environment variable recovery atcuno 2018-06-11 13:48:31 -05:00
  • 62b516682d Linux - add cache for per-process file path lookups atcuno 2018-06-11 13:08:47 -05:00
  • e7eaee242a Linux - make type check specific in check_syscall atcuno 2018-06-11 09:49:41 -05:00
  • 9ad2619a95 Linux - add pidhashtable sanity checks atcuno 2018-06-06 11:19:28 -05:00
  • a2dd5d345d Merge pull request #507 from mturkia/iehistory gleeda 2018-05-23 16:15:22 -04:00
  • 83efee3974 Adding back silent option for mutantscan. gleeda 2018-05-23 15:59:36 -04:00
  • cee0f9ceca add additional sanity checks for invalid service records Michael Ligh 2018-05-22 09:26:24 -05:00
  • 4aa28d468f Merge branch 'master' of https://github.com/volatilityfoundation/volatility Michael Ligh 2018-05-15 17:31:32 -05:00
  • e13baff1b5 add Win2008R2SP1x64_24000 Michael Ligh 2018-05-15 17:31:25 -05:00
  • 1bbd7bc37f Update bash and env processing for speed and ifconfig for new versions atcuno 2018-05-14 16:15:39 -05:00
  • 22a950b25a Merge pull request #511 from volatilityfoundation/spring-creators-17134 iMHLv2 2018-05-10 07:04:44 -05:00
  • e68c0c803b Mac - update get_profile atcuno 2018-05-09 09:44:57 -05:00
  • d88dd6c685 initial commit for spring creators support Michael Ligh 2018-05-09 09:38:01 -05:00
  • 8e4eb4162a Mac - update get_profile atcuno 2018-05-08 21:20:52 -05:00
  • 67851fe71e Mac - update get_profile atcuno 2018-05-07 10:49:06 -05:00
  • 5399524c0d hashdump backtraced when reading corrupt registry values for the user name Michael Ligh 2018-05-07 09:16:47 -05:00
  • 5ea27484dd add some sanity checks on invalid tokens / sids Michael Ligh 2018-04-30 12:59:38 -05:00
  • 6fd90ce8a4 Add profiles for 10.0.10240.17770 (2018-02-10) Michael Ligh 2018-04-24 08:00:11 -05:00
  • 1b81b83a6a Linux - fix height calculation Andrew Case 2018-04-24 00:12:26 -05:00
  • f567ace9a3 Linux - check tree height in file cache Andrew Case 2018-04-17 08:35:06 -05:00
  • 3b463b8514 Fix iehistory plugin to not override scan selection Miika Turkia 2018-04-11 10:36:17 +03:00
  • c043acfb14 add unified_output to editbox plugin Muted Mouse 2018-03-25 19:46:09 +00:00
  • 25b4fd9f0e added ppid to pslist unified and test output Muted Mouse 2018-03-24 17:25:09 -04:00
  • 19e4c5f001 add unified output Muted Mouse 2018-03-24 17:22:36 -04:00
  • bfb7a297c7 Adding fixes to pyinstaller hooks for most recent version Jamie Levy 2018-02-27 10:55:26 -05:00
  • 682b340ae3 Linux - update psscan to debug.warning instead of debug.error atcuno 2018-02-22 14:24:28 -06:00
  • dfb2b91854 Merge pull request #445 from HomeSen/master gleeda 2018-02-20 10:39:08 -05:00
  • 22dd2e87fa Merge pull request #495 from volatilityfoundation/issue_490 iMHLv2 2018-02-15 09:36:06 -06:00
  • 493c5cec08 Windows - update EPROCESS.is_valid() atcuno 2018-02-06 13:26:19 -06:00
  • 5ea6d075e4 Refs #490 refactor _EPROCESS.Peb32 for wow64 DLLs Michael Ligh 2018-02-06 08:12:55 -06:00
  • 8200f565fb Mac - Add 10_13_3_17D47 profile atcuno 2018-01-25 17:40:50 -06:00
  • 913c18c212 Mac - strengthen validation of bash hash entries atcuno 2018-01-25 17:19:36 -06:00
  • 3fb1df2093 Merge branch 'master' of https://github.com/volatilityfoundation/volatility Michael Ligh 2018-01-16 19:20:08 -06:00
  • 80fc44f050 Fixing the ssdt plugin on Windows 10.0.10586.x Michael Ligh 2018-01-16 19:20:01 -06:00
  • 1707a8f032 Windows - skip invalid x64 SSDT entries Andrew Case 2018-01-16 13:38:16 -06:00
  • 8bb09e01dd Windows - add tighter contstraints to Idle process scanning Andrew Case 2018-01-16 10:53:26 -06:00
  • e9047178ed Add big page table magic offsets for 10.0.16299.192 (windows 10 64-bit) Michael Ligh 2018-01-10 12:05:47 -06:00
  • afd684e441 Windows - Add profiles for Windows 7 build 24000 - commit 2 atcuno 2018-01-10 10:13:10 -06:00
  • 4fc4a4b02d Windows - Add profiles for Windows 7 build 24000 atcuno 2018-01-10 10:12:11 -06:00
  • 049d1ff2b9 Mac - add collision set for 10.13.1 atcuno 2018-01-08 21:00:13 -06:00
  • ce100d39bc Mac - update get_profile for new High Sierra profiles atcuno 2018-01-08 20:45:34 -06:00
  • f74d0312c4 Linux - protect against corrupt inode pointers Andrew Case 2018-01-08 10:41:42 -06:00
  • b39d99392e Windows - add tighter constraints to SSDT validation Andrew Case 2017-12-26 14:28:15 -06:00
  • f3c9dfee93 The WinPeb32 profile modification wasn't being applied properly to some 64-bit server-based profiles Michael Ligh 2017-11-30 10:44:03 -06:00
  • 5cc5d2a2b8 Add another condition to the WinPeb32 profile modification (profile must be windows) Michael Ligh 2017-11-15 21:40:43 -06:00
  • 9b34586c95 Merge branch 'wow64support-2' Michael Ligh 2017-11-15 14:07:32 -06:00
  • 1e337dfb71 In some cases, a PicoContext may be nonzero but still invalid (i.e. a terminated process) Michael Ligh 2017-11-14 13:13:09 -06:00
  • 6c6d403933 Before win10, Wow64Process points to user land, so is_valid() fails Michael Ligh 2017-11-14 10:10:19 -06:00
  • 9dfa58d424 Update impscan to be more backwards compatible for plugins that call impscan's methods (is_wow64 is now an optional keyword arg with a default of False) Michael Ligh 2017-11-14 09:49:51 -06:00
  • dda318a012 Add back the bool() cast on IsWow64() Michael Ligh 2017-11-14 08:19:05 -06:00
  • dd0da529ab Move wow64 code to windows64.py and don't apply wow64 types globally Michael Ligh 2017-11-14 08:03:36 -06:00
  • b4c70ff6db Dynamically load the PEB32 structures from the 32-bit version of the 64-bit profile being analyzed Michael Ligh 2017-11-14 07:24:02 -06:00
  • bb3fc2f186 Fixes for wow64 support on windows 10 Michael Ligh 2017-11-13 22:35:35 -06:00
  • b51e3d912a Mac - update get_profile for new debug kits Andrew Case 2017-11-13 10:23:01 -06:00
  • e8201c666a Merge branch 'master' of https://github.com/volatilityfoundation/volatility Andrew Case 2017-11-13 10:09:04 -06:00
  • deb328d74b Merge branch 'master' of https://github.com/volatilityfoundation/volatility Andrew Case 2017-11-13 10:08:26 -06:00
  • 6157f32b69 Mac - Update profile generation for high sierra Andrew Case 2017-11-13 10:05:18 -06:00
  • fc127ca626 Mac - add support for vme_offset in vm_map_entry Andrew Case 2017-11-13 08:48:09 -06:00
  • 179d206d3d Update the ssdt plugin for Windows 10 profiles Michael Ligh 2017-11-13 07:59:34 -06:00
  • 2377c25139 Add additional offsets for win32k gui support on creators and fall creators Michael Ligh 2017-11-10 21:01:44 -06:00
  • 71233acd84 Merge branch 'fall-creators-16299' Michael Ligh 2017-11-10 13:15:10 -06:00
  • 715387c6eb Add initial profile modifications for win32k plugins on win10 creators / fall creators Michael Ligh 2017-11-10 13:14:10 -06:00
  • 6d24b05f86 Merge branch 'pico2' Michael Ligh 2017-11-10 12:53:14 -06:00
  • f14757f444 Fixing netscan TCP endpoints on Windows 10 Creators and Fall Creators Michael Ligh 2017-11-10 08:48:44 -06:00
  • f1d1ed283f Add support for windows fall creators (16299) Michael Ligh 2017-11-09 16:29:44 -06:00
  • cb9e3e69ec Updates for WSL support (process names only) Michael Ligh 2017-11-09 14:03:45 -06:00
  • 5f02c4b975 avoid analyzing hollowed exes - needs testing from mhl malfindupdates Andrew Case 2017-11-08 15:53:24 -06:00
  • 3e145527ec force boolean evaluation Andrew Case 2017-11-08 14:41:07 -06:00
  • 9c91f54127 Move unstable plugins, plugins still under development, and plugins maintained/supported by members of the community to the community repository Michael Ligh 2017-10-23 10:13:02 -05:00
  • 1476136618 Windows - add property for wow64process due to member rename Andrew Case 2017-10-18 13:46:24 -05:00
  • 71d938b390 Windows - add reportin of Pico process names picowork Andrew Case 2017-10-18 13:28:50 -05:00
  • ea2e75d169 Windows - update svchost check to svchost across volumes Andrew Case 2017-10-18 13:02:52 -05:00
  • 370839a661 Add support for impscan 64 Andrew Case 2017-09-14 12:43:10 -05:00
  • 7e6718ad95 Merge pull request #431 from blschatz/master gleeda 2017-09-13 09:02:40 -04:00
  • d5b8a19ddf Revert changes to basic.py bradley 2017-09-13 22:57:24 +10:00
  • c4fb8de58e Merge branch 'master' of https://github.com/volatilityfoundation/volatility.git bradley 2017-09-13 22:35:32 +10:00
  • 458f3354f0 Shift AFF4 volatility support to contrib bradley 2017-09-13 22:27:20 +10:00
  • 4ac6c836cc added missing definition for wchar gleeda 2017-09-08 16:07:50 -04:00
  • f5aabe2368 drivermodule fixes: gleeda 2017-09-08 15:42:48 -04:00
  • 49566255c9 Add support for enumerating the 32bit modules in a wow64 process Andrew Case 2017-09-08 12:42:05 -05:00
  • f07a3119ac Mac - protect against stale Catfish entries in DTB scanning Andrew Case 2017-09-07 17:20:11 -05:00
  • 4dd0ab7496 Merge branch 'master' of https://github.com/volatilityfoundation/volatility Andrew Case 2017-08-24 12:18:18 -05:00
  • 375ab769bb Mac - update get_profile with latest profiles Andrew Case 2017-08-24 12:17:56 -05:00
  • 8a8de36549 Merge branch 'master' of https://github.com/volatilityfoundation/volatility Andrew Case 2017-08-23 16:22:42 -05:00
  • 8edf2c64be Mac - update threads_simple to print the current priority instead of the base Andrew Case 2017-08-18 16:10:44 -05:00
  • 108c2052a3 Mac - update vm_map alias member mapping Andrew Case 2017-08-18 16:03:50 -05:00
  • cd979ae113 Mac - update zone enumeration and handling Andrew Case 2017-08-18 15:57:48 -05:00
  • 7dee89a83a Mac - update vtype generation for typedefs and update check_mig_table to use new type when available Andrew Case 2017-08-18 15:05:16 -05:00
  • 473fd0d1aa Mac - update check_fop through Sierra Andrew Case 2017-08-18 12:48:45 -05:00
  • 75f7d9fc21 computers suck Andrew Case 2017-08-18 12:24:13 -05:00
  • 2da5aec5ce Linux - update system call API Andrew Case 2017-08-17 22:57:27 -05:00
  • 4b680c86ec Linux - add support for indexes for both system call tables on 64 bit systems Andrew Case 2017-08-17 19:18:06 -05:00
  • f56382a389 Linux - remove prints and update api for linux_moddump Andrew Case 2017-08-17 04:01:55 -05:00