Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Crashdump Writer plugin #694

Closed
wants to merge 503 commits into from
Closed

Crashdump Writer plugin #694

wants to merge 503 commits into from

Conversation

paulkermann
Copy link
Contributor

This PR furthers the work done in #472, to correctly create a crashdump (properly loaded in Windbg).
Importantly, this also allows parsing encoded KDBG structs in framework/plugins/windows/info.py.

ikelos and others added 30 commits October 17, 2021 00:25
@ikelos
Windows: Check only valid page table entries
865cb92
@ikelos
Windows: Limit pointers to layer maximum address
fb6610f
@ikelos
Windows: Max pointers at maximum layer address
49fe653
@ikelos
Windows: Stop looking for DTBs when a good one is found
9b4324a
@ikelos
Layers: Fix bug where PAT flag is treated as address
2a78314
@garanews
fix some typo
449c2aa
@ikelos
Merge pull request volatilityfoundation#582 from garanews/develop
a7ad0db 
fix some typo
@CaptWake
issue-449 - add --physical flag
2d3d133
@CaptWake
psscan: Remove usage of PHYSICAL_DEFAULT variable
6979a6d
@ikelos
Windows: Lower the vadlimit on MHL's advice
20ca165
@ikelos
Merge pull request volatilityfoundation#579 from volatilityfoundation…
0c603a2 
…/feature/vad-maxsize

Windows: Set a 100Gb VAD max size for vadinfo
@ikelos
Merge pull request volatilityfoundation#584 from CaptWake/issue-449
bcdec8a 
issue-449 - add --physical flag
@ikelos
Merge pull request volatilityfoundation#580 from volatilityfoundation…
23453f5 
…/issues/large-page-fix

Layers: Fix bug where PAT flag is treated as address
@ikelos
Layers: Speed up qemu by not bisecting
a1cbea2
@ikelos
Core: Fix up python 3.10 support
3cb2bf9 
Fixes volatilityfoundation#589
@ikelos
Layers: Close file on layer destruction to prevent ResourceWarning
8d48faa
@ikelos
Layers: Comment out unused code in AVML
f821ac6
@a5hlynx
update version to 2.0.0
6803490
@ikelos
Merge pull request volatilityfoundation#594 from a5hlynx/develop
da1216a 
update version to 2.0.0
@ikelos
Plugins: Bump skeleton_key_check to 2.0.0
96820e2
@japhlange
adds netstat symbols to Win8x64 ISF files
fffb375
@japhlange
reverts pointless createtime offset change
90ad7b1
@japhlange
adds new ISF for tcpip.sys 6.3.9600.19935 + distinguisher
ee65793
@japhlange
adds a few clarifying comments and handles errors better
3aac7b2
@japhlange
adds proper version requirement for verinfo
6cd2d94
@japhlange
improves decision making when to inspect driver pe header based on ve…
be4d014 
…rsion_dict
@japhlange
re-adds accidentally deleted file
125658e
@ikelos
Merge pull request volatilityfoundation#476 from japhlange/issues/iss…
8f083ed 
…ue474_netscan_win8sp1x64

adds netstat symbols to Win8x64 ISF files
@ikelos
Merge pull request volatilityfoundation#586 from volatilityfoundation…
32ec4af 
…/issues/qemu-speed-up

Layers: Speed up qemu by not bisecting
@ikelos
Linux: Fix long standing typo (thanks to @gcmoreira)
832bdc2
digitalisx and others added 15 commits March 28, 2022 00:36
@digitalisx
Add Windows DRIVER_OBJECT, DEVICE_OBJECT method
fb081ec
@digitalisx
Initialize DeviceTree plugin
6b91927
@digitalisx
Core: Bump the development version to 2.0.3
95a11c3
@digitalisx
Modify return type hint of method for get driver's and device's
ff9c5ce
@digitalisx
Revert method for get driver's and device's name
2f3bc8c
@digitalisx
Modify code comment of get_attached_devices method
8c29ba9
@digitalisx
Prettier of TreeGrid column
8104ee5
@digitalisx
Move handling of ValueError, PagedInvalidAddressException to _generator
7b3fa27
@digitalisx
Fix typo error for licenses, docs
655ab93
@digitalisx
Merge branch 'volatilityfoundation:develop' into fix/typo
03366d8
@digitalisx
Fix typo error of docs (Unreadable)
0fcc0d8
@digitalisx
Merge branch 'fix/typo' of https://github.com/Digitalisx/volatility3 …
8578a27 
…into fix/typo
@ikelos
Merge pull request volatilityfoundation#690 from Digitalisx/fix/typo
b94b45a 
Fix Typo Error for licenses, document.
@ikelos
Merge pull request volatilityfoundation#689 from Digitalisx/feature/d…
db20ccf 
…evice-tree

Implement DeviceTree plugin.
@ikelos
Windows: Fix the location of a netstat data file
f519147 
Very kindly pointed out by @digitalisx.
Closes volatilityfoundation#691
digitalisx
digitalisx reviewed Mar 30, 2022
View reviewed changes
Copy link
Contributor

@digitalisx digitalisx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed a very small thing about coding conventions/formats by PEP 8 style!

volatility3/framework/plugins/windows/info.py Outdated Show resolved Hide resolved
@paulkermann paulkermann force-pushed the feature/writecrashdump-plugin branch from 2bac5b1 to 70b0602 Compare March 30, 2022 08:20
@paulkermann
Copy link
Contributor Author

This PR is rebased on develop so only something like the last 3 commits really matter

@paulkermann paulkermann mentioned this pull request Mar 31, 2022
Closed
5 tasks
@paulkermann paulkermann mentioned this pull request Apr 27, 2022
Open
@paulkermann
Copy link
Contributor Author

#718 is now the active PR for this plugin

@paulkermann paulkermann deleted the feature/writecrashdump-plugin branch April 27, 2022 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@digitalisx digitalisx digitalisx left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.