Code

macOS: Latest kernels support#1115

Code

Draft

Abyss-W4tcher wants to merge 30 commits intovolatilityfoundation:developvolatilityfoundation/volatility3:developfrom

Abyss-W4tcher:macos_automagic_updateAbyss-W4tcher/volatility3:macos_automagic_updateCopy head branch name to clipboard

Commits

Commits on Mar 20, 2024

• MH_FILESET kernelcache macOS support

  Abyss-W4tcher

  committed
  5214601

  Copy full SHA for 5214601

• set join_path and add _KERNEL_MIN_ADDRESS constant

  Abyss-W4tcher

  committed
  ffcae1c

  Copy full SHA for ffcae1c

• use _KERNEL_MIN_ADDRESS constant in virtual_to_physical_address

  Abyss-W4tcher

  committed
  606d6be

  Copy full SHA for 606d6be

• remove unnecessary import

  Abyss-W4tcher

  committed
  4bc21a1

  Copy full SHA for 4bc21a1

• add seen_banners mechanism

  Abyss-W4tcher

  committed
  2c3db89

  Copy full SHA for 2c3db89

• more explicit symbol table variable name

  Abyss-W4tcher

  committed
  6ea2f16

  Copy full SHA for 6ea2f16

• find_aslr caller and logging messages changes

  Abyss-W4tcher

  committed
  78fc8f7

  Copy full SHA for 78fc8f7

• logging message improvement

  Abyss-W4tcher

  committed
  3678ac5

  Copy full SHA for 3678ac5

• use lowGlo scanning for aslr calculation

  Abyss-W4tcher

  committed
  a8c55ef

  Copy full SHA for a8c55ef

• vm_kernel_slide calculations

  Abyss-W4tcher

  committed
  de50148

  Copy full SHA for de50148

• aslr validation

  Abyss-W4tcher

  committed
  a01c9c9

  Copy full SHA for a01c9c9

• kernelcache calculations utilities

  Abyss-W4tcher

  committed
  83b7d40

  Copy full SHA for 83b7d40

• save needed constants for later shift use

  Abyss-W4tcher

  committed
  0d19dbc

  Copy full SHA for 0d19dbc

• add constant config prefix helper for kernelcache

  Abyss-W4tcher

  committed
  e601ccc

  Copy full SHA for e601ccc

• save kernelcache config options in a specific intel layer, if needed

  Abyss-W4tcher

  committed
  4fd0228

  Copy full SHA for 4fd0228

• add logging and import path_join

  Abyss-W4tcher

  committed
  b99c688

  Copy full SHA for b99c688

• introduce kernelcache unslide, to circumvent the additional kernelcache slide to some symbols

  Abyss-W4tcher

  committed
  e079d99

  Copy full SHA for e079d99

Commits on Mar 23, 2024

• revert symbol table sliding, for macOS kernelcache

  Abyss-W4tcher

  committed
  f6b4996

  Copy full SHA for f6b4996

• add kernelcache support module

  Abyss-W4tcher

  committed
  37f25b5

  Copy full SHA for 37f25b5

• automagic: use kernelcache module if needed

  Abyss-W4tcher

  committed
  3e0f975

  Copy full SHA for 3e0f975

• remove unnecessary macos requirement

  Abyss-W4tcher

  committed
  e1b7151

  Copy full SHA for e1b7151

• revert logging and path_join imports

  Abyss-W4tcher

  committed
  2e6f675

  Copy full SHA for 2e6f675

• additional documentation

  Abyss-W4tcher

  committed
  781d1f0

  Copy full SHA for 781d1f0

Commits on Mar 24, 2024

• remove irrelevant sqlitecache line

  Abyss-W4tcher

  committed
  09db071

  Copy full SHA for 09db071

• clean comparison

  Abyss-W4tcher

  committed
  6b57710

  Copy full SHA for 6b57710

• use a regex pattern to determine banner major and minor versions

  Abyss-W4tcher

  committed
  a5c58a7

  Copy full SHA for a5c58a7

• lowglo scanner return type hinting

  Abyss-W4tcher

  committed
  fd37a00

  Copy full SHA for fd37a00

• check if offset in kernel boundaries checker is absolute or not

  Abyss-W4tcher

  committed
  16979f7

  Copy full SHA for 16979f7

• remove unnecessary processing in get_symbols_by_absolute_location

  Abyss-W4tcher

  committed
  bd5f3f3

  Copy full SHA for bd5f3f3

Commits on Aug 9, 2024

• Merge branch 'volatilityfoundation:develop' into macos_automagic_update

  Abyss-W4tcher

  authored
  bfdee3d

  Copy full SHA for bfdee3d