volatilityfoundation/volatility3 v2.8.0

Volatility 3 2.8.0

on GitHub

New plugins:

• vmscan
• linux.netfilter
• windows.hollowprocesses
• windows.kpcrs
• windows.pedump
• windows.processghosting
• windows.psxview
• windows.registry.getcellroutine
• windows.shimcachemem
• windows.suspicious_threads
• windows.svcdiff
• windows.svclist
• windows.threads
• windows.timers
• windows.unloadedmodules

Improvements to:

• userassist with timeliner support
• bugfixes and additions to windows.modules and windows.modscan
• windows.callbacks plugin to support more callbacks
• Smear protection on windows
• Clearing the cache
• Intel layer
• Clang no longer using long unsigned int for pointers
• argcomplete support

Volatility 3 now uses features that require a minimum version of python >= 3.7.3.