8000 Update Memory Acquisition artifact to store driver in user directory by scudette · Pull Request #4221 · Velocidex/velociraptor · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Update Memory Acquisition artifact to store driver in user directory #4221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
May 5, 2025
Merged

Update Memory Acquisition artifact to store driver in user directory #4221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c8168df
Update Memory Acquisition artifact to store driver in user directory
scudette May 5, 2025
3fbb72c
fix: upgrade webpack from 5.98.0 to 5.99.5
snyk-bot May 5, 2025
53ad981
Bump vite from 4.5.13 to 4.5.14 in /gui/velociraptor
dependabot[bot] May 1, 2025
523c7de
fix: upgrade recharts from 2.15.1 to 2.15.2
snyk-bot Apr 28, 2025
ab39aa9
fix: upgrade dompurify from 3.2.4 to 3.2.5
snyk-bot Apr 28, 2025
322948c
Bump react-router and react-router-dom in /gui/velociraptor
dependabot[bot] Apr 24, 2025
8856220
fix: upgrade @babel/runtime from 7.26.10 to 7.27.0
snyk-bot Apr 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions artifacts/definitions/Windows/Memory/Acquisition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ precondition: |
parameters:
- name: ServiceName
description: Override the name of the driver service to install.
- name: DriverPath
description: Where to unpack the driver before loading it.
default: C:\Windows\Temp\winpmem.sys
- name: Compression
default: None
type: choices
Expand All @@ -44,6 +47,7 @@ sources:
LET Tempfile <= tempfile(extension=".pmem")

LET ImageInfo <= winpmem(
driver_path=DriverPath,
service=ServiceName,
image_path=Tempfile,
compression=Compression)
Expand Down
10 changes: 10 additions & 0 deletions docs/references/vql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -658,6 +658,7 @@
required: true
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: cancel_flow
description: |
Cancels the flow.
Expand Down Expand Up @@ -1638,6 +1639,7 @@
description: Size of the LRU cache.
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: delay
description: Executes 'query' and delays relaying the rows by the specified number
of seconds.
Expand Down Expand Up @@ -8407,6 +8409,7 @@
to be added here.
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: s3
description: |
Allows access to S3 buckets.
Expand Down Expand Up @@ -8544,6 +8547,7 @@
permissions: SERVER_ADMIN
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: secret_modify
description: Modify the secret
type: Function
Expand Down Expand Up @@ -8571,11 +8575,13 @@
permissions: SERVER_ADMIN
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: secrets
description: Retrieve the list of secrets on the server.
type: Plugin
platforms:
- linux_amd64_cgo
- windows_amd64_cgo
- name: send_event
description: |
Sends an event to a server event monitoring queue.
Expand Down Expand Up @@ -11339,6 +11345,10 @@
type: string
description: When writing a memory image use this compression (default none) can
be none, s2, snappy, gzip.
- name: driver_path
type: string
description: Specify where to extract the driver - by default we use the temp
folder
category: windows
metadata:
permissions: MACHINE_STATE
Expand Down
Loading
Loading
0