mirror of
https://github.com/volatilityfoundation/volatility
synced 2026-06-08 18:04:46 +00:00
sync with r3514
This commit is contained in:
+1
-1
@@ -18,7 +18,7 @@ AAron Walters
|
||||
Volatility 1.3:
|
||||
------------
|
||||
|
||||
AAron Walters <awalters@volatilesystems.com>
|
||||
AAron Walters <awalters@4tphi.net>
|
||||
Volatile Systems LLC
|
||||
|
||||
Brendan Dolan-Gavitt <bdolangavitt@wesleyan.edu>
|
||||
|
||||
@@ -4,12 +4,13 @@ Volatility
|
||||
License
|
||||
-------
|
||||
|
||||
Copyright (C) 2007-2011 Volatile Systems
|
||||
Copyright (C) 2007-2013 Volatility Foundation
|
||||
|
||||
Volatility is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU General Public License
|
||||
as published by the Free Software Foundation; either version 2
|
||||
of the License, or (at your option) any later version.
|
||||
Volatility is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License Version 2 as
|
||||
published by the Free Software Foundation. You may not use, modify or
|
||||
distribute this program under any other version of the GNU General
|
||||
Public License.
|
||||
|
||||
Volatility is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
@@ -17,7 +18,4 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
|
||||
USA.
|
||||
|
||||
along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
+12
-1
@@ -2,7 +2,7 @@
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
@@ -278,3 +278,14 @@ PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
Notwithstanding any rights to use the Software granted by the foregoing,
|
||||
if entities or individuals have received a Cease & Desist letter from
|
||||
the Volatility Project, the Volatility Foundation, or its copyright holders
|
||||
for violating the terms of the GPL version 2, those entities (their employees,
|
||||
subcontractors, independent contractors, and affiliates) and / or persons
|
||||
are granted no such rights and any use by any one or more of them is
|
||||
expressly prohibited, in accordance with Section 4 of the GPL version 2.
|
||||
Any rights granted to such entities and / or persons by earlier license
|
||||
agreements have been previously terminated as to them.
|
||||
|
||||
|
||||
@@ -2,9 +2,9 @@ Metadata-Version: 1.0
|
||||
Name: Volatility
|
||||
Version: GC1
|
||||
Summary: Volatility -- Volatile memory framwork
|
||||
Home-page: http://www.volatilesystems.com
|
||||
Home-page: http://www.volatilityfoundation.org
|
||||
Author: AAron Walters
|
||||
Author-email: awalters@volatilesystems.com
|
||||
Author-email: awalters@4tphi.net
|
||||
License: GPL
|
||||
Description: UNKNOWN
|
||||
Platform: UNKNOWN
|
||||
|
||||
+16
-19
@@ -13,7 +13,6 @@ from volatile memory samples and provide a platform for further work into
|
||||
this exciting area of research.
|
||||
|
||||
The Volatility distribution is available from:
|
||||
https://www.volatilesystems.com/default/volatility or
|
||||
http://code.google.com/p/volatility/downloads/list
|
||||
|
||||
Volatility should run on any platform that supports
|
||||
@@ -52,7 +51,7 @@ capabilities. For acquisition, there are both free and commercial
|
||||
solutions available. If you would like suggestions about suitable
|
||||
acquisition solutions, please contact us at:
|
||||
|
||||
volatility (at) volatilesystems (dot) com
|
||||
volatility (at) volatilityfoundation (dot) org
|
||||
|
||||
Volatility supports a variety of sample file formats and the
|
||||
ability to convert between these formats:
|
||||
@@ -101,12 +100,12 @@ Contact
|
||||
=======
|
||||
For information or requests, contact:
|
||||
|
||||
Volatile Systems
|
||||
Volatility Foundation
|
||||
|
||||
Web: http://www.volatilesystems.com/
|
||||
Web: http://www.volatilityfoundation.org/
|
||||
http://volatility.tumblr.com/
|
||||
|
||||
Email: volatility (at) volatilesystems (dot) com
|
||||
Email: volatility (at) volatilityfoundation (dot) org
|
||||
|
||||
IRC: #volatility on freenode
|
||||
|
||||
@@ -122,7 +121,6 @@ Some plugins may have other requirements which can be found at:
|
||||
Quick Start
|
||||
===========
|
||||
1. Unpack the latest version of Volatility from
|
||||
https://www.volatilesystems.com/default/volatility or
|
||||
http://code.google.com/p/volatility/downloads/list
|
||||
|
||||
2. To see available options, run "python vol.py -h"
|
||||
@@ -130,7 +128,7 @@ Quick Start
|
||||
Example:
|
||||
|
||||
$ python vol.py -h
|
||||
Volatile Systems Volatility Framework 2.3
|
||||
Volatility Foundation Volatility Framework 2.3
|
||||
Usage: Volatility - A memory forensics analysis platform.
|
||||
|
||||
Options:
|
||||
@@ -165,7 +163,7 @@ Options:
|
||||
-k KPCR, --kpcr=KPCR Specify a specific KPCR address
|
||||
|
||||
$ python vol.py --info
|
||||
Volatile Systems Volatility Framework 2.3
|
||||
Volatility Foundation Volatility Framework 2.3
|
||||
|
||||
Profiles
|
||||
--------
|
||||
@@ -402,7 +400,7 @@ PoolTagCheck - This scanner checks for the occurance of a pool tag
|
||||
Example:
|
||||
|
||||
> python vol.py imageinfo -f WIN-II7VOJTUNGL-20120324-193051.raw
|
||||
Volatile Systems Volatility Framework 2.3
|
||||
Volatility Foundation Volatility Framework 2.3
|
||||
Determining profile based on KDBG search...
|
||||
|
||||
Suggested Profile(s) : Win2008R2SP0x64, Win7SP1x64, Win7SP0x64, Win2008R2SP1x64 (Instantiated with Win7SP0x64)
|
||||
@@ -432,24 +430,23 @@ PoolTagCheck - This scanner checks for the occurance of a pool tag
|
||||
Licensing and Copyright
|
||||
=======================
|
||||
|
||||
Copyright (C) 2007-2011 Volatile Systems
|
||||
Copyright (C) 2007-2013 Volatility Foundation
|
||||
|
||||
All Rights Reserved
|
||||
|
||||
This program is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU General Public License
|
||||
as published by the Free Software Foundation; either version 2
|
||||
of the License, or (at your option) any later version.
|
||||
Volatility is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License Version 2 as
|
||||
published by the Free Software Foundation. You may not use, modify or
|
||||
distribute this program under any other version of the GNU General
|
||||
Public License.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
Volatility is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
02111-1307, USA.
|
||||
along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
Bugs and Support
|
||||
================
|
||||
@@ -484,7 +481,7 @@ Other options for communicaton can be found at:
|
||||
|
||||
Missing or Truncated Information
|
||||
================================
|
||||
Volatile Systems makes no claims about the validity or correctness of the
|
||||
Volatility Foundation makes no claims about the validity or correctness of the
|
||||
output of Volatility. Many factors may contribute to the
|
||||
incorrectness of output from Volatility including, but not
|
||||
limited to, malicious modifications to the operating system,
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.conf as conf
|
||||
|
||||
+12
-10
@@ -1,19 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (c) 2012 Michael Ligh (michael.ligh@mnin.org)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.taskmods as taskmods
|
||||
|
||||
+12
-10
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.timefmt as timefmt
|
||||
|
||||
@@ -8,19 +8,22 @@
|
||||
#
|
||||
# This plugin is based on zeusscan2.py by Michael Hale Ligh.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.taskmods as taskmods
|
||||
import volatility.obj as obj
|
||||
@@ -391,4 +394,4 @@ class PoisonIvyConfig(PoisonIvyScan):
|
||||
for i, proxy in enumerate(config.get_proxies()):
|
||||
outfd.write('\tHost {0}: {1}:{2} ({3})\n'.format(i, proxy.hostname, proxy.port, proxy.proto))
|
||||
|
||||
outfd.write("\nDecrypt: {0:#x}\n".format(config.func_Decrypt))
|
||||
outfd.write("\nDecrypt: {0:#x}\n".format(config.func_Decrypt))
|
||||
|
||||
@@ -6,19 +6,21 @@
|
||||
# Citadel support:
|
||||
# Santiago Vicente <smvicente@invisson.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import struct, hashlib
|
||||
@@ -592,4 +594,4 @@ class CitadelScan1345(ZeusScan2):
|
||||
params['login_key'])
|
||||
|
||||
outfd.write("{0:<30} : {1}\n".format("Login key", params['login_key'].upper()))
|
||||
outfd.write("{0:<30} : {1}\n".format("AES key", str(aes_key).encode('hex').upper()))
|
||||
outfd.write("{0:<30} : {1}\n".format("AES key", str(aes_key).encode('hex').upper()))
|
||||
|
||||
@@ -1,18 +1,21 @@
|
||||
# Volatility
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.commands as commands
|
||||
import volatility.utils as utils
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
|
||||
+12
-10
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import sys
|
||||
|
||||
+12
-10
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import re
|
||||
|
||||
@@ -3,22 +3,24 @@
|
||||
# Volatility
|
||||
#
|
||||
# Authors:
|
||||
# AAron Walters <awalters@volatilesystems.com>
|
||||
# AAron Walters <awalters@4tphi.net>
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
try:
|
||||
@@ -52,8 +54,8 @@ opts['name'] = "volatility"
|
||||
opts['version'] = volatility.constants.VERSION
|
||||
opts['description'] = "Volatility -- Volatile memory framwork"
|
||||
opts['author'] = "AAron Walters"
|
||||
opts['author_email'] = "awalters@volatilesystems.com"
|
||||
opts['url'] = "http://www.volatilesystems.com"
|
||||
opts['author_email'] = "awalters@4tphi.net"
|
||||
opts['url'] = "http://www.volatilityfoundation.org"
|
||||
opts['license'] = "GPL"
|
||||
opts['scripts'] = ["vol.py"]
|
||||
opts['packages'] = ["volatility",
|
||||
|
||||
+13
-11
@@ -6,24 +6,26 @@
|
||||
# Brendan Dolan-Gavitt
|
||||
# Mike Auty
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Brendan Dolan-Gavitt
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: brendandg@gatech.edu
|
||||
@organization: Georgia Institute of Technology
|
||||
"""
|
||||
|
||||
@@ -2,32 +2,30 @@
|
||||
# -*- mode: python; -*-
|
||||
#
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Original Source:
|
||||
# Volatools Basic
|
||||
# Copyright (C) 2007 Komoku, Inc.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: AAron Walters
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@contact: awalters@volatilesystems.com
|
||||
@organization: Volatile Systems
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: awalters@4tphi.net
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
#pylint: disable-msg=C0111
|
||||
@@ -130,7 +128,7 @@ def main():
|
||||
|
||||
# Get the version information on every output from the beginning
|
||||
# Exceptionally useful for debugging/telling people what's going on
|
||||
sys.stderr.write("Volatile Systems Volatility Framework {0}\n".format(constants.VERSION))
|
||||
sys.stderr.write("Volatility Foundation Volatility Framework {0}\n".format(constants.VERSION))
|
||||
sys.stderr.flush()
|
||||
|
||||
# Setup the debugging format
|
||||
|
||||
+16
-14
@@ -1,30 +1,32 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Original Source:
|
||||
# Copyright (C) 2004,2005,2006 4tphi Research
|
||||
# Author: {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: AAron Walters
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@contact: awalters@volatilesystems.com
|
||||
@organization: Volatile Systems
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: awalters@4tphi.com
|
||||
@organization: Volatility Foundation
|
||||
|
||||
Alias for all address spaces
|
||||
|
||||
|
||||
@@ -1,3 +1,19 @@
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
""" This module implements the volatility caching subsystem.
|
||||
|
||||
The volatility caching subsystem has the following design goals:
|
||||
|
||||
+13
-11
@@ -1,19 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2008 Volatile Systems
|
||||
# Copyright (C) 2008-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import sys, textwrap
|
||||
|
||||
+1
-2
@@ -1,4 +1,3 @@
|
||||
#!/usr/bin/env python
|
||||
## This file was taken from PyFlag http://www.pyflag.net/
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
# David Collett <daveco@users.sourceforge.net>
|
||||
@@ -19,7 +18,7 @@
|
||||
# *
|
||||
# * You should have received a copy of the GNU General Public License
|
||||
# * along with this program; if not, write to the Free Software
|
||||
# * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
# * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
# ******************************************************
|
||||
|
||||
#pylint: disable-msg=C0111
|
||||
|
||||
+13
-11
@@ -1,19 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2008 Volatile Systems
|
||||
# Copyright (C) 2008-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
# Blocksize was chosen to make it aligned
|
||||
|
||||
+12
-10
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
""" General debugging framework """
|
||||
|
||||
+12
-10
@@ -2,19 +2,21 @@
|
||||
# Copyright (C) 2010 Brendan Dolan-Gavitt
|
||||
# Copyright (c) 2011 Michael Cohen <scudette@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import re
|
||||
|
||||
+12
-10
@@ -1,18 +1,20 @@
|
||||
# Volatility
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
class VolatilityException(Exception):
|
||||
|
||||
+12
-10
@@ -1,18 +1,20 @@
|
||||
# Volatility
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import re
|
||||
|
||||
+16
-14
@@ -1,29 +1,31 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Copyright (C) 2005,2006 4tphi Research
|
||||
# Author: {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: AAron Walters
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@contact: awalters@volatilesystems.com
|
||||
@organization: Volatile Systems
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: awalters@4tphi.net
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
#pylint: disable-msg=C0111,W0613
|
||||
|
||||
@@ -4,19 +4,21 @@
|
||||
# Authors:
|
||||
# Mike Auty
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.addrspaces.paged as paged
|
||||
@@ -59,7 +61,7 @@ class AMD64PagedMemory(paged.AbstractWritablePagedMemory):
|
||||
"""
|
||||
order = 60
|
||||
cache = False
|
||||
pae = True
|
||||
pae = False
|
||||
checkname = 'AMD64ValidAS'
|
||||
paging_address_space = True
|
||||
minimum_size = 0x1000
|
||||
|
||||
@@ -4,19 +4,21 @@
|
||||
# attc - atcuno@gmail.com
|
||||
# Joe Sylve - joe.sylve@gmail.com
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import struct
|
||||
|
||||
@@ -1,23 +1,25 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2005,2006,2007 4tphi Research
|
||||
#
|
||||
# Authors:
|
||||
# {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
""" An AS for processing crash dumps """
|
||||
|
||||
@@ -1,22 +1,23 @@
|
||||
# Volatility
|
||||
#
|
||||
# Copyright (c) 2008 Volatile Systems
|
||||
# Copyright (c) 2008-2013 Volatility Foundation
|
||||
# Copyright (c) 2008 Brendan Dolan-Gavitt <bdolangavitt@wesleyan.edu>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# Code found in WindowsHiberFileSpace32 for parsing meta information
|
||||
# is inspired by the work of Matthieu Suiche: http://sandman.msuiche.net/.
|
||||
|
||||
@@ -1,18 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import zlib
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import time
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2013 Volatility Foundation
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2004,2005,2006 4tphi Research
|
||||
#
|
||||
# Authors:
|
||||
@@ -8,19 +7,21 @@
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import struct
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Authors:
|
||||
# attc - atcuno@gmail.com
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
import volatility.addrspace as addrspace
|
||||
import volatility.debug as debug
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import struct
|
||||
|
||||
@@ -1,19 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (c) 2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
#import fractions
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2004,2005,2006 4tphi Research
|
||||
#
|
||||
# Authors:
|
||||
@@ -7,19 +7,21 @@
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
""" These are standard address spaces supported by Volatility """
|
||||
|
||||
@@ -1,24 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2005,2006,2007 4tphi Research
|
||||
#
|
||||
# Authors:
|
||||
# {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
|
||||
# phil@teuwen.org (Philippe Teuwen)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# References:
|
||||
# VirtualBox core format:
|
||||
|
||||
@@ -1,23 +1,26 @@
|
||||
# VMware snapshot file parser
|
||||
# Copyright (C) 2012 Nir Izraeli (nirizr at gmail dot com)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Nir Izraeli
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: nirizr@gmail.com
|
||||
|
||||
This Address Space for Volatility is based on Nir's vmsnparser:
|
||||
|
||||
@@ -4,19 +4,21 @@
|
||||
# Adam Boileau <metlstorm@storm.net.nz>
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# *Heavily* based upon http://www.storm.net.nz/static/files/bioskbsnarf
|
||||
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Michael Cohen <scudette@users.sourceforge.net>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
""" This plugin contains CORE classes used by lots of other plugins """
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
#pylint: disable-msg=C0111
|
||||
|
||||
@@ -1,29 +1,31 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2008 Volatile Systems
|
||||
# Copyright (C) 2008-2013 Volatility Foundation
|
||||
# Copyright (c) 2008 Brendan Dolan-Gavitt <bdolangavitt@wesleyan.edu>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
This module implements the fast connection scanning
|
||||
|
||||
@author: AAron Walters and Brendan Dolan-Gavitt
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@contact: awalters@volatilesystems.com,bdolangavitt@wesleyan.edu
|
||||
@organization: Volatile Systems
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: awalters@4tphi.net,bdolangavitt@wesleyan.edu
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
#pylint: disable-msg=C0111
|
||||
@@ -55,7 +57,7 @@ class ConnScan(common.AbstractWindowsCommand):
|
||||
author = 'Brendan Dolan-Gavitt',
|
||||
copyright = 'Copyright (c) 2007,2008 Brendan Dolan-Gavitt',
|
||||
contact = 'bdolangavitt@wesleyan.edu',
|
||||
license = 'GNU General Public License 2.0 or later',
|
||||
license = 'GNU General Public License 2.0',
|
||||
url = 'http://moyix.blogspot.com/',
|
||||
os = 'WIN_32_XP_SP2',
|
||||
version = '1.0',
|
||||
|
||||
@@ -1,19 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2009-2012 Volatile Systems
|
||||
# Copyright (C) 2009-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.utils as utils
|
||||
|
||||
@@ -1,23 +1,25 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (c) 2008 Brendan Dolan-Gavitt <bdolangavitt@wesleyan.edu>
|
||||
#
|
||||
# Additional Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import os
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Authors:
|
||||
# Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
@@ -6,19 +7,21 @@
|
||||
# Contributors/References:
|
||||
# ## Based on sslkeyfinder: http://www.trapkit.de/research/sslkeyfinder/
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import os, sys, subprocess
|
||||
|
||||
Executable
+1121
File diff suppressed because it is too large
Load Diff
@@ -1,19 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (c) 2012 Michael Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.taskmods as taskmods
|
||||
|
||||
@@ -1,27 +1,29 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2008-2011 Volatile Systems
|
||||
# Copyright (C) 2008-2013 Volatility Foundation
|
||||
# Copyright (C) 2011 Jamie Levy (Gleeda) <jamie.levy@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Jamie Levy (gleeda)
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: jamie.levy@gmail.com
|
||||
@organization: Volatile Systems
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
import volatility.plugins.getsids as getsids
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.conf as conf
|
||||
|
||||
@@ -1,27 +1,27 @@
|
||||
#!/usr/bin/env python
|
||||
# fileobjscan.py
|
||||
# Copyright 2009 Andreas Schuster <a.schuster@yendor.net>
|
||||
# Copyright (C) 2009-2013 Volatility Foundation
|
||||
#
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# fileobjscan.py
|
||||
# Copyright 2009 Andreas Schuster <a.schuster@yendor.net>
|
||||
# Copyright (C) 2009-2011 Volatile Systems
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
||||
# MA 02110-1301, USA.
|
||||
|
||||
"""
|
||||
@author: Andreas Schuster
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: a.schuster@forensikblog.de
|
||||
@organization: http://computer.forensikblog.de/en/
|
||||
"""
|
||||
@@ -48,7 +48,7 @@ class FileScan(common.AbstractWindowsCommand):
|
||||
meta_info['author'] = 'Andreas Schuster'
|
||||
meta_info['copyright'] = 'Copyright (c) 2009 Andreas Schuster'
|
||||
meta_info['contact'] = 'a.schuster@forensikblog.de'
|
||||
meta_info['license'] = 'GNU General Public License 2.0 or later'
|
||||
meta_info['license'] = 'GNU General Public License 2.0'
|
||||
meta_info['url'] = 'http://computer.forensikblog.de/en/'
|
||||
meta_info['os'] = 'WIN_32_XP_SP2'
|
||||
meta_info['version'] = '0.1'
|
||||
@@ -409,10 +409,10 @@ class PSScan(common.AbstractWindowsCommand):
|
||||
# Declare meta information associated with this plugin
|
||||
meta_info = {}
|
||||
meta_info['author'] = 'AAron Walters'
|
||||
meta_info['copyright'] = 'Copyright (c) 2011 Volatile Systems'
|
||||
meta_info['contact'] = 'awalters@volatilesystems.com'
|
||||
meta_info['license'] = 'GNU General Public License 2.0 or later'
|
||||
meta_info['url'] = 'https://www.volatilesystems.com/'
|
||||
meta_info['copyright'] = 'Copyright (c) 2011 Volatility Foundation'
|
||||
meta_info['contact'] = 'awalters@4tphi.net'
|
||||
meta_info['license'] = 'GNU General Public License 2.0'
|
||||
meta_info['url'] = 'https://www.volatilityfoundation.org/'
|
||||
meta_info['os'] = ['Win7SP0x86', 'WinXPSP3x86']
|
||||
meta_info['version'] = '0.1'
|
||||
|
||||
|
||||
@@ -1,27 +1,29 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2011 Volatile Systems
|
||||
# Copyright (C) 2011-2013 Volatility Foundation
|
||||
# Copyright (C) 2011 Jamie Levy (Gleeda) <jamie.levy@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Jamie Levy (Gleeda)
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: jamie.levy@gmail.com
|
||||
@organization: Volatile Systems
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
import volatility.win32.rawreg as rawreg
|
||||
|
||||
@@ -1,31 +1,34 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2008 Volatile Systems
|
||||
# Copyright (C) 2008-2013 Volatility Foundation
|
||||
#
|
||||
# Additional Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
#
|
||||
# Based heavily upon the getsids plugin by Moyix
|
||||
# http://kurtz.cs.wesleyan.edu/%7Ebdolangavitt/memory/getsids.py
|
||||
|
||||
"""
|
||||
@author: AAron Walters and Brendan Dolan-Gavitt
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@contact: awalters@volatilesystems.com,bdolangavitt@wesleyan.edu
|
||||
@organization: Volatile Systems
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: awalters@4tphi.net,bdolangavitt@wesleyan.edu
|
||||
@organization: Volatility Foundation
|
||||
"""
|
||||
|
||||
|
||||
@@ -138,7 +141,7 @@ class GetSIDs(taskmods.DllList):
|
||||
meta_info['author'] = 'Brendan Dolan-Gavitt'
|
||||
meta_info['copyright'] = 'Copyright (c) 2007,2008 Brendan Dolan-Gavitt'
|
||||
meta_info['contact'] = 'bdolangavitt@wesleyan.edu'
|
||||
meta_info['license'] = 'GNU General Public License 2.0 or later'
|
||||
meta_info['license'] = 'GNU General Public License 2.0'
|
||||
meta_info['url'] = 'http://moyix.blogspot.com/'
|
||||
meta_info['os'] = 'WIN_32_XP_SP2'
|
||||
meta_info['version'] = '1.0'
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,21 +1,23 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
# Copyright (C) 2009 Brendan Dolan-Gavitt
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import copy
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.gui.windowstations as windowstations
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.gui.sessions as sessions
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.utils as utils
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.common as common
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,21 +1,23 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
# Copyright (C) 2009 Brendan Dolan-Gavitt
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import os
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.gui.sessions as sessions
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.gui.messagehooks as messagehooks
|
||||
|
||||
@@ -1,20 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007,2008 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (C) 2010,2011,2012 Michael Hale Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,22 +1,24 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2011 Volatile Systems
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# Additional Authors:
|
||||
# Michael Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.taskmods as taskmods
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.utils as utils
|
||||
|
||||
@@ -1,18 +1,21 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.plugins.crashinfo as crashinfo
|
||||
@@ -48,4 +51,4 @@ class HPAKExtract(HPAKInfo):
|
||||
|
||||
data.convert_to_raw(outfd)
|
||||
|
||||
print "Done."
|
||||
print "Done."
|
||||
|
||||
@@ -1,19 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
# Copyright (c) 2010, 2011, 2012 Michael Ligh <michael.ligh@mnin.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
## http://www.docslide.com/forensic-analysis-of-internet-explorer-activity-files/
|
||||
## http://libmsiecf.googlecode.com/files/MSIE%20Cache%20File%20%28index.dat%29%20format.pdf
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import os
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.win32.tasks as tasks
|
||||
|
||||
@@ -3,19 +3,21 @@
|
||||
# Authors:
|
||||
# Mike Auty <mike.auty@gmail.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,24 +1,25 @@
|
||||
# Volatility
|
||||
#
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Bradley Schatz
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: bradley@schatzforensic.com.au
|
||||
@organization: Schatz Forensic
|
||||
"""
|
||||
@@ -39,7 +40,7 @@ class KPCRScan(common.AbstractWindowsCommand):
|
||||
author = 'Bradley Schatz',
|
||||
copyright = 'Copyright (c) 2010 Bradley Schatz',
|
||||
contact = 'bradley@schatzforensic.com.au',
|
||||
license = 'GNU General Public License 2.0 or later',
|
||||
license = 'GNU General Public License 2.0',
|
||||
url = 'http://www.schatzforensic.com.au/',
|
||||
os = 'WIN_32_VISTA_SP0',
|
||||
version = '1.0',
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import socket
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,25 @@
|
||||
# Volatility
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Joe Sylve
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: joe.sylve@gmail.com
|
||||
@organization: 504ENSICS Labs
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,22 +1,25 @@
|
||||
# Volatility
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Joe Sylve
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: joe.sylve@gmail.com
|
||||
@organization: 504ENSICS Labs
|
||||
"""
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import volatility.commands as commands
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import volatility.plugins.linux.common as linux_common
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import os.path
|
||||
|
||||
@@ -1,22 +1,26 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization:
|
||||
"""
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
# flags used throughout the plugins
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import volatility.plugins.linux.common as linux_common
|
||||
|
||||
@@ -1,24 +1,28 @@
|
||||
# Volatility
|
||||
# Copyright (C) 2007-2013 Volatility Foundation
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or (at
|
||||
# your option) any later version.
|
||||
# This file is part of Volatility.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# General Public License for more details.
|
||||
# Volatility is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License Version 2 as
|
||||
# published by the Free Software Foundation. You may not use, modify or
|
||||
# distribute this program under any other version of the GNU General
|
||||
# Public License.
|
||||
#
|
||||
# Volatility is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
"""
|
||||
@author: Andrew Case
|
||||
@license: GNU General Public License 2.0 or later
|
||||
@license: GNU General Public License 2.0
|
||||
@contact: atcuno@gmail.com
|
||||
@organization: Digital Forensics Solutions
|
||||
@organization:
|
||||
"""
|
||||
|
||||
import volatility.obj as obj
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user