6c7d95bdac
Merge pull request #243 from bridgeythegeek/master
...
Add editbox plugin; strings optionally reports ImageFileName.
2016-01-18 16:49:18 -05:00
9752a6ad67
the strings plugin complains if you run it on a non raw memory image
2015-10-14 12:42:08 -05:00
8bc5c81ac0
Updated strings to support reporting ImageFileName
...
strings plugin now supports `--lookup-pid/-L`. This will report the
name of the process when appropriate, for example, not for Kernel or FREE
MEMORY.
2015-09-06 17:04:12 +01:00
e8b6ece9a5
fix a bug in strings translation
...
this bug would cause string translation to fail for strings on PAE and
x64 images found in physical offsets greater than 4GB. specifically, it
would report them to the in FREE memory rather than the correct process
or kernel module.
2015-01-04 15:50:31 -06:00
677abec0fe
making strings more robust when encountering string files with empty lines
2014-11-26 12:49:57 -05:00
3fc7672c4a
converted strings plugin over
...
Notes: it is much slower as expected, so recommend running on only a
small subset of interesting strings. Also left the render_text in for
for this reason.
2014-11-26 12:17:13 -05:00
297f2db8ea
staging the strings plugin for conversion to unified output
2014-11-25 22:01:37 -05:00
3f3969b333
oops, virtual addresses in strings output should still be in hex
2014-03-13 11:35:27 -05:00
241199ed7b
don't ignore strings in free/dealloc blocks. format physical offsets as decimal to match the input format
2014-03-13 10:26:10 -05:00
067c31db04
fix a bug in strings line stripping
2014-01-29 13:02:23 -06:00
8d124ed50b
refs #15 swap the order back to kernel first and then process
2014-01-28 15:42:39 -06:00
7edb7d9bf0
initial commit of revised strings plugin to work with linux and mac
2014-01-28 15:24:32 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
65690943aa
change Strings.parse_line() to staticmethod so it can be used in other plugins without inheritance
2013-08-20 20:22:12 +00:00
2fe72e3975
make Strings.get_reverse_map() a staticmethod so it can be accessed by other plugins without inheritance
2013-08-20 20:01:37 +00:00
f1c1900aba
the strings plugin consumes 1.2 GB RAM when parsing 180 MB of strings, because it reads them all at once and collects them into a list before processing. this patch reads one line at a time, processes it, then throws it away before fetching the next line
2013-05-15 18:21:16 +00:00
f606ffd282
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
2013-02-20 02:56:19 +00:00
482a144f66
automatically translate kernel addresses in the strings output to identify the owning kernel module. fixes issue #363
2013-01-17 02:12:52 +00:00
4162c00fab
Move to consistent output on the strings plugin (always hex).
2012-06-12 13:26:12 +00:00
821130fb2e
Convert all *args to *args, **kwargs in __init__ functions.
2012-03-08 20:58:06 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
gleeda