49566255c9
Add support for enumerating the 32bit modules in a wow64 process
2017-09-08 12:42:05 -05:00
0e28d8d1aa
Fix DLL LoadCount for Win8 and Win10. Add DLL LoadTime to dlllist output (will be blank for < Win7)
2017-03-29 06:41:51 -05:00
0358d51534
refs #672 ensure the memmap plugin's dumpfileoffset column is properly synced with the offsets of memdump's data.
...
as a side effect, memmap will be slightly slower than before, since we
must attempt to read the data.
2015-10-12 14:09:37 -05:00
3344ac2ad7
refs #183 memdump's debug message reports a process offset instead of file offset
2015-10-12 13:19:45 -05:00
769e85f2f7
fixing the -o/--offset for some win7sp1x64 samples with a recent patch that changed the offset for the ThreadListEntry member of _ETHREAD
...
just a temporary fix until we have dynamic profile support (i.e.
pdbs)…in the meantime at least we’ll be able to bounce back in all
cases rather than just unpatched systems
2015-07-07 14:04:00 -05:00
cc0f87efa7
adding back pretty printing.
...
unified output still intact for other renderings
2015-03-18 09:59:02 +00:00
e2b73802bc
adding back render_dot
2015-03-18 08:57:39 +00:00
9d46f4b11b
converting memmap to unified output
2015-01-13 16:12:06 -05:00
80a6e2f614
taskmods small fix. Thanks Beni U for reporting
2015-01-02 09:25:13 -05:00
aa3ddae44a
dlllist's size and load count columns were inadvertently changed to decimal rather than hex during conversion
2014-12-13 17:24:40 -06:00
d3d133fe7e
Change all the existing converted plugins over to the new mechanism.
2014-10-25 18:32:33 +01:00
2344bc8aad
Update pslist to use the new unified_output.
2014-09-27 23:21:54 +01:00
1680acd35c
Fix many little bugs, add leading 0s for address spaces, however the squeeze to fit still needs work.
2014-09-24 01:43:09 +01:00
ef57731163
Add in stock renderers and convert dlllist as a test.
2014-09-23 22:50:05 +01:00
c4a5e32c34
clarify the --physical-offset parameter to pslist
2014-06-14 18:52:43 -05:00
d0fff718c9
suggest --offset=OFFSET when --pid doesn't find a process
2014-06-14 18:52:43 -05:00
e83b8b7cdc
add command line windows plugin
2014-05-29 22:02:48 -05:00
99df524021
add a process name filter (--name=regex)
2014-03-28 17:50:37 -05:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
61c52cca9b
convert DllList.virtual_process_from_physical_offset() from a plugin class method into a @staticmethod so it can be used/called by external code
2013-07-03 15:23:08 +00:00
964c3b32c9
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
2013-02-06 00:02:16 +00:00
725fc79817
prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279
2013-01-05 20:11:56 +00:00
762f9963b4
add LoadCount column to dlllist so we can tell static (IAT) vs dynamic loaded dlls
2012-11-24 05:08:31 +00:00
cb488ba7fa
fix a minor caps mistake in pslist plugin description
2012-08-29 15:18:20 +00:00
7572475254
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
2012-06-24 19:34:44 +00:00
090a3a9b88
Fixes issue 266.
2012-06-03 14:55:44 +00:00
dae64ee3f0
add exit time, session id, and wow64 columns to pslist. we can now easily distinguish between 32bit processes on 64bit models. when there is more than one critical system process like csrss.exe, winlogon.exe that have different pids, we can now tell which belongs to sesison 0, session 1, etc. the exit time addition fixes issue #215
2012-05-22 14:22:25 +00:00
91cea8afa0
add the @property IsWow64 to _EPROCESS. change session_id() to @property SessionId
2012-05-22 14:10:41 +00:00
2717daa3c7
alert users to the ldrmodules plugin when they use dlllist on wow64 processes. fixes issue #251 .
2012-05-22 13:38:00 +00:00
c5843bae8d
Add in support for the table output in a couple of plugins.
2012-05-22 08:26:41 +00:00
2e8090cd56
Revert issue190 changes mistakenly applied to trunk.
2012-05-19 14:42:45 +00:00
5774ac5646
Add in support for the table output in a couple of plugins.
2012-05-19 14:39:04 +00:00
4f6681a14d
Apply basic windows restrictions to most windows plugins.
2012-05-18 09:53:27 +00:00
756cfe9997
few modifications to strings in dlllist's output. this may end up just being temporary if other changes to unicode strings are made to the core, but might as well keep them consistent with how other plugins are printing strings at the moment.
2012-04-10 16:32:51 +00:00
821130fb2e
Convert all *args to *args, **kwargs in __init__ functions.
2012-03-08 20:58:06 +00:00
4ae458e160
Remove all unnecessary trailing slashes.
2012-02-26 23:26:52 +00:00
5c6c0b7bda
move some of the per-profile guess work done in taskmods.py into object classes
2012-02-14 17:35:03 +00:00
d649b5b9b0
Fix inconsistency in commands.command class capitalization.
2012-02-05 23:36:33 +00:00
6ea1d71930
sanity check the bounce from physical to virtual eprocess. Fixes issue #154
2012-01-25 15:18:53 +00:00
662b412248
prevent memdump from crashing on unreadable (paged) memory
2012-01-20 23:40:43 +00:00
1220d59ba7
move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160
2011-10-26 20:10:43 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
Andrew Case