41b8a6ebcf
mftparser: fix due to renamed function
2015-01-01 14:33:35 -05:00
628de64e37
mftparser: checking for DEBUGOUT in the config
...
Not everyone will want to use this, especially from volshell
2015-01-01 14:23:27 -05:00
bfc29de2b1
rewrite of mftparser to make it more usable in volshell and elsewhere
2015-01-01 01:38:55 -05:00
4fb3afc79c
small fix due to speedup in 6dde8592e7
2015-01-01 01:34:12 -05:00
2e2b9bebf5
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-29 17:09:39 -06:00
6882415656
Linux - protect against corruption in mount data structures
2014-12-29 17:09:21 -06:00
6d0f9c4132
Linux - update time handling for olderish kernels
2014-12-29 17:08:50 -06:00
57f706dd84
small change to mftparser, ref issue #153
2014-12-29 15:49:04 -05:00
0df3402801
removed unneeded import
2014-12-29 15:10:31 -05:00
425836e1bc
updated timeliner to use new xlsx renderer
2014-12-29 15:09:39 -05:00
a45fe45621
moddump: moving debug error to rendering function
2014-12-29 13:47:07 -05:00
e30a845e1c
changed install string for openpyxl
2014-12-29 12:23:54 -05:00
21462b6d5a
removed blank line
2014-12-29 12:07:45 -05:00
c4a9a732c9
adding xlsx rendering
2014-12-29 12:06:33 -05:00
cc07fb72a5
Mac - update ifconfig
2014-12-21 17:24:16 -06:00
8ee5e91ccd
Mac - update netstat
2014-12-21 17:00:15 -06:00
39feac06b4
small fix to mftparser
2014-12-17 16:58:35 -05:00
272c6cbae0
Merge pull request #152 from jlcx/master
...
spelling correction
2014-12-15 16:07:58 -06:00
005d7a78d9
spelling correction
2014-12-15 15:24:44 -05:00
7bcad479e5
Linux - update hidden modules for Android differences
2014-12-14 18:17:30 -06:00
3995eab4a7
Mac - update
2014-12-14 12:33:31 -06:00
78c88fe5bb
Mac - add new threads plugin
2014-12-14 10:14:37 -06:00
aa3ddae44a
dlllist's size and load count columns were inadvertently changed to decimal rather than hex during conversion
2014-12-13 17:24:40 -06:00
2e06f180f6
if column types don't match, explain why in the exception
2014-12-13 17:23:21 -06:00
b69cb2a998
fix in text renderer for python 2.6
...
error:
self._elide(("{:<" + str(grid_max_widths[index]) + "}").format(column.name), grid_max_widths[index])]
ValueError: zero length field name in format
2014-12-10 16:51:53 -05:00
89dd81b4e1
Mac - add support for listing kauth listeners and scopes
2014-12-05 23:21:44 -06:00
86369e4e0e
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-05 21:24:39 -06:00
48206f805d
Mac - make kext maps render as lsmod
2014-12-05 21:24:33 -06:00
401f6e8f8e
converted idt and gdt
...
Note: binary data is left out for now in VERBOSE mode
2014-12-05 11:33:38 -05:00
de891a889c
mftparser: fix for issue #142
2014-12-05 11:18:19 -05:00
c77f6854d3
converted svscan
2014-12-05 10:41:19 -05:00
c43deb9c70
text renderer: s/\\n/\\r\\n/ to fix output for windows
...
see issue #148
2014-12-04 20:26:10 -05:00
54cf225ba6
Mac - move malfind to overlay
2014-12-04 17:41:40 -06:00
047ee58491
refs #147 fix apihooks unicode error in 2.4.1
2014-12-04 12:38:12 -06:00
55f5417179
Mac - add thread name
2014-12-03 17:40:25 -06:00
08c0a6aaeb
Mac - update yarascan to correct kernel start address
2014-12-03 17:27:54 -06:00
310b0c9e89
Mac - fix library dump
2014-12-03 16:51:51 -06:00
f6f1ea4670
Mac - add orphan threads
2014-12-03 16:51:38 -06:00
9b9f62b2d0
Mac - add listing raw sockets
2014-12-03 14:26:50 -06:00
78c9cad946
Make two fixes for issue #143 , thanks for the spot gleeda!
2014-12-03 19:54:31 +00:00
ab90ea2771
Update CREDITS.txt
2014-12-03 00:30:48 -06:00
59634236ec
Update CREDITS.txt
2014-12-02 22:46:02 -06:00
e7bcb913e7
Merge pull request #141 from hiddenillusion/master
...
Malfind (yarascan): added -A, -C & modified -W
2014-12-02 22:35:35 -06:00
0ad9254114
Malfind : added -A, -C & modified -W
...
Added:
~ '-C' for case insensitive YARA searches
~ '-A' for searching both process & kernel memory in one run of the
plugin
~ '_scan_kernel_memory()' & '_scan_process_memory()' to YaraScan class
due to the new '-A' switch
Modified:
~ '-W' now adds 'ascii' to YARA rule so both are searched when WIDE is
chosen
Single pull for
https://github.com/volatilityfoundation/volatility/pull/131 ; easier
this way.
2014-12-02 23:29:36 -05:00
f41880cc01
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-02 22:05:18 -06:00
970b8049a4
Linux - fix mount_cache
2014-12-02 22:04:40 -06:00
e627896688
Update CREDITS.txt
2014-12-02 21:49:35 -06:00
87e013d508
Merge pull request #110 from KarlVogel/endian-fix
...
Fix endianness dependency in IpAddress
2014-12-02 21:48:20 -06:00
041823fb63
Linux - restrict IDT to Intel based captures
2014-12-02 21:47:43 -06:00
9bb1d535db
Linux - restrict info_regs to Intel samples
2014-12-02 21:41:06 -06:00
gleeda