566521e151
closes #4 add default arg parameters to get_image and get_sections
2014-06-19 18:58:25 -05:00
5eb7cd79e0
verinfo plugin update
2014-03-07 13:50:31 -06:00
6c1cda1a88
fix a memory consumption problem with zeusscan2 plugin
2014-01-28 22:46:44 -06:00
6c6f3844e4
condense ProcExeDump and ProcMemDump
...
dumping exe vs mem is now just a commandline arg to ProcDump. move main
methods to object classes of _IMAGE_DOS_HEADER - now its easier to
extract PE files from anywhere without inheriting from a plugin
2014-01-27 18:20:25 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
f1271ad529
move the timeliner plugin from the contrib folder into core (so it will be in the compiled pyinstaller exe and because its used frequently by volatility users
2013-07-03 20:09:40 +00:00
f3f07f89d7
adding better descriptions for --hive/--user/--registry options in timeliner
2013-04-04 13:03:08 +00:00
cc6a5d9f45
remove unnecessary timeliner options passed down by inheriting from other plugins
2013-03-25 18:01:09 +00:00
07b8f6949b
modified render_xlsx to use optimized writer
2013-03-08 13:39:55 +00:00
6033c35bd1
added xlsx output renderer for timeliner using OpenPyxl
2013-03-08 00:27:28 +00:00
ec42d1a81f
initial commit of timeliner in contrib/plugins folder
2013-03-07 16:05:05 +00:00
30b50f0600
add the zeusscan1 plugin (for zeus > 1.2 and < 2.0), zeusscan2 plugin (for zeus >= 2.0 but before IceX) and citadel 1.3.4.5 plugin by Santiago Vicente
2013-01-04 01:48:04 +00:00
b181aee2c7
add a directory contrib/plugins/malware for malware-specific plugins, both proof-of-concept and in full working order. start with Andreas Schuster's poisonivyscan and poisonivyconfig plugins...recently ported to 2.3 framework by MHL
2013-01-03 23:40:03 +00:00
4c3e9d6747
Move contrib/plugins/addrspaces to contrib/plugins/aspaces.
...
We had to do this because addrspaces conflicts with
volatility/plugins/addrspaces when python tries to import modules.
2012-09-14 06:56:47 +00:00
9d091ffd31
Remove python EWF implementation because pyewf is still very buggy.
2012-09-14 06:50:21 +00:00
33cbf31032
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
2012-07-07 19:19:58 +00:00
02a8380f71
Remove while 1 loop from scanning code.
2012-04-06 22:30:26 +00:00
fc43608aa0
Add in simple pagecheck plugin. Fixes issue 237.
2012-04-03 07:19:31 +00:00
8229248606
Add in an address space which uses PyEWF.
...
Note: during testing of libewf-20120304, PyEWF still appears to have a few bugs.
2012-03-30 13:18:00 +00:00
b5fb20c948
Move the EWF address space into the contrib directory.
...
The ctypes library search was causing a half second delay on every
volatility invocation, whether the address space was actually used or
not. Putting it in contrib for those that need it, without impacting
those that don't.
2012-03-30 13:16:07 +00:00
821130fb2e
Convert all *args to *args, **kwargs in __init__ functions.
2012-03-08 20:58:06 +00:00
4ae458e160
Remove all unnecessary trailing slashes.
2012-02-26 23:26:52 +00:00
d649b5b9b0
Fix inconsistency in commands.command class capitalization.
2012-02-05 23:36:33 +00:00
7c571f8606
add object classes for _IMAGE_IMPORT_DESCRIPTOR, _IMAGE_EXPORT_DIRECTORY, and _LDR_DATA_TABLE_ENTRY. allows enumeration of PE (exe/dll/sys) imports and exports (by name or by ordinal). handles forwarded exports. required for finding ssdt on x64 and for various malware plugins (like apihooks). Fixes Issue #197
2012-01-31 13:03:48 +00:00
fcbcea1476
create object classes for PE header structs, add sanity checks for MZ and PE signatures. Fixes Issue #155
2011-10-27 23:41:33 +00:00
1220d59ba7
move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160
2011-10-26 20:10:43 +00:00
b12ae5b0ad
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
2011-10-01 16:19:51 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
iMHLv2