41b8a6ebcf
mftparser: fix due to renamed function
2015-01-01 14:33:35 -05:00
628de64e37
mftparser: checking for DEBUGOUT in the config
...
Not everyone will want to use this, especially from volshell
2015-01-01 14:23:27 -05:00
bfc29de2b1
rewrite of mftparser to make it more usable in volshell and elsewhere
2015-01-01 01:38:55 -05:00
4fb3afc79c
small fix due to speedup in 6dde8592e7
2015-01-01 01:34:12 -05:00
2e2b9bebf5
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-29 17:09:39 -06:00
6882415656
Linux - protect against corruption in mount data structures
2014-12-29 17:09:21 -06:00
6d0f9c4132
Linux - update time handling for olderish kernels
2014-12-29 17:08:50 -06:00
57f706dd84
small change to mftparser, ref issue #153
2014-12-29 15:49:04 -05:00
0df3402801
removed unneeded import
2014-12-29 15:10:31 -05:00
425836e1bc
updated timeliner to use new xlsx renderer
2014-12-29 15:09:39 -05:00
a45fe45621
moddump: moving debug error to rendering function
2014-12-29 13:47:07 -05:00
cc07fb72a5
Mac - update ifconfig
2014-12-21 17:24:16 -06:00
8ee5e91ccd
Mac - update netstat
2014-12-21 17:00:15 -06:00
39feac06b4
small fix to mftparser
2014-12-17 16:58:35 -05:00
005d7a78d9
spelling correction
2014-12-15 15:24:44 -05:00
7bcad479e5
Linux - update hidden modules for Android differences
2014-12-14 18:17:30 -06:00
3995eab4a7
Mac - update
2014-12-14 12:33:31 -06:00
78c88fe5bb
Mac - add new threads plugin
2014-12-14 10:14:37 -06:00
aa3ddae44a
dlllist's size and load count columns were inadvertently changed to decimal rather than hex during conversion
2014-12-13 17:24:40 -06:00
89dd81b4e1
Mac - add support for listing kauth listeners and scopes
2014-12-05 23:21:44 -06:00
86369e4e0e
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-05 21:24:39 -06:00
48206f805d
Mac - make kext maps render as lsmod
2014-12-05 21:24:33 -06:00
401f6e8f8e
converted idt and gdt
...
Note: binary data is left out for now in VERBOSE mode
2014-12-05 11:33:38 -05:00
de891a889c
mftparser: fix for issue #142
2014-12-05 11:18:19 -05:00
c77f6854d3
converted svscan
2014-12-05 10:41:19 -05:00
54cf225ba6
Mac - move malfind to overlay
2014-12-04 17:41:40 -06:00
047ee58491
refs #147 fix apihooks unicode error in 2.4.1
2014-12-04 12:38:12 -06:00
55f5417179
Mac - add thread name
2014-12-03 17:40:25 -06:00
08c0a6aaeb
Mac - update yarascan to correct kernel start address
2014-12-03 17:27:54 -06:00
310b0c9e89
Mac - fix library dump
2014-12-03 16:51:51 -06:00
f6f1ea4670
Mac - add orphan threads
2014-12-03 16:51:38 -06:00
9b9f62b2d0
Mac - add listing raw sockets
2014-12-03 14:26:50 -06:00
0ad9254114
Malfind : added -A, -C & modified -W
...
Added:
~ '-C' for case insensitive YARA searches
~ '-A' for searching both process & kernel memory in one run of the
plugin
~ '_scan_kernel_memory()' & '_scan_process_memory()' to YaraScan class
due to the new '-A' switch
Modified:
~ '-W' now adds 'ascii' to YARA rule so both are searched when WIDE is
chosen
Single pull for
https://github.com/volatilityfoundation/volatility/pull/131 ; easier
this way.
2014-12-02 23:29:36 -05:00
f41880cc01
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
2014-12-02 22:05:18 -06:00
970b8049a4
Linux - fix mount_cache
2014-12-02 22:04:40 -06:00
87e013d508
Merge pull request #110 from KarlVogel/endian-fix
...
Fix endianness dependency in IpAddress
2014-12-02 21:48:20 -06:00
041823fb63
Linux - restrict IDT to Intel based captures
2014-12-02 21:47:43 -06:00
9bb1d535db
Linux - restrict info_regs to Intel samples
2014-12-02 21:41:06 -06:00
b1ee66da09
Linux - fix info_regs
2014-12-02 21:31:46 -06:00
9c161cfe7c
Mac add promisicuous in ifconfig output
2014-12-02 21:19:18 -06:00
696d535db6
Linux - find list_raw bug
2014-12-02 21:18:47 -06:00
bfd9b66f41
adding back render_text to linux_apihooks because
...
it takes a really long time to get anything back.
this is because after getting text back with render_text
the plugin seems to hang. ran for 30+ mins after output obtained
not sure why it just hangs there yet...
2014-12-02 19:05:39 -05:00
12f864f172
converted linux_apihooks
2014-12-02 17:29:46 -05:00
db7cc05c28
Mac - netstat update
2014-12-02 15:39:07 -06:00
419141310a
Mac - change render order in trap table
2014-12-02 14:31:07 -06:00
6b115f52f6
converted linux_check_creds
2014-12-02 14:26:15 -05:00
d418e4c83d
converted linux_inline_kernel
2014-12-02 14:09:27 -05:00
264b42d14d
converted linux_check_fop
2014-12-02 14:04:49 -05:00
6c79641cc8
converted linux_check_modules
2014-12-02 14:00:39 -05:00
652f6ebb45
converted linux_check_syscall_arm
...
Note: haven't tested after conversion due to lack of samples
2014-12-02 13:57:33 -05:00
gleeda