abae4c9672
Merge branch 'unified-output'
...
NOTE: fast/immediate output of plugins is affected by this merge!
Very little should change for existing plugins, any plugins using the
table_header/table_row routines should continue to run as normal,
however plugins converted to the unified output will not give output
until they complete. There is currently a quicktext output renderer to
get immediate (but ugly) results.
This commit should ensure greater visibility and testing of the unified
output solution, and identify issues before our next release. Please
report any issues to github as soon as possible.
Conflicts:
volatility/plugins/mftparser.py
volatility/plugins/registry/shimcache.py
2014-11-25 20:04:03 +00:00
6ba54ad10c
fix a recursion error processing windows
2014-11-12 14:22:45 -06:00
2d7abae461
catch invalid processes yielded by the MM_SESSION_SPACE.processes() API
2014-11-11 14:10:49 -06:00
d3d133fe7e
Change all the existing converted plugins over to the new mechanism.
2014-10-25 18:32:33 +01:00
2d7bf086e0
Fix up change of API for the gahti plugin.
2014-10-20 15:48:22 +01:00
210b9dc77f
Convert over atomscan and atoms to unified_output.
2014-10-03 11:31:29 +01:00
65f7012caa
Convert gahti to use unified_output.
2014-10-03 11:22:59 +01:00
d214186218
refs #73 avoid windows stations with no desktops. ignore desktops without names
2014-08-16 13:42:52 -05:00
4b1f428dd1
closes #28 session image lists aren't maintained in win8/2012
2014-07-18 14:38:30 -05:00
94574a598a
refs #35 update gui plugins for 64-bit windows 8, windows 8.1, server 2012, and server 2012 r2
2014-07-06 14:10:22 -05:00
6860c06c27
add a majority of types needed for gui subsystem plugins on windows 8/8.1
2014-06-20 23:48:19 -05:00
0e695be0b6
remove the profile restriction from event hooks
2014-06-20 23:47:13 -05:00
4468d32307
lift the profile restriction from clipboard and user handles
2014-06-20 22:46:11 -05:00
9a14a95719
update the win32k_core for finding gahti on win8
2014-06-20 22:26:13 -05:00
d5c3159076
remove the profile restriction on win8/2012 from atoms/gahti/wndscan plugins
2014-06-20 22:25:43 -05:00
54b9ba552e
fixing a bug in atoms
2014-06-20 20:04:36 -05:00
c45d108ed7
errant offset in tagCLIP data structure for windows 7
2014-06-20 18:36:25 -05:00
566521e151
closes #4 add default arg parameters to get_image and get_sections
2014-06-19 18:58:25 -05:00
329b474405
determine V or P offset based on self._config.VIRTUAL for scanners
2014-03-03 09:39:11 -06:00
aeefe2f0e1
fix a bug in win32k_core when enumerating desktop threads
2014-01-17 20:03:14 -06:00
a98432b9dd
patching a bug in atoms/atomscan on the mebromi.vmem sample
...
https://github.com/iMHLv2/voldb/commit/0f2555a7d22ffde4d0f700c716fbcbe6f
bbeba20
2014-01-17 20:00:13 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
b284deb5d7
fix some windows -> unix line breaks in syscall files, remove some debug.error on invalid profile from individual plugins since that's in the base now
2013-11-01 11:54:49 -04:00
1b8e54783f
update the scanning framework to support win 8 and server 2012. implement multiscanner interface. disable all GUI plugins for win 8 and server 2012 (they will be enabled individually at a later time)
2013-10-10 00:50:24 -04:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
3d5318a9c2
check the value of w32kbase before trying to read from it, fixes a bug in the sessions plugin found by wyatt
2013-10-04 04:50:43 +00:00
f606ffd282
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
2013-02-20 02:56:19 +00:00
8e952d8a6c
gditimers - get the process info from the object handle header if available, otherwise from the timer object itself. spotted by Bartosz Inglot
2013-02-19 15:59:16 +00:00
10cd0e4f58
add a new set of message hook offsets for win32k.sys 5.1.2600.6149
2012-11-12 19:53:39 +00:00
518294754d
Merge 2.3-devel into trunk.
2012-10-13 21:31:29 +00:00
be2b480c12
fix an ommission from r2604
2012-09-29 01:24:00 +00:00
33f08f6422
ensure all win32k.sys plugins inherit from AbstractWindowsCommand instead of Command, so they don't show up in command listings when linux profiles are in use
2012-09-24 03:35:29 +00:00
9dd3a3b256
add a new set of (_catomSysTableEntries, _aatomSysLoaded) offsets to messagehooks plugin
2012-09-08 22:50:42 +00:00
9c73b18aed
small refactor to the _MM_SESSION_SPACE.find_shared_info() method, which allows us to find tagSHAREDINFO in the following conditions: 1) win32k.sys PE header is memory resident 2) win32k.sys PE header is not memory resident 3) win32k.sys PE header is memory resident but zeroed out or corrupted.
2012-09-08 21:41:00 +00:00
3a85ac0226
get the gditimer owner information from the _HANDLEENTRY rather than the TYPE_TIMER object. the handle entry structure is more reliable since its consistent on all windows profiles of the same architecture, as opposed to the timer object which changes between xp, 2003, vista, and 7 etc
2012-09-07 14:47:11 +00:00
21e2d7b022
in rare cases, the PE header of win32k.sys and several pages after it are not memory resident. this prevents the moddump-ing of win32k.sys but more importantly it prevents plugins such as clipboard, userhandles, eventhooks, and gditimers from working properly. they rely on parsing the PE header to find the .data and/or .rdata section in win32k.sys to then scan for critical structures in those sections. this patch adds a fallback mechanism to allow the mentioned plugins to work even if the PE header of win32k.sys is paged or corrupted by malware. it basically scans 5MB from the base of win32k.sys to find the structures
2012-09-07 03:19:27 +00:00
7da0e55e66
add a pair of offsets to messagehooks plugin for win 2008 r2 sp1 x64
2012-09-07 01:51:57 +00:00
9932a2ef54
change the pool scanning check for window station objects - don't look in paged pools
2012-09-06 23:46:12 +00:00
99efb3f0f0
on small and medium memory systems the atoms and atomscan plugins work great, however on large memory systems (i.e. 80 GB) there were some false positives showing up. this patch adds a filter that only displays string atoms (i.e. atoms with ID 0xC000 to 0xFFFF). this helps reduce false positives in the big memory systems without negatively affecting the small/medium systems
2012-09-06 15:06:19 +00:00
b0212e88dd
prevent exceptions when finding shared info structures in sessions that have since terminated
2012-09-06 05:36:10 +00:00
bcc75b6e49
fix a typo in a win32k_core.py comment
2012-09-06 03:31:13 +00:00
2aae4e00f3
add the win32k suite. reviewed and tested by gleeda, aw, and ikelos
2012-09-05 02:09:58 +00:00
Mike Auty