401f6e8f8e
converted idt and gdt
...
Note: binary data is left out for now in VERBOSE mode
2014-12-05 11:33:38 -05:00
c77f6854d3
converted svscan
2014-12-05 10:41:19 -05:00
0ad9254114
Malfind : added -A, -C & modified -W
...
Added:
~ '-C' for case insensitive YARA searches
~ '-A' for searching both process & kernel memory in one run of the
plugin
~ '_scan_kernel_memory()' & '_scan_process_memory()' to YaraScan class
due to the new '-A' switch
Modified:
~ '-W' now adds 'ascii' to YARA rule so both are searched when WIDE is
chosen
Single pull for
https://github.com/volatilityfoundation/volatility/pull/131 ; easier
this way.
2014-12-02 23:29:36 -05:00
abae4c9672
Merge branch 'unified-output'
...
NOTE: fast/immediate output of plugins is affected by this merge!
Very little should change for existing plugins, any plugins using the
table_header/table_row routines should continue to run as normal,
however plugins converted to the unified output will not give output
until they complete. There is currently a quicktext output renderer to
get immediate (but ugly) results.
This commit should ensure greater visibility and testing of the unified
output solution, and identify issues before our next release. Please
report any issues to github as soon as possible.
Conflicts:
volatility/plugins/mftparser.py
volatility/plugins/registry/shimcache.py
2014-11-25 20:04:03 +00:00
be20a9a4ec
converted impscan
2014-11-17 12:00:01 -05:00
7ac28799ad
converted callbacks and fixed warning on drivernames that are None
2014-11-17 11:08:24 -05:00
70374eedf1
distinguish unused (null) IDT entries from used entries that point to unknown modules (per Frank Boldewin)
2014-11-15 13:03:41 -06:00
99c57fe648
converted psxview and updated openpyxl support
2014-11-14 14:16:59 -05:00
0d381428ca
refs #114 fix an offset in the svcscan plugin for win8/2012 x64
2014-11-02 13:43:19 -06:00
3de4b23e34
update devicetree plugin's naming convention
2014-10-12 21:56:55 -05:00
ee7050df8d
fix the timers plugin on windows 6.1.x samples
2014-10-11 17:01:10 -05:00
013506e7d7
refs #86 remove the is_valid_address check in impscan for base address
2014-09-12 11:10:28 -05:00
d43fdcd9ff
refs #83 fix threads plugin when invalid offsets are supplied
2014-09-03 13:35:12 -05:00
3654860e8b
refs #64 deskthrd list was False on 8/2012
2014-08-11 14:02:04 -05:00
44883bb00f
svcscan: removing unused variable and making sure to avoid nulls in values
2014-07-25 20:06:39 -04:00
27787693ad
recover service start type (auto, manual, disabled, etc)
2014-07-11 13:45:48 -05:00
ea81b3976e
refs #46 move service dll enumeration code to a @staticmethod so it can be called by other libs
2014-07-11 08:49:48 -05:00
55f5568e77
committing svcscan --verbose speedup. fixes issues #46
2014-07-11 05:15:20 -04:00
d96cbdd0a2
update apihooks to detect JMP FAR instructions. contributed and tested on an SSDT root kit by Stewart McIntyre
2014-07-04 11:43:44 -05:00
739f951a05
fixing svcscan for 8.1 and 2012 r2
2014-06-30 19:16:15 -05:00
815157a817
add a --listhead option to timers in cases (esp win2003) where disasm fails to locate the list head
2014-06-27 20:46:08 -04:00
825691eb32
fixes timers plugin on 8.1 and 2012 R2
2014-06-27 20:32:21 -04:00
e916f99e57
fix the threads plugin to properly follow the --offset option
2014-06-27 19:44:32 -04:00
9f33f7b383
prevent a stack trace in timers plugin when KiTimerTableListHead is not found
2014-06-27 19:24:50 -04:00
eb2b7fe6f3
test bug check reason callback pointer validity
2014-06-27 19:14:36 -04:00
bf86239480
adding xlsx output to psxview
2014-06-25 15:06:53 -04:00
566521e151
closes #4 add default arg parameters to get_image and get_sections
2014-06-19 18:58:25 -05:00
8b4ed02f00
closes #12 fix backtrace on enumerating desktop threads with psxview in win8/2012
2014-06-19 18:33:32 -05:00
326dde2a1c
refs #2 fixing -R and -s args to linux_yarascan and mac_yarascan
2014-05-30 00:22:51 -05:00
7c392f1f86
moving call to get currentcontrolset (we don't need to get it every iteration of the loop)
2014-05-20 21:42:19 -04:00
0fc8ed6e30
apihooks: removing unneeded --memory option inherited from procdump
2014-05-08 12:01:48 -04:00
8471ad3c26
disable the #include output in impscan idc format
2014-04-10 18:59:13 -05:00
bdb732627a
refs #40 impscan uses MakeQword on 64-bits
2014-04-10 18:22:10 -05:00
e5793a1253
get image size from peheader if impscan is used on an unlinked or hidden module
2014-04-10 18:18:55 -05:00
6429bd1908
initial support of 64-bit trampoline API hooks
2014-03-30 22:10:15 +02:00
871a3cbedf
update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)
2014-03-30 11:11:37 +02:00
f85b5e0d48
update callbacks for win7 x64 (other x64 will need verifying)
2014-03-28 22:11:45 -05:00
76b926fc18
move the _EPROCESS methods from malware.py into windows.py. remove the MalwareObjectClasesXP profile modification
2014-03-24 18:06:21 -05:00
a0e21d2cd7
yarascan -R option allows printing data at a negative offset from the hit, to show more context
2014-03-24 17:05:25 -05:00
00ecea5631
Revert "ldrmodules skips dlls loaded as data, image, and resource files"
...
This reverts commit aea68e67b59ae842b17f2d6ff2a9b9c6643cf92f.
2014-03-20 11:33:22 -05:00
4a408769e6
ldrmodules skips dlls loaded as data, image, and resource files
2014-03-19 11:01:42 -05:00
67c8a4419d
yarascan allows --size option for controlling preview hex dump size
2014-03-17 23:28:01 -05:00
d351efa839
fix a bug in BaseYaraScanner -- apparently type() on <yara.Rules> causes a segfault
2014-01-27 18:58:36 -06:00
6c6f3844e4
condense ProcExeDump and ProcMemDump
...
dumping exe vs mem is now just a commandline arg to ProcDump. move main
methods to object classes of _IMAGE_DOS_HEADER - now its easier to
extract PE files from anywhere without inheriting from a plugin
2014-01-27 18:20:25 -06:00
f725c596e3
psxview apply rules patch
2014-01-18 22:27:11 -06:00
d1533dcb25
fix a few bugs in the callback plugin
2014-01-17 21:50:47 -06:00
f521e33f8b
support multiple yara rule files - until the next yara release does
...
https://github.com/iMHLv2/voldb/commit/63156075f62607efec44e894e9719d9bf
ab0c926
2014-01-17 20:56:33 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
43c21340b8
vad reorganization and fixing for win8/server2012
2013-10-31 22:41:35 -04:00
cdc90f21e2
revert commit 80097f4de73d5cd54b865acd442f0dd85625d987 - the change is not necessary for win8 support
2013-10-14 10:23:16 -04:00
gleeda