 gleeda
|
c77f6854d3
|
converted svscan
|
2014-12-05 10:41:19 -05:00 |
|
|
iMHLv2
|
0d381428ca
|
refs #114 fix an offset in the svcscan plugin for win8/2012 x64
|
2014-11-02 13:43:19 -06:00 |
|
|
gleeda
|
44883bb00f
|
svcscan: removing unused variable and making sure to avoid nulls in values
|
2014-07-25 20:06:39 -04:00 |
|
|
iMHLv2
|
27787693ad
|
recover service start type (auto, manual, disabled, etc)
|
2014-07-11 13:45:48 -05:00 |
|
|
iMHLv2
|
ea81b3976e
|
refs #46 move service dll enumeration code to a @staticmethod so it can be called by other libs
|
2014-07-11 08:49:48 -05:00 |
|
|
gleeda
|
55f5568e77
|
committing svcscan --verbose speedup. fixes issues #46
|
2014-07-11 05:15:20 -04:00 |
|
|
iMHLv2
|
739f951a05
|
fixing svcscan for 8.1 and 2012 r2
|
2014-06-30 19:16:15 -05:00 |
|
|
gleeda
|
7c392f1f86
|
moving call to get currentcontrolset (we don't need to get it every iteration of the loop)
|
2014-05-20 21:42:19 -04:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
a69215113a
|
fixing svcscan on both 32- and 64-bit win8/server2012
|
2013-10-08 18:31:17 -04:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
b23d6cf75a
|
bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images
|
2012-11-22 18:04:20 +00:00 |
|
|
iMHLv2
|
a9a6ff54a1
|
in --verbose mode, the svcscan plugin queries the registry for a service's ServiceDll path
|
2012-11-21 16:31:34 +00:00 |
|
|
iMHLv2
|
022972a33c
|
patch from gleeda to conform the search_process_memory API call in svcscan to the new format (which accepts a list of strings instead of a single string)
|
2012-11-01 23:06:13 +00:00 |
|
|
iMHLv2
|
a4be56b1c7
|
all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles
|
2012-08-26 17:14:46 +00:00 |
|
|
mike.auty@gmail.com
|
5cb4ab5dda
|
Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.
|
2012-05-14 23:06:56 +00:00 |
|
|
iMHLv2
|
fdb358b9d5
|
reduce the size of vtypes in svcscan.py by using base vtypes and overlays
|
2012-05-08 16:27:38 +00:00 |
|
|
mike.auty@gmail.com
|
f3c28c098a
|
Pylint some files.
|
2012-04-30 11:56:50 +00:00 |
|
|
iMHLv2
|
00dd38e075
|
bug in svcscan (valid -> is_valid)
|
2012-04-19 15:15:03 +00:00 |
|
|
iMHLv2
|
60404a00a2
|
some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.
|
2012-04-11 13:49:36 +00:00 |
|
|
iMHLv2
|
a25aa7be57
|
change a few get_xxx() in svcscan to @property
|
2012-04-11 13:40:45 +00:00 |
|
|
iMHLv2
|
af5130e419
|
move svcscan's service record tag into a VolatilityMagic so its always available in the profile
|
2012-04-11 01:37:18 +00:00 |
|
|
iMHLv2
|
a6a33981ea
|
add malfind, ldrmodules, yarascan, and svcscan plugins for x86 and x64 windows. Fixes Issue #234. Fixes Issue #235.
|
2012-03-30 15:42:02 +00:00 |
|