d3d133fe7e
Change all the existing converted plugins over to the new mechanism.
2014-10-25 18:32:33 +01:00
9f36927630
Convert thrdscan plugin to unified_output.
2014-10-01 10:02:28 +01:00
e00cb218dc
Convert modscan plugin to unified_output.
2014-10-01 09:57:26 +01:00
329b474405
determine V or P offset based on self._config.VIRTUAL for scanners
2014-03-03 09:39:11 -06:00
d8d49d5101
making all physical offsets 64 bit ones to account for large x86 samples. it doesn't make sense to limit addresses when doing physical scans
2014-02-10 09:31:55 -05:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
1b8e54783f
update the scanning framework to support win 8 and server 2012. implement multiscanner interface. disable all GUI plugins for win 8 and server 2012 (they will be enabled individually at a later time)
2013-10-10 00:50:24 -04:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
964c3b32c9
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
2013-02-06 00:02:16 +00:00
e91ae38900
Convert over modscan and thrdscan to the table formatting.
2012-05-22 08:27:19 +00:00
462d103f0a
update modscan, filescan, and driverscan to suppress NoneObject as string warnings (see r1563).
2012-03-23 14:17:51 +00:00
e44c2d641e
Add in encoding support in strings.
...
Now String.v() returns a character array of length (as specified in
the constructor) or NoneObject if the object could not be read.
str(String) returns a string with encoding errors replaced by '?'
and unicode(String) returns a unicode string with encoding errors
replaced by '\ufffd'.
_UNICODE_STRING.v() returns a unicode string or NoneObject if the buffer
length is invalid. str(_UNICODE_STRING) and unicode(_UNICODE_STRING)
behave like str(String) and unicode(String) except that if there is a
problem with the buffer length or dereferencing the buffer a warning
will be issued. If the warning can safely be ignored use
str(_UNICODE_STRING or '') or unicode(_UNICODE_STRING or '').
2012-03-21 23:25:23 +00:00
4ae458e160
Remove all unnecessary trailing slashes.
2012-02-26 23:26:52 +00:00
8a8e423ef1
modify thrdscan to instantiate ETHREAD objects with native_vm
2012-02-11 20:37:42 +00:00
efbbf8b6fc
fix the modscan plugin after the preamble patch in r1324
2012-02-02 01:02:53 +00:00
f996b03b23
remove the object preambles (ObjectPreamble Magic and scan.PoolScanner.preamble). all scanners should be using the bottom-up technique of carving objects from pools
2012-02-01 00:55:21 +00:00
a2771c5e4c
Rename nativevm to native_vm to improve readability and fix muscle-memory typos.
2011-12-30 15:37:51 +00:00
70c19885bb
Add in repr wrappers around all the Unicode names pulled out of handles.
2011-12-29 13:36:06 +00:00
40ad0e59ae
Convert _vol_offsetlayer into obj_nativevm.
2011-12-29 13:35:59 +00:00
2fb6964c9a
Change module scanning plugins to eliminate parse_string.
2011-12-29 13:35:51 +00:00
b12ae5b0ad
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
2011-10-01 16:19:51 +00:00
e320cb8861
Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.
2011-09-15 14:03:56 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
Mike Auty