 iMHLv2
|
aa3ddae44a
|
dlllist's size and load count columns were inadvertently changed to decimal rather than hex during conversion
|
2014-12-13 17:24:40 -06:00 |
|
|
Mike Auty
|
d3d133fe7e
|
Change all the existing converted plugins over to the new mechanism.
|
2014-10-25 18:32:33 +01:00 |
|
|
Mike Auty
|
2344bc8aad
|
Update pslist to use the new unified_output.
|
2014-09-27 23:21:54 +01:00 |
|
|
Mike Auty
|
1680acd35c
|
Fix many little bugs, add leading 0s for address spaces, however the squeeze to fit still needs work.
|
2014-09-24 01:43:09 +01:00 |
|
|
Mike Auty
|
ef57731163
|
Add in stock renderers and convert dlllist as a test.
|
2014-09-23 22:50:05 +01:00 |
|
|
iMHLv2
|
c4a5e32c34
|
clarify the --physical-offset parameter to pslist
|
2014-06-14 18:52:43 -05:00 |
|
|
iMHLv2
|
d0fff718c9
|
suggest --offset=OFFSET when --pid doesn't find a process
|
2014-06-14 18:52:43 -05:00 |
|
|
iMHLv2
|
e83b8b7cdc
|
add command line windows plugin
|
2014-05-29 22:02:48 -05:00 |
|
|
iMHLv2
|
99df524021
|
add a process name filter (--name=regex)
|
2014-03-28 17:50:37 -05:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
61c52cca9b
|
convert DllList.virtual_process_from_physical_offset() from a plugin class method into a @staticmethod so it can be used/called by external code
|
2013-07-03 15:23:08 +00:00 |
|
|
gleeda
|
964c3b32c9
|
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
|
2013-02-06 00:02:16 +00:00 |
|
|
iMHLv2
|
725fc79817
|
prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279
|
2013-01-05 20:11:56 +00:00 |
|
|
iMHLv2
|
762f9963b4
|
add LoadCount column to dlllist so we can tell static (IAT) vs dynamic loaded dlls
|
2012-11-24 05:08:31 +00:00 |
|
|
iMHLv2
|
cb488ba7fa
|
fix a minor caps mistake in pslist plugin description
|
2012-08-29 15:18:20 +00:00 |
|
|
iMHLv2
|
7572475254
|
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
|
2012-06-24 19:34:44 +00:00 |
|
|
mike.auty@gmail.com
|
090a3a9b88
|
Fixes issue 266.
|
2012-06-03 14:55:44 +00:00 |
|
|
iMHLv2
|
dae64ee3f0
|
add exit time, session id, and wow64 columns to pslist. we can now easily distinguish between 32bit processes on 64bit models. when there is more than one critical system process like csrss.exe, winlogon.exe that have different pids, we can now tell which belongs to sesison 0, session 1, etc. the exit time addition fixes issue #215
|
2012-05-22 14:22:25 +00:00 |
|
|
iMHLv2
|
91cea8afa0
|
add the @property IsWow64 to _EPROCESS. change session_id() to @property SessionId
|
2012-05-22 14:10:41 +00:00 |
|
|
iMHLv2
|
2717daa3c7
|
alert users to the ldrmodules plugin when they use dlllist on wow64 processes. fixes issue #251.
|
2012-05-22 13:38:00 +00:00 |
|
|
mike.auty@gmail.com
|
c5843bae8d
|
Add in support for the table output in a couple of plugins.
|
2012-05-22 08:26:41 +00:00 |
|
|
mike.auty@gmail.com
|
2e8090cd56
|
Revert issue190 changes mistakenly applied to trunk.
|
2012-05-19 14:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
5774ac5646
|
Add in support for the table output in a couple of plugins.
|
2012-05-19 14:39:04 +00:00 |
|
|
mike.auty@gmail.com
|
4f6681a14d
|
Apply basic windows restrictions to most windows plugins.
|
2012-05-18 09:53:27 +00:00 |
|
|
iMHLv2
|
756cfe9997
|
few modifications to strings in dlllist's output. this may end up just being temporary if other changes to unicode strings are made to the core, but might as well keep them consistent with how other plugins are printing strings at the moment.
|
2012-04-10 16:32:51 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
mike.auty@gmail.com
|
4ae458e160
|
Remove all unnecessary trailing slashes.
|
2012-02-26 23:26:52 +00:00 |
|
|
iMHLv2
|
5c6c0b7bda
|
move some of the per-profile guess work done in taskmods.py into object classes
|
2012-02-14 17:35:03 +00:00 |
|
|
mike.auty@gmail.com
|
d649b5b9b0
|
Fix inconsistency in commands.command class capitalization.
|
2012-02-05 23:36:33 +00:00 |
|
|
iMHLv2
|
6ea1d71930
|
sanity check the bounce from physical to virtual eprocess. Fixes issue #154
|
2012-01-25 15:18:53 +00:00 |
|
|
iMHLv2
|
662b412248
|
prevent memdump from crashing on unreadable (paged) memory
|
2012-01-20 23:40:43 +00:00 |
|
|
iMHLv2
|
1220d59ba7
|
move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160
|
2011-10-26 20:10:43 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|