 Andrew C
|
caa1906b9a
|
Mac - add stack and heap markers to mac_get_proc_maps
|
2014-06-09 09:32:43 -05:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
e8b9d6e7aa
|
move the mac_proc_maps methods for determing mapped file name into object class APIs
|
2013-04-09 21:49:14 +00:00 |
|
|
iMHLv2
|
b796169f98
|
fix mac_proc_maps to not create a local variable with the reserved 'object' name
|
2013-04-09 19:51:03 +00:00 |
|
|
iMHLv2
|
2415f5f47f
|
add an API to mac's proc object for enumerating process memory regions (proc.get_proc_maps())
|
2013-04-03 14:28:25 +00:00 |
|
|
iMHLv2
|
c6857209f1
|
prevent a 'NoneObject as string: Pointer v_name invalid' message when using the mac_proc_maps plugin
|
2013-04-01 01:26:05 +00:00 |
|
|
atcuno
|
a737a55bb4
|
Mac - have proc_maps inherfit from tasks instead of pslist
|
2013-03-31 22:04:03 +00:00 |
|
|
iMHLv2
|
44af125f77
|
prevent a backtrace when mac_proc_maps encounters a null map entry
|
2013-03-29 03:04:58 +00:00 |
|
|
iMHLv2
|
4996ae93f5
|
add columns to mac_proc_maps to show pid and process name, otherwise you can't tell when maps for one process ends and the other begins...they just all blend together
|
2013-03-29 02:32:28 +00:00 |
|
|
iMHLv2
|
a024bd336d
|
adjust the find_aslr_shift and mac_proc_maps plugins for proper widths of long/unsigned long values
|
2013-03-28 16:29:52 +00:00 |
|
|
iMHLv2
|
3caae1ea79
|
Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()
|
2013-02-19 23:54:47 +00:00 |
|
|
iMHLv2
|
9b98a7c69f
|
just add a fixme comment to mac_proc_maps
|
2013-01-31 03:51:39 +00:00 |
|
|
iMHLv2
|
387f3c6a3c
|
create an object class for vm_map_entry and move the permission calculating code to vm_map_entry.get_perms()
|
2013-01-31 03:47:20 +00:00 |
|
|
iMHLv2
|
325391c64d
|
mac_proc_maps plugin: yield map instead of start, end, name. render_text will derive start, end, name from map
|
2013-01-31 03:35:19 +00:00 |
|
|
iMHLv2
|
071bb3311b
|
remove blank lines at the end of plugins
|
2013-01-31 02:51:09 +00:00 |
|
|
iMHLv2
|
ea9d38e6fb
|
edit a majority of mac plugins to remove calls to common.get_string. replace the functionality by using overlays of the String type
|
2013-01-30 05:06:13 +00:00 |
|
|
iMHLv2
|
1dfece3131
|
use dereference_as() in mac_proc_maps. use xrange(count) instead of xrange(0, count)
|
2013-01-29 16:28:35 +00:00 |
|
|
iMHLv2
|
ae931cacfd
|
change some relative imports to absolute (i.e. import x -> import volatility.plugins.mac.x as x)
|
2013-01-29 03:34:10 +00:00 |
|
|
atcuno
|
103e4607d6
|
Mac - update proc_maps to yield proc struct
|
2013-01-22 06:00:50 +00:00 |
|
|
atcuno
|
d88a0e8afe
|
Mac - update proc_maps to use table format and to print full path of maps
|
2013-01-22 05:00:53 +00:00 |
|
|
atcuno
|
80199cd5c8
|
Mac - update proc_maps
|
2013-01-21 07:03:05 +00:00 |
|