d3d133fe7e
Change all the existing converted plugins over to the new mechanism.
2014-10-25 18:32:33 +01:00
d38525b04d
Convert procdump and dlldump to unified_output.
2014-10-01 10:27:39 +01:00
5bd44992bd
typo fix
2014-08-27 16:32:44 +10:00
24cd99bbdb
closes #42 patch from Matt McCormack to fix dumped PE file image base with --fix option
2014-07-18 12:24:40 -05:00
4a1fb10e61
update error message when pe dumping plugins fail
2014-06-19 19:27:56 -05:00
6c6f3844e4
condense ProcExeDump and ProcMemDump
...
dumping exe vs mem is now just a commandline arg to ProcDump. move main
methods to object classes of _IMAGE_DOS_HEADER - now its easier to
extract PE files from anywhere without inheriting from a plugin
2014-01-27 18:20:25 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
08eadf1dd5
remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page
2012-08-10 15:08:07 +00:00
f7b46ccef5
Fix a minor error in netscan, and pylint the rest of the recently changed code.
2012-07-12 20:00:04 +00:00
7a4021fea1
convert dlldump, procexedump, and moddump to table_header/row output. increases code sharing between the plugins. adds more descriptive error messages when pe files cannot be dumped. accomplishes goals 1, 2, and 3 from issue #291 . all parties agree commit is OK wrt 2.1 RC1
2012-07-10 18:27:08 +00:00
33cbf31032
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
2012-07-07 19:19:58 +00:00
a59ead5777
fix a bug in all plugins that inherit from ProcExeDump. in particular, they crash when extracting a PE whose size of headers (nt_header.OptionalHeader.SizeOfHeaders) encompasses one or more pages that are unavailable. use zread instead of read.
2012-04-10 17:09:08 +00:00
821130fb2e
Convert all *args to *args, **kwargs in __init__ functions.
2012-03-08 20:58:06 +00:00
fcbcea1476
create object classes for PE header structs, add sanity checks for MZ and PE signatures. Fixes Issue #155
2011-10-27 23:41:33 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
Mike Auty