 atcuno
|
17cd70e20b
|
Linux - filter out bad task_structs in pid_hashtable
|
2013-03-29 18:49:57 +00:00 |
|
|
iMHLv2
|
dcc234530f
|
small whitespace in linux_tty_check
|
2013-03-28 16:42:00 +00:00 |
|
|
iMHLv2
|
94631b577d
|
linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED
|
2013-03-25 16:00:52 +00:00 |
|
|
iMHLv2
|
edeee594a6
|
include the task ID in the table column for linux_proc_maps. otherwise when you view maps for multiple processes, you can't tell which range belongs to which process
|
2013-03-07 16:04:53 +00:00 |
|
|
iMHLv2
|
f78329f8f2
|
fix linux_dump_maps plugin: inherit from proc_maps for -p option, replace --outfile with --dump-dir so we can write multiple VMAs to separate files, use table_header/table_row for a summary. spotted by Edwin Smulders
|
2013-03-07 15:58:19 +00:00 |
|
|
iMHLv2
|
bbad6877e8
|
remove some whitespace in linux_pstree
|
2013-03-07 15:37:31 +00:00 |
|
|
iMHLv2
|
e8569a92d6
|
add **kwargs for all linux plugins
|
2013-03-07 15:28:36 +00:00 |
|
|
iMHLv2
|
f106698abf
|
bring the IGNORE_UNIX option back to linux_netstat. it was deleted it r2808 but the variable self._config.IGNORE_UNIX is still referenced in code
|
2013-02-22 18:31:28 +00:00 |
|
|
iMHLv2
|
a69bc6f84b
|
add a description to the linux_volshell command
|
2013-02-22 15:33:48 +00:00 |
|
|
iMHLv2
|
be4231481f
|
fix pydoc for linux_tmpfs function
|
2013-02-22 14:46:42 +00:00 |
|
|
iMHLv2
|
e317dfe58f
|
remove unused inode.i_size variable
|
2013-02-22 14:19:03 +00:00 |
|
|
iMHLv2
|
2605f7bfcc
|
remove some unnecessary variable reassignments in linux_tmpfs
|
2013-02-22 14:16:19 +00:00 |
|
|
iMHLv2
|
e899be9888
|
fix linux_tmpfs for --tz time zone handling and UnixTimeStamp
|
2013-02-22 14:07:38 +00:00 |
|
|
iMHLv2
|
676597f7cb
|
remove the sym_type parameter to AbstractMacProfile.get_symbol() and AbstractLinuxProfile.get_symbol(). its no longer needed after the pointer masking patch in r3127
|
2013-02-20 03:07:23 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
0cc8f8e4df
|
move the linux_common.get_partial_path() function to a dentry object class method
|
2013-02-19 20:52:38 +00:00 |
|
|
iMHLv2
|
a6a72d898b
|
some whitespace in linux_tmpfs
|
2013-02-19 20:06:57 +00:00 |
|
|
iMHLv2
|
4f7e22430b
|
remove the linux_common.S_ISREG and linux_common.S_ISDIR functions. replace them with an inode object class that has is_dir() and is_reg() methods
|
2013-02-19 20:05:32 +00:00 |
|
|
iMHLv2
|
300739da35
|
remove the deprecated walk_list_head() function from linux common
|
2013-02-19 19:54:45 +00:00 |
|
|
iMHLv2
|
49d57f9ae0
|
move online_cpus, get_per_cpu_symbol, and walk_per_cpu_var from AbstractLinuxCommand into linux_cpuinfo
|
2013-02-19 18:04:31 +00:00 |
|
|
iMHLv2
|
8ed0c4bdbc
|
move the linux get_task_start_time() API out of AbstractLinuxCommand - put it in the task_struct object class
|
2013-02-19 17:58:44 +00:00 |
|
|
iMHLv2
|
885087f009
|
remove the unnecessary AbstractLinuxCommand.get_profile_symbol(). plugins now call directly to the API
|
2013-02-19 17:44:04 +00:00 |
|
|
iMHLv2
|
0af575492f
|
replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead
|
2013-02-19 17:42:25 +00:00 |
|
|
iMHLv2
|
f28cf51411
|
fix some whitespace in linux_find_file
|
2013-02-13 21:36:27 +00:00 |
|
|
iMHLv2
|
5978db698a
|
fix a bug in linux_tmpfs, introduced after 2.2 when we converted the 'name' variable to a simple character buffer into a volatility String object. spotted by Sebastien Bourdon-Richard
|
2013-02-13 01:56:41 +00:00 |
|
|
iMHLv2
|
1e8e2d4ecd
|
the metadata memory_model value can be directly assigned to table_name in linux_check_syscall
|
2013-02-12 20:50:39 +00:00 |
|
|
iMHLv2
|
6e6a9f7fdc
|
we dont need the mask value in linux_check_syscalls if we switch from long to unsigned long
|
2013-02-12 20:47:53 +00:00 |
|
|
iMHLv2
|
1f48e304e7
|
remove unnecessary import from proc_maps
|
2013-02-12 20:44:10 +00:00 |
|
|
iMHLv2
|
728a6a21d3
|
some whitespace in proc_maps
|
2013-02-12 20:43:10 +00:00 |
|
|
iMHLv2
|
1fa8f1800d
|
we don't need to create a new super_block object in linux_proc_maps, we can leverage the auto-dereference capability when just accessing the inode.i_sb attribute
|
2013-02-12 20:40:56 +00:00 |
|
|
iMHLv2
|
27f6029040
|
create a super_block object class with 'major' and 'minor' properties
|
2013-02-12 20:37:54 +00:00 |
|
|
iMHLv2
|
2e5ebc6120
|
create a Flags object for handling rwx, r-x style output for linux, instead of using the format_perms() method attached to a specific plugin
|
2013-02-12 20:27:29 +00:00 |
|
|
iMHLv2
|
ffd749a839
|
remove the mask_number() method from linux_proc_maps, its no longer needed
|
2013-02-12 19:35:38 +00:00 |
|
|
iMHLv2
|
ebf0a9903f
|
some whitespace in linux_check_syscall_arm
|
2013-02-05 20:08:55 +00:00 |
|
|
iMHLv2
|
7185d06827
|
some whitespace in linux_check_evt_arm
|
2013-02-05 20:08:00 +00:00 |
|
|
iMHLv2
|
7cbab87f06
|
move the plugin description for linux_check_evt_arm to proper place for pydoc
|
2013-02-05 20:05:06 +00:00 |
|
|
iMHLv2
|
3cd0e2c881
|
add the linux_moddump plugin
|
2013-02-05 20:02:31 +00:00 |
|
|
iMHLv2
|
8932135e0f
|
add the linux yarascan plugin
|
2013-02-05 15:53:57 +00:00 |
|
|
iMHLv2
|
ee0ac2406a
|
change the Pgoff column in linux_proc_maps to [addr] instead of decimal 6-char width
|
2013-02-05 04:51:13 +00:00 |
|
|
atcuno
|
dd44c49f8e
|
Linux - update proc_maps interface and add search_process_memory
|
2013-02-05 03:15:37 +00:00 |
|
|
iMHLv2
|
6a0a1c603b
|
add an initial mac_volshell plugin
|
2013-02-04 15:15:05 +00:00 |
|
|
iMHLv2
|
e65c61bf20
|
refactor linux_volshell to share more code with the existing windows volshell command
|
2013-02-04 14:32:04 +00:00 |
|
|
iMHLv2
|
8eb611679c
|
fix a bug in the new dtb printing column for linux_pslist
|
2013-02-04 04:19:22 +00:00 |
|
|
iMHLv2
|
608efd4e7a
|
add a linux_volshell command. as stated in the plugin, there is massive code duplicate, because the windows volshell is not written in an inheritance friendly manner. at the moment, we accept this risk in favor of functionality - being able to db/dd/dq/dis/dt/cc interactively on linux memory images
|
2013-02-04 00:42:14 +00:00 |
|
|
iMHLv2
|
14a5d6e05a
|
show the process DTB in linux_pslist, from task_struct.mm.pgd
|
2013-02-04 00:25:13 +00:00 |
|
|
atcuno
|
d57fc31fb1
|
Linux - add joes check evt arm patch
|
2013-01-29 01:05:51 +00:00 |
|
|
atcuno
|
b871fda79b
|
Linux - Add joes check syscall on ARM patch
|
2013-01-29 01:03:46 +00:00 |
|
|
atcuno
|
c9f9b9abc1
|
Linux - switch dump_map to zread
|
2013-01-22 05:59:19 +00:00 |
|
|
atcuno
|
6b0e737aef
|
Linux - make netstat inherit from pslist
|
2012-11-23 03:15:26 +00:00 |
|
|
atcuno
|
984f68dd88
|
Linux - change proc maps to table
|
2012-11-23 03:11:54 +00:00 |
|