 mike.auty@gmail.com
|
4f6681a14d
|
Apply basic windows restrictions to most windows plugins.
|
2012-05-18 09:53:27 +00:00 |
|
|
mike.auty@gmail.com
|
a51f61a44f
|
Fix a typo/bug in the recent malware threads plugin.
|
2012-05-14 23:07:20 +00:00 |
|
|
mike.auty@gmail.com
|
5cb4ab5dda
|
Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.
|
2012-05-14 23:06:56 +00:00 |
|
|
mike.auty@gmail.com
|
b904171df7
|
Move the plugin constraints to an is_valid_profile function, in preparation for the linux-trunk merge.
|
2012-05-14 23:06:39 +00:00 |
|
|
mike.auty@gmail.com
|
92ca6454f7
|
Set a sensible default for the new attribute to is_valid (since the overridden method doesn't expect that value).
|
2012-05-14 23:06:23 +00:00 |
|
|
iMHLv2
|
fdb358b9d5
|
reduce the size of vtypes in svcscan.py by using base vtypes and overlays
|
2012-05-08 16:27:38 +00:00 |
|
|
iMHLv2
|
fc33d7dcce
|
add threads plugin. fixes issue #249
|
2012-05-08 15:53:02 +00:00 |
|
|
mike.auty@gmail.com
|
f3c28c098a
|
Pylint some files.
|
2012-04-30 11:56:50 +00:00 |
|
|
iMHLv2
|
1dcad3d557
|
bring back the --dump-dir option to malfind
|
2012-04-23 02:45:51 +00:00 |
|
|
iMHLv2
|
00dd38e075
|
bug in svcscan (valid -> is_valid)
|
2012-04-19 15:15:03 +00:00 |
|
|
iMHLv2
|
60404a00a2
|
some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.
|
2012-04-11 13:49:36 +00:00 |
|
|
iMHLv2
|
a25aa7be57
|
change a few get_xxx() in svcscan to @property
|
2012-04-11 13:40:45 +00:00 |
|
|
iMHLv2
|
af5130e419
|
move svcscan's service record tag into a VolatilityMagic so its always available in the profile
|
2012-04-11 01:37:18 +00:00 |
|
|
iMHLv2
|
16cede7a83
|
since at least r630 we've been instantiating the root vad (EPROCESS.VadRoot) in kernel AS and all child nodes in process AS. in r1548 we attemped to add consistency and instantiate all from process AS, but that was the wrong decision. this patch reverts the changes made in r1548 and ensures all MMVADs are in kernel AS but that actual vad data comes from process AS. the get_data() and get_vads() helpers go away. we introduce some helper APIs for the malware plugins to filter vads based on MMVAD flags and data
|
2012-04-07 16:02:15 +00:00 |
|
|
mike.auty@gmail.com
|
b9f1215593
|
Fix a typo in cmdhistory.
|
2012-04-06 23:43:42 +00:00 |
|
|
mike.auty@gmail.com
|
69dd3ee613
|
Pylint this before fixing a typo.
|
2012-04-06 23:43:31 +00:00 |
|
|
iMHLv2
|
3524c4ccd5
|
replace several get_xxx() with @property for MMVADs
|
2012-04-06 23:13:22 +00:00 |
|
|
iMHLv2
|
4e3afdbdcc
|
remove unused interrupt lookup table from idt.py
|
2012-04-06 20:40:20 +00:00 |
|
|
iMHLv2
|
f1a17ed17f
|
add idt and gdt plugins for x86. support for x64 is planned but not a big priority, given the discounted role that the descriptor tables play on x64 systems.
|
2012-04-06 20:38:00 +00:00 |
|
|
iMHLv2
|
caec97971b
|
add windows command history plugins (cmdscan and consoles). fixes issue #148.
|
2012-04-04 19:22:44 +00:00 |
|
|
iMHLv2
|
e2ec13d12a
|
change the list_mapped_files API to return the MMVAD object instead of the vad's starting address. this supports Gleeda's use of the API for her eventlogs plugin.
|
2012-04-02 17:14:31 +00:00 |
|
|
iMHLv2
|
a6a33981ea
|
add malfind, ldrmodules, yarascan, and svcscan plugins for x86 and x64 windows. Fixes Issue #234. Fixes Issue #235.
|
2012-03-30 15:42:02 +00:00 |
|
|
iMHLv2
|
51f97e26c6
|
update devicetree and driverirp for new unicode strings (see r1563)
|
2012-03-23 15:06:24 +00:00 |
|
|
mike.auty@gmail.com
|
848500de99
|
Add in the debug import, and minor pylint/whitespace fixes.
|
2012-03-17 13:23:46 +00:00 |
|
|
iMHLv2
|
5907bd464f
|
fix a bug detecting timers on win2k3sp0...s/major/build/
|
2012-03-16 17:42:29 +00:00 |
|
|
iMHLv2
|
4c2bd45cff
|
add driverirp plugin to devicetree.py file. checks for inline hooks of IRP functions will return after the ApiHooks plugin is committed. fixes issue #232.
|
2012-03-13 01:17:14 +00:00 |
|
|
iMHLv2
|
8561e48e70
|
add psxview plugin for x86 and x64 windows. fixes issue #231
|
2012-03-12 00:57:13 +00:00 |
|
|
iMHLv2
|
2b7a65ddb5
|
replace raise StopIteration with return in callbacks.py, per scudette's recommedation - thanks.
|
2012-03-12 00:46:02 +00:00 |
|
|
iMHLv2
|
35a8d1cfbd
|
add MAJOR_FUNCTIONS constants to devicetree.py, fix import statement in callbacks.py. later a driverirp plugin will be added to devicetree.py that also uses MAJOR_FUNCTIONS
|
2012-03-10 21:52:28 +00:00 |
|
|
iMHLv2
|
d809b6bafc
|
add callbacks.py and timers.py plugins. fixes issue #228. fixes issue #229.
|
2012-03-09 21:36:46 +00:00 |
|
|
iMHLv2
|
7b08839a37
|
add devicetree plugin to core - volatility/plugins/devicetree.py. fixes Issue #226.
|
2012-03-09 14:19:48 +00:00 |
|
|
iMHLv2
|
e032b38ee8
|
make a future home for malware plugins in volatility/plugins/malware
|
2012-03-08 19:25:21 +00:00 |
|