 iMHLv2
|
2e0d0b72ca
|
increase the width of the mac_mount plugin's Mount Point column
|
2013-03-28 17:19:44 +00:00 |
|
|
iMHLv2
|
dcc234530f
|
small whitespace in linux_tty_check
|
2013-03-28 16:42:00 +00:00 |
|
|
iMHLv2
|
a024bd336d
|
adjust the find_aslr_shift and mac_proc_maps plugins for proper widths of long/unsigned long values
|
2013-03-28 16:29:52 +00:00 |
|
|
iMHLv2
|
a625bd7389
|
mac_pslist DTB field uses #018x format specifier instead of [addrpad]
|
2013-03-28 15:53:07 +00:00 |
|
|
iMHLv2
|
fa27b876a6
|
allow mac_pslist process creation timestamps to abide by the --tz command-line parameter instead of always displaying localtime
|
2013-03-28 14:28:02 +00:00 |
|
|
iMHLv2
|
75ccdf6c9e
|
not all threads that start in kernel mode are 'system' threads, so change the way we look up the owning module's name to just check if the start address is above MmSystemRangeStart
|
2013-03-27 16:51:09 +00:00 |
|
|
iMHLv2
|
6f7a9682b9
|
make sure to disassemble thread starting addresses in 32 or 64 bit according to the profile
|
2013-03-27 15:53:36 +00:00 |
|
|
mike.auty@gmail.com
|
4239018d0e
|
Match the help message to the plugin path separator.
|
2013-03-27 08:51:26 +00:00 |
|
|
mike.auty@gmail.com
|
50982a178d
|
Make plugin path separators operating system dependent, matching the PATH environment variable.
|
2013-03-26 22:01:42 +00:00 |
|
|
iMHLv2
|
cc6a5d9f45
|
remove unnecessary timeliner options passed down by inheriting from other plugins
|
2013-03-25 18:01:09 +00:00 |
|
|
iMHLv2
|
1c6743f165
|
rework the detection of idt hooks using gdt selectors. ignore gdt entries that aren't for code segments
|
2013-03-25 17:46:53 +00:00 |
|
|
iMHLv2
|
a1880c0b3c
|
change the idt plugin to print the selector column as hex to match with the gdt selector output
|
2013-03-25 17:21:45 +00:00 |
|
|
iMHLv2
|
94631b577d
|
linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED
|
2013-03-25 16:00:52 +00:00 |
|
|
iMHLv2
|
623006f870
|
use a process AS to disassemble threads starting address. fixes issue #391
|
2013-03-25 15:55:23 +00:00 |
|
|
gleeda
|
144af159e8
|
fixing up some windows profile descriptions
|
2013-03-19 20:38:55 +00:00 |
|
|
gleeda
|
205cc2fe6f
|
mftparser: switching the offset and filename as requested by Bart Inglot to make it easier to sort when using excel and the like
|
2013-03-10 01:21:46 +00:00 |
|
|
gleeda
|
07b8f6949b
|
modified render_xlsx to use optimized writer
|
2013-03-08 13:39:55 +00:00 |
|
|
iMHLv2
|
cca161ba12
|
fix a small issue with the disassembly printed by apihooks for NT syscall type hooks. it assumes the system call is done with CALL [EDX] but it is sometimes done with CALL EDX (no deref)
|
2013-03-08 06:38:07 +00:00 |
|
|
gleeda
|
6033c35bd1
|
added xlsx output renderer for timeliner using OpenPyxl
|
2013-03-08 00:27:28 +00:00 |
|
|
gleeda
|
566a5efebc
|
fixed a small bug
|
2013-03-07 16:29:23 +00:00 |
|
|
iMHLv2
|
fe4e945c94
|
remove the last remaining plugins that reference commands.command - change to commands.Command
|
2013-03-07 16:09:49 +00:00 |
|
|
iMHLv2
|
2933c6a786
|
remove the deprecated command component from commands.py
|
2013-03-07 16:07:32 +00:00 |
|
|
gleeda
|
ec42d1a81f
|
initial commit of timeliner in contrib/plugins folder
|
2013-03-07 16:05:05 +00:00 |
|
|
iMHLv2
|
edeee594a6
|
include the task ID in the table column for linux_proc_maps. otherwise when you view maps for multiple processes, you can't tell which range belongs to which process
|
2013-03-07 16:04:53 +00:00 |
|
|
gleeda
|
4059a55569
|
changed debug.error to debug.warning so other plugins collecting shimcache output are not killed if shimcache fails
|
2013-03-07 16:04:22 +00:00 |
|
|
iMHLv2
|
f78329f8f2
|
fix linux_dump_maps plugin: inherit from proc_maps for -p option, replace --outfile with --dump-dir so we can write multiple VMAs to separate files, use table_header/table_row for a summary. spotted by Edwin Smulders
|
2013-03-07 15:58:19 +00:00 |
|
|
iMHLv2
|
bbad6877e8
|
remove some whitespace in linux_pstree
|
2013-03-07 15:37:31 +00:00 |
|
|
iMHLv2
|
e8569a92d6
|
add **kwargs for all linux plugins
|
2013-03-07 15:28:36 +00:00 |
|
|
gleeda
|
2b965b3f91
|
removed empty folder
|
2013-03-07 15:16:11 +00:00 |
|
|
gleeda
|
43ec9fb49e
|
fixed output in pstree to show full time. it was chopped off after updating the timestamps to UTC. fixes issue 389
|
2013-03-07 14:23:52 +00:00 |
|
|
gleeda
|
db09e88ac8
|
removed uneeded line
|
2013-03-02 03:04:49 +00:00 |
|
|
gleeda
|
07d5f28b70
|
adding the Makefile for pmem which was left off in revision 3161
|
2013-03-02 02:18:41 +00:00 |
|
|
gleeda
|
0e040c8bf0
|
Fixing the Makefile for module.c to handle kernels >= 3.7 since VM_RESERVED is removed (thanks dhiru.kholia) and also moving pmem to its own folder so it can be compiled separately. Fixes issue #368
|
2013-03-02 02:15:52 +00:00 |
|
|
iMHLv2
|
b2ec5bdb6a
|
allow detection of ssdt inline hooks when --verbose is supplied to the ssdt plugin (x86 only)
|
2013-02-26 16:57:53 +00:00 |
|
|
iMHLv2
|
5b9a804a61
|
fix setup.py to include the volatility.plugins.overlays.mac package. spotted by D. Kovar
|
2013-02-25 17:37:43 +00:00 |
|
|
iMHLv2
|
f106698abf
|
bring the IGNORE_UNIX option back to linux_netstat. it was deleted it r2808 but the variable self._config.IGNORE_UNIX is still referenced in code
|
2013-02-22 18:31:28 +00:00 |
|
|
iMHLv2
|
1394f9a72f
|
fix a bug in the threads plugin...a typo introduced with the new address space pointer masking. spotted by Wyatt Roersma
|
2013-02-22 16:38:37 +00:00 |
|
|
iMHLv2
|
a69bc6f84b
|
add a description to the linux_volshell command
|
2013-02-22 15:33:48 +00:00 |
|
|
iMHLv2
|
be4231481f
|
fix pydoc for linux_tmpfs function
|
2013-02-22 14:46:42 +00:00 |
|
|
iMHLv2
|
e317dfe58f
|
remove unused inode.i_size variable
|
2013-02-22 14:19:03 +00:00 |
|
|
iMHLv2
|
2605f7bfcc
|
remove some unnecessary variable reassignments in linux_tmpfs
|
2013-02-22 14:16:19 +00:00 |
|
|
iMHLv2
|
e899be9888
|
fix linux_tmpfs for --tz time zone handling and UnixTimeStamp
|
2013-02-22 14:07:38 +00:00 |
|
|
iMHLv2
|
b5d8d77fdb
|
fix evtlogs to detect and skip corrupt records (based on invalid SID length). spotted by Wyatt Roersma
|
2013-02-21 18:01:41 +00:00 |
|
|
iMHLv2
|
dbd344f547
|
change some of the members of event log structures from int to unsigned int. this will be required for detecting mangled records (see next upcoming patch)
|
2013-02-21 17:53:55 +00:00 |
|
|
iMHLv2
|
676597f7cb
|
remove the sym_type parameter to AbstractMacProfile.get_symbol() and AbstractLinuxProfile.get_symbol(). its no longer needed after the pointer masking patch in r3127
|
2013-02-20 03:07:23 +00:00 |
|
|
iMHLv2
|
5a82d7db8a
|
some whitespace and remove some unused print statements in mac.py
|
2013-02-20 03:03:29 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
34f418714f
|
make the changes described in r3125 to the new mac check_syscall plugin
|
2013-02-19 23:58:46 +00:00 |
|
|
iMHLv2
|
3caae1ea79
|
Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()
|
2013-02-19 23:54:47 +00:00 |
|
|
iMHLv2
|
3890e72110
|
Linux - modify task_struct.get_task_start_time() to properly use UnixTimeStamp objects (little endian) and the timezone settings from the CONFIG object
|
2013-02-19 23:29:19 +00:00 |
|