 atcuno
|
2e8dac8aa3
|
Mac - update mount
|
2013-01-21 07:20:52 +00:00 |
|
|
atcuno
|
a248c8edce
|
Mac - update trustedbsd
|
2013-01-21 07:17:15 +00:00 |
|
|
atcuno
|
d7d47b25fc
|
Mac - update common
|
2013-01-21 07:16:56 +00:00 |
|
|
atcuno
|
89d77f91ac
|
Mac - update netstat
|
2013-01-21 07:09:44 +00:00 |
|
|
atcuno
|
352ab14d8e
|
Mac - update ifconfig
|
2013-01-21 07:06:03 +00:00 |
|
|
atcuno
|
80199cd5c8
|
Mac - update proc_maps
|
2013-01-21 07:03:05 +00:00 |
|
|
atcuno
|
bc4930f0e3
|
Mac - fix psaux
|
2013-01-21 06:59:16 +00:00 |
|
|
atcuno
|
8cfc9ce8b3
|
Mac - update psaux, broken due to failed AS check issue
|
2013-01-21 06:41:12 +00:00 |
|
|
atcuno
|
98415e272e
|
Mac - get rid of wait queues
|
2013-01-21 06:28:33 +00:00 |
|
|
atcuno
|
e325909cc3
|
Mac - update lsof
|
2013-01-21 06:27:10 +00:00 |
|
|
atcuno
|
d0b8fed31d
|
Mac - update pslist
|
2013-01-21 06:26:10 +00:00 |
|
|
atcuno
|
7aa6d3fbb3
|
Mac - update vfs_events
|
2013-01-21 06:22:17 +00:00 |
|
|
atcuno
|
ccb86bcc69
|
Mac - update machine_info
|
2013-01-21 06:17:03 +00:00 |
|
|
atcuno
|
3c142ac5b6
|
Mac - get rid of old files
|
2013-01-21 06:12:38 +00:00 |
|
|
atcuno
|
daaf97650f
|
Mac - update lsmod
|
2013-01-21 06:12:14 +00:00 |
|
|
atcuno
|
791c242779
|
Mac - update common
|
2013-01-21 06:11:57 +00:00 |
|
|
atcuno
|
b6d6c8ec8b
|
Mac - update version to use common instead of mac_common
|
2013-01-21 06:10:04 +00:00 |
|
|
atcuno
|
498ae876b3
|
Mac - rename common
|
2013-01-21 05:57:23 +00:00 |
|
|
atcuno
|
eed63a383f
|
Mac - update mac_common for execute/profile/set_members
|
2013-01-21 05:56:29 +00:00 |
|
|
atcuno
|
28cb76dfdc
|
add mac profile internals additions and AS checks
|
2013-01-21 05:55:33 +00:00 |
|
|
atcuno
|
52be2c2cbe
|
Update convert tool
|
2013-01-21 05:54:37 +00:00 |
|
|
iMHLv2
|
482a144f66
|
automatically translate kernel addresses in the strings output to identify the owning kernel module. fixes issue #363
|
2013-01-17 02:12:52 +00:00 |
|
|
iMHLv2
|
96d088e578
|
increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)
|
2013-01-17 01:13:27 +00:00 |
|
|
iMHLv2
|
a8e3d84f69
|
a column length is not needed for Pid in connections, because its the last column on the right
|
2013-01-17 01:10:58 +00:00 |
|
|
gleeda
|
2b1494a4cd
|
removed unused variable
|
2013-01-17 00:38:52 +00:00 |
|
|
gleeda
|
f6fe6eae44
|
Small fix in body output. Thanks to Bart I. for reporting!
|
2013-01-15 13:53:19 +00:00 |
|
|
gleeda
|
9221956b2d
|
Changed input to search_process_memory to list format as required. fixes issue 371
|
2013-01-09 16:25:01 +00:00 |
|
|
iMHLv2
|
9e770dc95d
|
remove an extranous / unnecessary import statement in filescan.py
|
2013-01-06 02:01:21 +00:00 |
|
|
iMHLv2
|
725fc79817
|
prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279
|
2013-01-05 20:11:56 +00:00 |
|
|
iMHLv2
|
eebcd278a7
|
reorder 2.3 CREDITS to be alphabetical by last name
|
2013-01-04 01:50:06 +00:00 |
|
|
iMHLv2
|
e50646b989
|
give Santiago Vicente credits in the 2.3 release for his citadel plugin(s)
|
2013-01-04 01:49:11 +00:00 |
|
|
iMHLv2
|
30b50f0600
|
add the zeusscan1 plugin (for zeus > 1.2 and < 2.0), zeusscan2 plugin (for zeus >= 2.0 but before IceX) and citadel 1.3.4.5 plugin by Santiago Vicente
|
2013-01-04 01:48:04 +00:00 |
|
|
iMHLv2
|
4ae4e796c1
|
give Andreas Schuster credits in the 2.3 release for his two poison ivy plugins
|
2013-01-03 23:42:23 +00:00 |
|
|
iMHLv2
|
b181aee2c7
|
add a directory contrib/plugins/malware for malware-specific plugins, both proof-of-concept and in full working order. start with Andreas Schuster's poisonivyscan and poisonivyconfig plugins...recently ported to 2.3 framework by MHL
|
2013-01-03 23:40:03 +00:00 |
|
|
iMHLv2
|
a66c3a6c14
|
apihooks should handle systems using kiintsystemcall in addition to kifastsystemcall. spotted by mathieu.geli. fixes issue #370
|
2013-01-03 23:01:12 +00:00 |
|
|
gleeda
|
33a8932176
|
small fix to output to conform to other bodyfile format outputs
|
2012-12-17 00:31:10 +00:00 |
|
|
gleeda
|
3696e4c4d9
|
added bodyfile format output to shellbags
|
2012-12-13 17:22:25 +00:00 |
|
|
gleeda
|
739e6ffc55
|
small change to allow access to raw timestamps
|
2012-12-13 17:05:06 +00:00 |
|
|
gleeda
|
56f8ee2904
|
slight change to allow access to raw timestamps
|
2012-12-13 17:03:42 +00:00 |
|
|
gleeda
|
343f9c253c
|
fixed up body output, added EA/EA_INFO vtypes and two small fixes
|
2012-12-13 16:03:22 +00:00 |
|
|
iMHLv2
|
c238f9272d
|
add the same check to _EPROCESS.search_process_memory() as VADDump uses for avoiding MM_MAX_COMMIT ranges on wow64 processes. spotted by Wyatt
|
2012-12-10 21:10:44 +00:00 |
|
|
gleeda
|
f3871f3822
|
Fixed so that we don't print out the list head as a possible hive. For details see: http://moyix.blogspot.com/2008/02/enumerating-registry-hives.html
|
2012-11-30 21:38:20 +00:00 |
|
|
gleeda
|
9d4fd0b2ff
|
converted to standard table output
|
2012-11-28 15:20:10 +00:00 |
|
|
iMHLv2
|
762f9963b4
|
add LoadCount column to dlllist so we can tell static (IAT) vs dynamic loaded dlls
|
2012-11-24 05:08:31 +00:00 |
|
|
iMHLv2
|
e4b8caf53e
|
the --pid parameter to impscan should be an integer (comma separated strings are not accepted)
|
2012-11-23 16:32:11 +00:00 |
|
|
atcuno
|
6b0e737aef
|
Linux - make netstat inherit from pslist
|
2012-11-23 03:15:26 +00:00 |
|
|
atcuno
|
69d9ed62b4
|
Linux - update overlay for amd64validas
|
2012-11-23 03:13:22 +00:00 |
|
|
atcuno
|
984f68dd88
|
Linux - change proc maps to table
|
2012-11-23 03:11:54 +00:00 |
|
|
iMHLv2
|
b23d6cf75a
|
bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images
|
2012-11-22 18:04:20 +00:00 |
|
|
iMHLv2
|
9d881ed2b0
|
a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set
|
2012-11-22 02:55:52 +00:00 |
|