 atcuno
|
2e8dac8aa3
|
Mac - update mount
|
2013-01-21 07:20:52 +00:00 |
|
|
atcuno
|
a248c8edce
|
Mac - update trustedbsd
|
2013-01-21 07:17:15 +00:00 |
|
|
atcuno
|
d7d47b25fc
|
Mac - update common
|
2013-01-21 07:16:56 +00:00 |
|
|
atcuno
|
89d77f91ac
|
Mac - update netstat
|
2013-01-21 07:09:44 +00:00 |
|
|
atcuno
|
352ab14d8e
|
Mac - update ifconfig
|
2013-01-21 07:06:03 +00:00 |
|
|
atcuno
|
80199cd5c8
|
Mac - update proc_maps
|
2013-01-21 07:03:05 +00:00 |
|
|
atcuno
|
bc4930f0e3
|
Mac - fix psaux
|
2013-01-21 06:59:16 +00:00 |
|
|
atcuno
|
8cfc9ce8b3
|
Mac - update psaux, broken due to failed AS check issue
|
2013-01-21 06:41:12 +00:00 |
|
|
atcuno
|
98415e272e
|
Mac - get rid of wait queues
|
2013-01-21 06:28:33 +00:00 |
|
|
atcuno
|
e325909cc3
|
Mac - update lsof
|
2013-01-21 06:27:10 +00:00 |
|
|
atcuno
|
d0b8fed31d
|
Mac - update pslist
|
2013-01-21 06:26:10 +00:00 |
|
|
atcuno
|
7aa6d3fbb3
|
Mac - update vfs_events
|
2013-01-21 06:22:17 +00:00 |
|
|
atcuno
|
ccb86bcc69
|
Mac - update machine_info
|
2013-01-21 06:17:03 +00:00 |
|
|
atcuno
|
3c142ac5b6
|
Mac - get rid of old files
|
2013-01-21 06:12:38 +00:00 |
|
|
atcuno
|
daaf97650f
|
Mac - update lsmod
|
2013-01-21 06:12:14 +00:00 |
|
|
atcuno
|
791c242779
|
Mac - update common
|
2013-01-21 06:11:57 +00:00 |
|
|
atcuno
|
b6d6c8ec8b
|
Mac - update version to use common instead of mac_common
|
2013-01-21 06:10:04 +00:00 |
|
|
atcuno
|
498ae876b3
|
Mac - rename common
|
2013-01-21 05:57:23 +00:00 |
|
|
atcuno
|
eed63a383f
|
Mac - update mac_common for execute/profile/set_members
|
2013-01-21 05:56:29 +00:00 |
|
|
atcuno
|
28cb76dfdc
|
add mac profile internals additions and AS checks
|
2013-01-21 05:55:33 +00:00 |
|
|
iMHLv2
|
482a144f66
|
automatically translate kernel addresses in the strings output to identify the owning kernel module. fixes issue #363
|
2013-01-17 02:12:52 +00:00 |
|
|
iMHLv2
|
96d088e578
|
increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)
|
2013-01-17 01:13:27 +00:00 |
|
|
iMHLv2
|
a8e3d84f69
|
a column length is not needed for Pid in connections, because its the last column on the right
|
2013-01-17 01:10:58 +00:00 |
|
|
gleeda
|
f6fe6eae44
|
Small fix in body output. Thanks to Bart I. for reporting!
|
2013-01-15 13:53:19 +00:00 |
|
|
gleeda
|
9221956b2d
|
Changed input to search_process_memory to list format as required. fixes issue 371
|
2013-01-09 16:25:01 +00:00 |
|
|
iMHLv2
|
9e770dc95d
|
remove an extranous / unnecessary import statement in filescan.py
|
2013-01-06 02:01:21 +00:00 |
|
|
iMHLv2
|
725fc79817
|
prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279
|
2013-01-05 20:11:56 +00:00 |
|
|
iMHLv2
|
a66c3a6c14
|
apihooks should handle systems using kiintsystemcall in addition to kifastsystemcall. spotted by mathieu.geli. fixes issue #370
|
2013-01-03 23:01:12 +00:00 |
|
|
gleeda
|
33a8932176
|
small fix to output to conform to other bodyfile format outputs
|
2012-12-17 00:31:10 +00:00 |
|
|
gleeda
|
3696e4c4d9
|
added bodyfile format output to shellbags
|
2012-12-13 17:22:25 +00:00 |
|
|
gleeda
|
739e6ffc55
|
small change to allow access to raw timestamps
|
2012-12-13 17:05:06 +00:00 |
|
|
gleeda
|
56f8ee2904
|
slight change to allow access to raw timestamps
|
2012-12-13 17:03:42 +00:00 |
|
|
gleeda
|
343f9c253c
|
fixed up body output, added EA/EA_INFO vtypes and two small fixes
|
2012-12-13 16:03:22 +00:00 |
|
|
iMHLv2
|
c238f9272d
|
add the same check to _EPROCESS.search_process_memory() as VADDump uses for avoiding MM_MAX_COMMIT ranges on wow64 processes. spotted by Wyatt
|
2012-12-10 21:10:44 +00:00 |
|
|
gleeda
|
f3871f3822
|
Fixed so that we don't print out the list head as a possible hive. For details see: http://moyix.blogspot.com/2008/02/enumerating-registry-hives.html
|
2012-11-30 21:38:20 +00:00 |
|
|
gleeda
|
9d4fd0b2ff
|
converted to standard table output
|
2012-11-28 15:20:10 +00:00 |
|
|
iMHLv2
|
762f9963b4
|
add LoadCount column to dlllist so we can tell static (IAT) vs dynamic loaded dlls
|
2012-11-24 05:08:31 +00:00 |
|
|
iMHLv2
|
e4b8caf53e
|
the --pid parameter to impscan should be an integer (comma separated strings are not accepted)
|
2012-11-23 16:32:11 +00:00 |
|
|
atcuno
|
6b0e737aef
|
Linux - make netstat inherit from pslist
|
2012-11-23 03:15:26 +00:00 |
|
|
atcuno
|
69d9ed62b4
|
Linux - update overlay for amd64validas
|
2012-11-23 03:13:22 +00:00 |
|
|
atcuno
|
984f68dd88
|
Linux - change proc maps to table
|
2012-11-23 03:11:54 +00:00 |
|
|
iMHLv2
|
b23d6cf75a
|
bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images
|
2012-11-22 18:04:20 +00:00 |
|
|
iMHLv2
|
9d881ed2b0
|
a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set
|
2012-11-22 02:55:52 +00:00 |
|
|
iMHLv2
|
d6ff602f04
|
add the unloadedmodules plugin for detecting recently loaded but then quickly unloaded drivers
|
2012-11-21 20:26:55 +00:00 |
|
|
iMHLv2
|
a9a6ff54a1
|
in --verbose mode, the svcscan plugin queries the registry for a service's ServiceDll path
|
2012-11-21 16:31:34 +00:00 |
|
|
iMHLv2
|
a4bd3aa524
|
add the privileges plugin
|
2012-11-20 21:38:46 +00:00 |
|
|
gleeda
|
911f1b8243
|
comment fix
|
2012-11-14 00:43:27 +00:00 |
|
|
gleeda
|
e90948e217
|
small formatting fix
|
2012-11-13 21:50:45 +00:00 |
|
|
gleeda
|
fc44873e54
|
added is_bootable_and_used() as a better check for the partition table since we need a bootable partition that is valid and non-empty
|
2012-11-13 21:31:42 +00:00 |
|
|
gleeda
|
c1efda5625
|
finished a comment
|
2012-11-13 20:54:15 +00:00 |
|