 iMHLv2
|
725fc79817
|
prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279
|
2013-01-05 20:11:56 +00:00 |
|
|
iMHLv2
|
762f9963b4
|
add LoadCount column to dlllist so we can tell static (IAT) vs dynamic loaded dlls
|
2012-11-24 05:08:31 +00:00 |
|
|
iMHLv2
|
cb488ba7fa
|
fix a minor caps mistake in pslist plugin description
|
2012-08-29 15:18:20 +00:00 |
|
|
iMHLv2
|
7572475254
|
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
|
2012-06-24 19:34:44 +00:00 |
|
|
mike.auty@gmail.com
|
090a3a9b88
|
Fixes issue 266.
|
2012-06-03 14:55:44 +00:00 |
|
|
iMHLv2
|
dae64ee3f0
|
add exit time, session id, and wow64 columns to pslist. we can now easily distinguish between 32bit processes on 64bit models. when there is more than one critical system process like csrss.exe, winlogon.exe that have different pids, we can now tell which belongs to sesison 0, session 1, etc. the exit time addition fixes issue #215
|
2012-05-22 14:22:25 +00:00 |
|
|
iMHLv2
|
91cea8afa0
|
add the @property IsWow64 to _EPROCESS. change session_id() to @property SessionId
|
2012-05-22 14:10:41 +00:00 |
|
|
iMHLv2
|
2717daa3c7
|
alert users to the ldrmodules plugin when they use dlllist on wow64 processes. fixes issue #251.
|
2012-05-22 13:38:00 +00:00 |
|
|
mike.auty@gmail.com
|
c5843bae8d
|
Add in support for the table output in a couple of plugins.
|
2012-05-22 08:26:41 +00:00 |
|
|
mike.auty@gmail.com
|
2e8090cd56
|
Revert issue190 changes mistakenly applied to trunk.
|
2012-05-19 14:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
5774ac5646
|
Add in support for the table output in a couple of plugins.
|
2012-05-19 14:39:04 +00:00 |
|
|
mike.auty@gmail.com
|
4f6681a14d
|
Apply basic windows restrictions to most windows plugins.
|
2012-05-18 09:53:27 +00:00 |
|
|
iMHLv2
|
756cfe9997
|
few modifications to strings in dlllist's output. this may end up just being temporary if other changes to unicode strings are made to the core, but might as well keep them consistent with how other plugins are printing strings at the moment.
|
2012-04-10 16:32:51 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
mike.auty@gmail.com
|
4ae458e160
|
Remove all unnecessary trailing slashes.
|
2012-02-26 23:26:52 +00:00 |
|
|
iMHLv2
|
5c6c0b7bda
|
move some of the per-profile guess work done in taskmods.py into object classes
|
2012-02-14 17:35:03 +00:00 |
|
|
mike.auty@gmail.com
|
d649b5b9b0
|
Fix inconsistency in commands.command class capitalization.
|
2012-02-05 23:36:33 +00:00 |
|
|
iMHLv2
|
6ea1d71930
|
sanity check the bounce from physical to virtual eprocess. Fixes issue #154
|
2012-01-25 15:18:53 +00:00 |
|
|
iMHLv2
|
662b412248
|
prevent memdump from crashing on unreadable (paged) memory
|
2012-01-20 23:40:43 +00:00 |
|
|
iMHLv2
|
1220d59ba7
|
move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160
|
2011-10-26 20:10:43 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|