2f7e6ed60d
malfind and yarascan should not bt if the specified output directory doesn't exist or if its a file - spotted by attrc
2012-07-28 15:35:18 +00:00
f2bcc5ebe7
fix a misspelled name in the credits
2012-07-27 23:32:40 +00:00
3235757bd2
update the AUTHORS, CREDITS, and README for 2.1
2012-07-27 23:30:02 +00:00
5da520ae59
Bump to rc3 bceause of the Pointer.v() fix for yarascan.
2012-07-25 18:35:25 +00:00
f16400dd78
until we can fix the Pointer.v() 48-bit truncation globally, fix the yarascan module resolution on x64 by supplying it with a private version of find_module that does the truncation
2012-07-25 18:09:16 +00:00
41376407b4
Bump to rc2 for the next testing build.
2012-07-24 19:51:50 +00:00
87dc0d7e06
add a comment to yarascan which explains why module lookups will fail when operating in kernelmode on x64. it'll be a known issue of the plugin for 2.1, after which time we'll update trunk's Pointer.v() and be able to test more thoroughly before a release
2012-07-24 19:47:05 +00:00
9db11a27e5
fix an off-by-one error in the impscan plugin. use the new vad.Length property added in r2076
2012-07-24 19:39:48 +00:00
dec52f7a43
bring back the ability for malfind to ignore VADs whose entire region is either unavailable due to paging or all 0's...this was lost in r2077 because we avoided reading the entire range into memory at once.
2012-07-24 19:37:11 +00:00
d5678fd981
apply a remedy for issue 306 - vaddump on wow64 processes with MM_MAX_COMMIT. we don't want to dump these multi terabyte ranges with no valid pages. see issue 306 for details and analysis...the issue will remain open while we consider other ways to address the problem, however this patch should resolve it well enough for the stability of the 2.1 release
2012-07-24 14:47:37 +00:00
9f79c3aca2
Make sure we don't use the same variable for different things in malfind BaseScanner.
2012-07-24 07:30:59 +00:00
5f7e3c1837
add scudette's BaseYaraScanner, VadYaraScanner, and DiscontigYaraScanner to malfind.py. this fixes yarascan on x64 kernelmode. the EPROCESS.get_vads() API changes a bit. it results in greater speed when using ldrmodules because only the first 2 bytes are needed instead of the whole vad region. also a new method VADDump.dump_vad is added which aims to write vads to a file in small chunks rather than building a large buffer in memory, which can exhaust/consume the analysis system's RAM.
2012-07-24 03:07:10 +00:00
84bc637f2f
add a Length property to MMVAD to reduce confusion over the purpose of vad.End and minimize the chance of off-by-one errors when calculating vad lengths. fixes Issue 308
2012-07-24 01:45:52 +00:00
712ac11fdf
prevent the 'NoneObject as string' warning when using regex with dlldump and moddump. we do plan on finding some other solution for all this after 2.1
2012-07-18 15:02:33 +00:00
7a27e3504b
Potential fix for issue 301, and minor pylint on volshell.
2012-07-17 16:09:55 +00:00
43ff231ada
Fix minor typo in impscan.
2012-07-17 16:09:48 +00:00
c63559a4ad
Fix the pyinstaller distorm3 hook documentation to be pyinstaller specific.
2012-07-12 21:20:33 +00:00
3df7c22bfe
Add in distorm3 support and unbuffered output for pyinstaller. Also minor pylint for setup.py.
2012-07-12 21:18:47 +00:00
f7b46ccef5
Fix a minor error in netscan, and pylint the rest of the recently changed code.
2012-07-12 20:00:04 +00:00
65507320be
prevent impscan from raising an IndexError when no imports are found. Fixes issue #300
2012-07-12 16:28:21 +00:00
7a4021fea1
convert dlldump, procexedump, and moddump to table_header/row output. increases code sharing between the plugins. adds more descriptive error messages when pe files cannot be dumped. accomplishes goals 1, 2, and 3 from issue #291 . all parties agree commit is OK wrt 2.1 RC1
2012-07-10 18:27:08 +00:00
00d59759ad
convert connscan output to table_header/table_row. this should be done prior to 2.1 since table renders are a major new feature in 2.1
2012-07-10 14:20:40 +00:00
5479c2be1d
fix some typos in the connections.Connections class pydoc
2012-07-10 14:13:53 +00:00
a2d21d59ef
make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.
2012-07-10 14:11:47 +00:00
d6050871e9
apply (maybe temporary) fixes to two UnicodeEncodeError exceptions in vadinfo and hivelist. fixes issue #295 .
2012-07-10 03:20:43 +00:00
276c1a420a
Remove unnecessary imports now we're using the dev pyinstaller.
2012-07-09 01:00:49 +00:00
5b455fca97
Move to the development version of pyinstaller (> 1.5.1).
...
Note, pyinstaller requires a patch to add:
importfunc.im_self.path = parent.__path__
to the ImportManager.doimport function in loader/iu.py
Without it the volatility.plugins.__path__ change never gets seen
by the pyinstaller importer.
2012-07-09 00:48:49 +00:00
a019abed5d
Fix pyinstaller plugins support.
...
Includes plugins in both the internal pyz, and the unpacked data
directory, in order to have dynamic loading work properly.
Also ensure that existing __path__ directories don't throw the plugin
loader off by trying to import the same plugin twice under different
namespaces.
2012-07-08 21:19:08 +00:00
1bbff68e01
Pylint the pyinstaller spec file.
2012-07-08 18:06:25 +00:00
c20ea55646
Catch InvalidOffsetErrors gracefully. Fixes issue 280.
2012-07-08 13:16:33 +00:00
1d724a6e88
Mark trunk at 2.1_rc1.
2012-07-08 09:36:46 +00:00
8bd862b2aa
fix a UnicodeEncodeError when dlldump prints module names
2012-07-07 23:24:27 +00:00
ecd60b4767
Include malware in the python setup sections.
2012-07-07 19:26:43 +00:00
33cbf31032
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
2012-07-07 19:19:58 +00:00
6887750a98
Print the reason for a NoneObject in the NoneObject representation itself.
2012-07-01 16:27:17 +00:00
18a6841950
Ensure NoneObjects always display as strings, no matter the input format code.
2012-07-01 16:27:09 +00:00
f2b24da4d9
tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278
2012-06-28 19:09:18 +00:00
d6e2136a61
small tweak to what ldrmodules considers a mapped file, for better detection of stuxnet and other malware that could possibly overwrite the vad's FileName after loading
2012-06-28 15:25:45 +00:00
0c70e45b66
use the MaxAddress volatility magic in yarascan
2012-06-28 13:52:54 +00:00
a989a170ef
fix a bug in vaddump and introduce a VolMagic for getting the maximum address in an AS based on the size of a native addr
2012-06-28 13:36:48 +00:00
74c678989a
the Limit column of GDT plugin should be addrpad
2012-06-25 20:39:38 +00:00
6c91c521d1
apply Ikelos' patch for adding a format_value method to commands. use it in vaddump to properly format file names for x86 and x64 addresses
2012-06-25 19:54:44 +00:00
b0fc9fab2e
fix a bitmasking issue with GDT 32-bit callgate address calculation. also make the Limit field for callgates 0 instead of a dash or it'll encounter a formatting bug when trying to print as hex
2012-06-25 19:18:14 +00:00
d2b99f97a0
Move hivedump to the printkey module, since it prints registry data, rather than having anything to do with crypto. Fixes issue 276.
2012-06-25 18:59:25 +00:00
143e73a47d
the gdt selector column should be displayed as hex
2012-06-25 18:57:13 +00:00
5a719d134d
bring back two components of the idt plugin output which was present in 2.0: print the PE section name of the IDT function and allow disasm of code when --verbose is enabled
2012-06-25 18:43:02 +00:00
7572475254
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
2012-06-24 19:34:44 +00:00
2c52ee66f6
bring back the -v option to driverirp that prints a disasm of each function (was in 2.0 version of the plugin from malware.py)
2012-06-23 22:59:11 +00:00
9e0525da35
add a description to apihooks plugin
2012-06-23 05:44:45 +00:00
ddf9de9edc
add apihooks plugin (x86) for IAT, EAT, Inline hooks in user and kernel mode, plus winsock proc table hooks (new), calls to unknown code pages (kernel), and ntdll syscall hooks
2012-06-21 14:26:48 +00:00
iMHLv2