 gleeda
|
2fcf6612e5
|
fixed to allow one to specify hex output if they don't have disasm installed. also added a ZEROSTART option to make it easier to xxd -r from hex output
|
2013-02-06 22:09:12 +00:00 |
|
|
gleeda
|
190ae8bb1c
|
mbrparser: fixed one small bug
|
2013-02-06 13:43:19 +00:00 |
|
|
gleeda
|
85cf79cddb
|
changing column width of Create and Exit times for psscan
|
2013-02-06 00:08:29 +00:00 |
|
|
gleeda
|
964c3b32c9
|
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
|
2013-02-06 00:02:16 +00:00 |
|
|
iMHLv2
|
a48925ce7b
|
fix a % to format() in moddump
|
2013-02-05 20:09:37 +00:00 |
|
|
iMHLv2
|
ebf0a9903f
|
some whitespace in linux_check_syscall_arm
|
2013-02-05 20:08:55 +00:00 |
|
|
iMHLv2
|
7185d06827
|
some whitespace in linux_check_evt_arm
|
2013-02-05 20:08:00 +00:00 |
|
|
iMHLv2
|
7cbab87f06
|
move the plugin description for linux_check_evt_arm to proper place for pydoc
|
2013-02-05 20:05:06 +00:00 |
|
|
iMHLv2
|
3cd0e2c881
|
add the linux_moddump plugin
|
2013-02-05 20:02:31 +00:00 |
|
|
iMHLv2
|
8932135e0f
|
add the linux yarascan plugin
|
2013-02-05 15:53:57 +00:00 |
|
|
iMHLv2
|
8c69a0a162
|
move the yara rules compilation code to a method of the YaraScan plugin, thus making it accessible to plugins which inherit from YaraScan. also catch yara.SyntaxError exceptions
|
2013-02-05 14:25:30 +00:00 |
|
|
iMHLv2
|
ee0ac2406a
|
change the Pgoff column in linux_proc_maps to [addr] instead of decimal 6-char width
|
2013-02-05 04:51:13 +00:00 |
|
|
atcuno
|
dd44c49f8e
|
Linux - update proc_maps interface and add search_process_memory
|
2013-02-05 03:15:37 +00:00 |
|
|
iMHLv2
|
600bfe96d8
|
add DTB column to mac_pslist
|
2013-02-04 23:28:51 +00:00 |
|
|
iMHLv2
|
5361e6706b
|
fix the gid column of linux_pslist for centos 6.3 and newer. fixes issue #377
|
2013-02-04 23:28:12 +00:00 |
|
|
iMHLv2
|
68cb9b40b2
|
add a description to the mac_find_aslr_shift plugin
|
2013-02-04 19:52:34 +00:00 |
|
|
gleeda
|
3ac888cee2
|
volshell: changed s/address_space/space for dt() to conform with other commands
|
2013-02-04 18:25:28 +00:00 |
|
|
gleeda
|
a841aa606a
|
few cleanups: removed %, fixed a small bug and added levenshtein distance checks
|
2013-02-04 17:40:19 +00:00 |
|
|
iMHLv2
|
6a0a1c603b
|
add an initial mac_volshell plugin
|
2013-02-04 15:15:05 +00:00 |
|
|
iMHLv2
|
e65c61bf20
|
refactor linux_volshell to share more code with the existing windows volshell command
|
2013-02-04 14:32:04 +00:00 |
|
|
iMHLv2
|
5b7a13e56e
|
change the name of the current process in volshell from eproc to proc to make it more generic and re-usable for linux and mac (whose process struct is not eprocess)
|
2013-02-04 14:19:11 +00:00 |
|
|
iMHLv2
|
f172c17266
|
cleanup linux.VolatilityDTB so that it doesnt contain x64 logic. the x64 check is in linux64.VolatilityDTB
|
2013-02-04 04:21:09 +00:00 |
|
|
iMHLv2
|
8eb611679c
|
fix a bug in the new dtb printing column for linux_pslist
|
2013-02-04 04:19:22 +00:00 |
|
|
iMHLv2
|
608efd4e7a
|
add a linux_volshell command. as stated in the plugin, there is massive code duplicate, because the windows volshell is not written in an inheritance friendly manner. at the moment, we accept this risk in favor of functionality - being able to db/dd/dq/dis/dt/cc interactively on linux memory images
|
2013-02-04 00:42:14 +00:00 |
|
|
iMHLv2
|
14a5d6e05a
|
show the process DTB in linux_pslist, from task_struct.mm.pgd
|
2013-02-04 00:25:13 +00:00 |
|
|
atcuno
|
fbadaa9de9
|
Mac - fix dump_maps
|
2013-01-31 23:41:20 +00:00 |
|
|
iMHLv2
|
30f421d1f4
|
remove unused import from mac.py
|
2013-01-31 22:56:33 +00:00 |
|
|
atcuno
|
0c318be595
|
Mac - rename find_aslr_dtb to find_aslr_shift
|
2013-01-31 22:38:33 +00:00 |
|
|
atcuno
|
b4192c6b82
|
Mac - rename find_aslr_dtb to find_aslr_shift
|
2013-01-31 22:38:04 +00:00 |
|
|
atcuno
|
63a4025f2a
|
Mac - fix trustedbsd and make print wider
|
2013-01-31 21:58:30 +00:00 |
|
|
atcuno
|
86a3eaa6e1
|
Mac - make mount print wider
|
2013-01-31 21:50:50 +00:00 |
|
|
atcuno
|
04c87ec9b6
|
Mac - add global SHIFT option to specifiy kernel aslr shift for an image
|
2013-01-31 21:39:01 +00:00 |
|
|
atcuno
|
f6b56e82f6
|
Mac - add find_aslr_dtb
|
2013-01-31 21:21:02 +00:00 |
|
|
atcuno
|
85530c9195
|
Mac - fix typo in mac.py
|
2013-01-31 21:02:48 +00:00 |
|
|
atcuno
|
8802a9340f
|
Mac - cleanup mac.py
|
2013-01-31 20:41:29 +00:00 |
|
|
atcuno
|
84de91c801
|
Mac - cleanup mac.py
|
2013-01-31 20:41:07 +00:00 |
|
|
atcuno
|
959a7c630d
|
Mac - cleanup mac.py
|
2013-01-31 20:39:46 +00:00 |
|
|
atcuno
|
797c77ab97
|
Mac - update mac.py to support 10.8
|
2013-01-31 20:33:19 +00:00 |
|
|
iMHLv2
|
0dc5c01cc1
|
fix some import statements in mac.py
|
2013-01-31 18:29:25 +00:00 |
|
|
iMHLv2
|
efb72f9893
|
replace the ifaddr object class with sockaddr. use table_header/table_row in mac_route. delete the mac_route.get_ip() function as its been replaced with the sockaddr.get_address() API. report N/A in mac_route for columns not present in a profile
|
2013-01-31 18:25:02 +00:00 |
|
|
iMHLv2
|
45f0489293
|
tiny space saving change in mac_list_sessions
|
2013-01-31 04:09:18 +00:00 |
|
|
iMHLv2
|
099bb5320d
|
remove unused import in mac_netstat
|
2013-01-31 04:06:39 +00:00 |
|
|
iMHLv2
|
6812f3ad76
|
remove unused import in mac_ip_filters
|
2013-01-31 04:05:57 +00:00 |
|
|
iMHLv2
|
5fbe956f90
|
remove unused import in mac_dump_maps
|
2013-01-31 04:05:30 +00:00 |
|
|
iMHLv2
|
fca57c5951
|
fix mac_dump_maps for the new number of parameters yielded by mac_proc_maps.calculate()
|
2013-01-31 04:05:04 +00:00 |
|
|
iMHLv2
|
5ad3243ed0
|
remove unused imports in mac_pstree
|
2013-01-31 04:02:35 +00:00 |
|
|
iMHLv2
|
33194af14a
|
mac_psaux inherits from mac_pslist so it doesn't need a calculate function at all
|
2013-01-31 04:00:43 +00:00 |
|
|
atcuno
|
8f73d9428f
|
Mac - update convert.py to rename class_type variables
|
2013-01-31 04:00:42 +00:00 |
|
|
iMHLv2
|
1934e29945
|
add get_task_name() method to proc object class. call it from mac_psaux plugin
|
2013-01-31 03:54:48 +00:00 |
|
|
iMHLv2
|
9b98a7c69f
|
just add a fixme comment to mac_proc_maps
|
2013-01-31 03:51:39 +00:00 |
|