 iMHLv2
|
ebf0a9903f
|
some whitespace in linux_check_syscall_arm
|
2013-02-05 20:08:55 +00:00 |
|
|
iMHLv2
|
7185d06827
|
some whitespace in linux_check_evt_arm
|
2013-02-05 20:08:00 +00:00 |
|
|
iMHLv2
|
7cbab87f06
|
move the plugin description for linux_check_evt_arm to proper place for pydoc
|
2013-02-05 20:05:06 +00:00 |
|
|
iMHLv2
|
3cd0e2c881
|
add the linux_moddump plugin
|
2013-02-05 20:02:31 +00:00 |
|
|
iMHLv2
|
8932135e0f
|
add the linux yarascan plugin
|
2013-02-05 15:53:57 +00:00 |
|
|
iMHLv2
|
ee0ac2406a
|
change the Pgoff column in linux_proc_maps to [addr] instead of decimal 6-char width
|
2013-02-05 04:51:13 +00:00 |
|
|
atcuno
|
dd44c49f8e
|
Linux - update proc_maps interface and add search_process_memory
|
2013-02-05 03:15:37 +00:00 |
|
|
iMHLv2
|
6a0a1c603b
|
add an initial mac_volshell plugin
|
2013-02-04 15:15:05 +00:00 |
|
|
iMHLv2
|
e65c61bf20
|
refactor linux_volshell to share more code with the existing windows volshell command
|
2013-02-04 14:32:04 +00:00 |
|
|
iMHLv2
|
8eb611679c
|
fix a bug in the new dtb printing column for linux_pslist
|
2013-02-04 04:19:22 +00:00 |
|
|
iMHLv2
|
608efd4e7a
|
add a linux_volshell command. as stated in the plugin, there is massive code duplicate, because the windows volshell is not written in an inheritance friendly manner. at the moment, we accept this risk in favor of functionality - being able to db/dd/dq/dis/dt/cc interactively on linux memory images
|
2013-02-04 00:42:14 +00:00 |
|
|
iMHLv2
|
14a5d6e05a
|
show the process DTB in linux_pslist, from task_struct.mm.pgd
|
2013-02-04 00:25:13 +00:00 |
|
|
atcuno
|
d57fc31fb1
|
Linux - add joes check evt arm patch
|
2013-01-29 01:05:51 +00:00 |
|
|
atcuno
|
b871fda79b
|
Linux - Add joes check syscall on ARM patch
|
2013-01-29 01:03:46 +00:00 |
|
|
atcuno
|
c9f9b9abc1
|
Linux - switch dump_map to zread
|
2013-01-22 05:59:19 +00:00 |
|
|
atcuno
|
6b0e737aef
|
Linux - make netstat inherit from pslist
|
2012-11-23 03:15:26 +00:00 |
|
|
atcuno
|
984f68dd88
|
Linux - change proc maps to table
|
2012-11-23 03:11:54 +00:00 |
|
|
atcuno
|
dff594ed3d
|
Linux - add joes plugins for detecting in-kernel keyloggers
|
2012-10-15 18:28:55 +00:00 |
|
|
atcuno
|
10d7e59428
|
Linux - fix psaux table formatting
|
2012-10-15 17:38:26 +00:00 |
|
|
atcuno
|
a97cc4b40f
|
Linux - fix bug report 352, improper distorm check
|
2012-10-15 17:16:52 +00:00 |
|
|
atcuno
|
509290364b
|
Linux - add group ID to pslist and psaux
|
2012-10-15 16:18:30 +00:00 |
|
|
mike.auty@gmail.com
|
49ec1e7a21
|
Minor pylint tidy up.
|
2012-10-14 01:00:31 +00:00 |
|
|
mike.auty@gmail.com
|
518294754d
|
Merge 2.3-devel into trunk.
|
2012-10-13 21:31:29 +00:00 |
|
|
iMHLv2
|
002a9a7e13
|
fix a linux command that uses @staticmethod to set config options...they carry through to windows commands
|
2012-09-29 22:22:58 +00:00 |
|
|
atcuno
|
26910f2ccc
|
Linux - bugfix - have route_cache walk the entire chain
|
2012-09-18 03:32:12 +00:00 |
|
|
atcuno
|
8ac0c534e7
|
Linux - bugfix - allow module sections to be printed from old kernels
|
2012-09-17 02:22:29 +00:00 |
|
|
atcuno
|
fc1ae9f29b
|
Linux - bugfix - protect against corrupt unallocated sk_buff structures
|
2012-09-17 01:27:20 +00:00 |
|
|
atcuno
|
05cb633d45
|
Linux - update mount_cache to work with 2.6.18
|
2012-09-17 00:55:46 +00:00 |
|
|
atcuno
|
1f611157a4
|
Linux - bugfix - update dentry_cache to support old cache name
|
2012-09-16 22:53:48 +00:00 |
|
|
atcuno
|
56736d1d7f
|
Linux - bugfix - update check_afinfo to support centos 2.6.18
|
2012-09-16 21:59:59 +00:00 |
|
|
atcuno
|
74a915194d
|
Linux - bugfix - update calculation of task start time to support 2.6.18 centos
|
2012-09-16 21:50:47 +00:00 |
|
|
atcuno
|
c26b9e534d
|
Linux - add the ability to specify a specific inode to check_fop
|
2012-09-12 23:03:24 +00:00 |
|
|
atcuno
|
48ff833f38
|
Linux - bugfix - make return values consistent in address_in_module
|
2012-09-12 18:28:50 +00:00 |
|
|
atcuno
|
4e8db59dc9
|
Linux - add table name column to check_syscall to differentiate between 32 and 64 bit
|
2012-09-12 00:54:58 +00:00 |
|
|
atcuno
|
cbdef36153
|
Linux - move radix tree and getting files into find_file and update tmpfs to use new code
|
2012-09-12 00:28:36 +00:00 |
|
|
iMHLv2
|
d9095a0c28
|
Linux - prevent messages like 'NoneObject as string: Invalid Address 0xFFFFA047A640, instantiating int' from being displayed with linux_lsmod -P option
|
2012-09-11 20:35:40 +00:00 |
|
|
iMHLv2
|
f1e4666e40
|
Linux - prevent a 'NoneObject as string: Pointer cred invalid' from being displayed in pstree output when analyzing a task_struct that are being deallocated or that started after insmod (i.e. the mm and cred pointers aren't valid
|
2012-09-11 20:16:44 +00:00 |
|
|
iMHLv2
|
af56d92f5e
|
Linux - change the 'What' column in check_afinfo and check_fop to 'Symbol Name'
|
2012-09-11 19:50:27 +00:00 |
|
|
atcuno
|
f4c765cb4e
|
Linux - ensure find_file does not follow invalid directories
|
2012-09-11 19:38:05 +00:00 |
|
|
iMHLv2
|
0ae2b04635
|
Linux - fix plugin description for linux_sk_buff
|
2012-09-11 19:02:26 +00:00 |
|
|
atcuno
|
565a8fda39
|
Linux - change .next to m.next in pkt_queues
|
2012-09-11 17:15:08 +00:00 |
|
|
iMHLv2
|
258f9983cc
|
Linux - add a missing import to sk_buff_cache
|
2012-09-10 23:29:56 +00:00 |
|
|
mike.auty@gmail.com
|
e139eece1a
|
Linux - Fix an error in common.py and shrink a function slightly.
|
2012-09-10 20:45:52 +00:00 |
|
|
atcuno
|
30d782dbd8
|
Linux - remove unnecesary TODOs and change some to FUTURE
|
2012-09-10 20:12:35 +00:00 |
|
|
atcuno
|
39150fc6b5
|
Linux - proc_maps remove an unneeded fixme
|
2012-09-10 20:07:06 +00:00 |
|
|
atcuno
|
fa98736e2a
|
Linux - further cleanup of common for verify_ops, change check_fop and check_afinfo to use
|
2012-09-10 19:40:59 +00:00 |
|
|
atcuno
|
add23cbc31
|
Linux - continue the cleanup of common, update pidhashtable and cpuinfo to reference new code locations
|
2012-09-10 19:12:19 +00:00 |
|
|
atcuno
|
60d3ac6ac4
|
Linux - make get_page_contents use zread
|
2012-09-10 18:52:26 +00:00 |
|
|
atcuno
|
84cab784ea
|
Linux - get rid of phys_addr_of_page for page overlay to_paddr
|
2012-09-10 18:11:53 +00:00 |
|
|
atcuno
|
2a3eb5b70c
|
Linux - remove old sparse code from common
|
2012-09-10 18:05:06 +00:00 |
|