 iMHLv2
|
0cc8f8e4df
|
move the linux_common.get_partial_path() function to a dentry object class method
|
2013-02-19 20:52:38 +00:00 |
|
|
iMHLv2
|
a6a72d898b
|
some whitespace in linux_tmpfs
|
2013-02-19 20:06:57 +00:00 |
|
|
iMHLv2
|
4f7e22430b
|
remove the linux_common.S_ISREG and linux_common.S_ISDIR functions. replace them with an inode object class that has is_dir() and is_reg() methods
|
2013-02-19 20:05:32 +00:00 |
|
|
iMHLv2
|
300739da35
|
remove the deprecated walk_list_head() function from linux common
|
2013-02-19 19:54:45 +00:00 |
|
|
iMHLv2
|
49d57f9ae0
|
move online_cpus, get_per_cpu_symbol, and walk_per_cpu_var from AbstractLinuxCommand into linux_cpuinfo
|
2013-02-19 18:04:31 +00:00 |
|
|
iMHLv2
|
8ed0c4bdbc
|
move the linux get_task_start_time() API out of AbstractLinuxCommand - put it in the task_struct object class
|
2013-02-19 17:58:44 +00:00 |
|
|
iMHLv2
|
885087f009
|
remove the unnecessary AbstractLinuxCommand.get_profile_symbol(). plugins now call directly to the API
|
2013-02-19 17:44:04 +00:00 |
|
|
iMHLv2
|
0af575492f
|
replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead
|
2013-02-19 17:42:25 +00:00 |
|
|
iMHLv2
|
f28cf51411
|
fix some whitespace in linux_find_file
|
2013-02-13 21:36:27 +00:00 |
|
|
iMHLv2
|
5978db698a
|
fix a bug in linux_tmpfs, introduced after 2.2 when we converted the 'name' variable to a simple character buffer into a volatility String object. spotted by Sebastien Bourdon-Richard
|
2013-02-13 01:56:41 +00:00 |
|
|
iMHLv2
|
1e8e2d4ecd
|
the metadata memory_model value can be directly assigned to table_name in linux_check_syscall
|
2013-02-12 20:50:39 +00:00 |
|
|
iMHLv2
|
6e6a9f7fdc
|
we dont need the mask value in linux_check_syscalls if we switch from long to unsigned long
|
2013-02-12 20:47:53 +00:00 |
|
|
iMHLv2
|
1f48e304e7
|
remove unnecessary import from proc_maps
|
2013-02-12 20:44:10 +00:00 |
|
|
iMHLv2
|
728a6a21d3
|
some whitespace in proc_maps
|
2013-02-12 20:43:10 +00:00 |
|
|
iMHLv2
|
1fa8f1800d
|
we don't need to create a new super_block object in linux_proc_maps, we can leverage the auto-dereference capability when just accessing the inode.i_sb attribute
|
2013-02-12 20:40:56 +00:00 |
|
|
iMHLv2
|
27f6029040
|
create a super_block object class with 'major' and 'minor' properties
|
2013-02-12 20:37:54 +00:00 |
|
|
iMHLv2
|
2e5ebc6120
|
create a Flags object for handling rwx, r-x style output for linux, instead of using the format_perms() method attached to a specific plugin
|
2013-02-12 20:27:29 +00:00 |
|
|
iMHLv2
|
ffd749a839
|
remove the mask_number() method from linux_proc_maps, its no longer needed
|
2013-02-12 19:35:38 +00:00 |
|
|
iMHLv2
|
ebf0a9903f
|
some whitespace in linux_check_syscall_arm
|
2013-02-05 20:08:55 +00:00 |
|
|
iMHLv2
|
7185d06827
|
some whitespace in linux_check_evt_arm
|
2013-02-05 20:08:00 +00:00 |
|
|
iMHLv2
|
7cbab87f06
|
move the plugin description for linux_check_evt_arm to proper place for pydoc
|
2013-02-05 20:05:06 +00:00 |
|
|
iMHLv2
|
3cd0e2c881
|
add the linux_moddump plugin
|
2013-02-05 20:02:31 +00:00 |
|
|
iMHLv2
|
8932135e0f
|
add the linux yarascan plugin
|
2013-02-05 15:53:57 +00:00 |
|
|
iMHLv2
|
ee0ac2406a
|
change the Pgoff column in linux_proc_maps to [addr] instead of decimal 6-char width
|
2013-02-05 04:51:13 +00:00 |
|
|
atcuno
|
dd44c49f8e
|
Linux - update proc_maps interface and add search_process_memory
|
2013-02-05 03:15:37 +00:00 |
|
|
iMHLv2
|
6a0a1c603b
|
add an initial mac_volshell plugin
|
2013-02-04 15:15:05 +00:00 |
|
|
iMHLv2
|
e65c61bf20
|
refactor linux_volshell to share more code with the existing windows volshell command
|
2013-02-04 14:32:04 +00:00 |
|
|
iMHLv2
|
8eb611679c
|
fix a bug in the new dtb printing column for linux_pslist
|
2013-02-04 04:19:22 +00:00 |
|
|
iMHLv2
|
608efd4e7a
|
add a linux_volshell command. as stated in the plugin, there is massive code duplicate, because the windows volshell is not written in an inheritance friendly manner. at the moment, we accept this risk in favor of functionality - being able to db/dd/dq/dis/dt/cc interactively on linux memory images
|
2013-02-04 00:42:14 +00:00 |
|
|
iMHLv2
|
14a5d6e05a
|
show the process DTB in linux_pslist, from task_struct.mm.pgd
|
2013-02-04 00:25:13 +00:00 |
|
|
atcuno
|
d57fc31fb1
|
Linux - add joes check evt arm patch
|
2013-01-29 01:05:51 +00:00 |
|
|
atcuno
|
b871fda79b
|
Linux - Add joes check syscall on ARM patch
|
2013-01-29 01:03:46 +00:00 |
|
|
atcuno
|
c9f9b9abc1
|
Linux - switch dump_map to zread
|
2013-01-22 05:59:19 +00:00 |
|
|
atcuno
|
6b0e737aef
|
Linux - make netstat inherit from pslist
|
2012-11-23 03:15:26 +00:00 |
|
|
atcuno
|
984f68dd88
|
Linux - change proc maps to table
|
2012-11-23 03:11:54 +00:00 |
|
|
atcuno
|
dff594ed3d
|
Linux - add joes plugins for detecting in-kernel keyloggers
|
2012-10-15 18:28:55 +00:00 |
|
|
atcuno
|
10d7e59428
|
Linux - fix psaux table formatting
|
2012-10-15 17:38:26 +00:00 |
|
|
atcuno
|
a97cc4b40f
|
Linux - fix bug report 352, improper distorm check
|
2012-10-15 17:16:52 +00:00 |
|
|
atcuno
|
509290364b
|
Linux - add group ID to pslist and psaux
|
2012-10-15 16:18:30 +00:00 |
|
|
mike.auty@gmail.com
|
49ec1e7a21
|
Minor pylint tidy up.
|
2012-10-14 01:00:31 +00:00 |
|
|
mike.auty@gmail.com
|
518294754d
|
Merge 2.3-devel into trunk.
|
2012-10-13 21:31:29 +00:00 |
|
|
iMHLv2
|
002a9a7e13
|
fix a linux command that uses @staticmethod to set config options...they carry through to windows commands
|
2012-09-29 22:22:58 +00:00 |
|
|
atcuno
|
26910f2ccc
|
Linux - bugfix - have route_cache walk the entire chain
|
2012-09-18 03:32:12 +00:00 |
|
|
atcuno
|
8ac0c534e7
|
Linux - bugfix - allow module sections to be printed from old kernels
|
2012-09-17 02:22:29 +00:00 |
|
|
atcuno
|
fc1ae9f29b
|
Linux - bugfix - protect against corrupt unallocated sk_buff structures
|
2012-09-17 01:27:20 +00:00 |
|
|
atcuno
|
05cb633d45
|
Linux - update mount_cache to work with 2.6.18
|
2012-09-17 00:55:46 +00:00 |
|
|
atcuno
|
1f611157a4
|
Linux - bugfix - update dentry_cache to support old cache name
|
2012-09-16 22:53:48 +00:00 |
|
|
atcuno
|
56736d1d7f
|
Linux - bugfix - update check_afinfo to support centos 2.6.18
|
2012-09-16 21:59:59 +00:00 |
|
|
atcuno
|
74a915194d
|
Linux - bugfix - update calculation of task start time to support 2.6.18 centos
|
2012-09-16 21:50:47 +00:00 |
|
|
atcuno
|
c26b9e534d
|
Linux - add the ability to specify a specific inode to check_fop
|
2012-09-12 23:03:24 +00:00 |
|