 mike.auty@gmail.com
|
5dfdff5570
|
Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.
|
2012-03-15 22:35:56 +00:00 |
|
|
mike.auty@gmail.com
|
188e6a6cfa
|
Revert "Add in pointer to pointer64 fix from pdbparse."
This reverts commit b8d85f88000660f2b405f37bcdff20bfbaa1dda1.
|
2012-03-15 21:33:12 +00:00 |
|
|
mike.auty@gmail.com
|
0c1fbd0230
|
Add in pointer to pointer64 fix from pdbparse.
|
2012-03-15 20:17:55 +00:00 |
|
|
iMHLv2
|
d352ffdf7f
|
add a get_token() method to _EPROCESS. add a _TOKEN object class with get_sids() method. modify the getsids.py plugin to use these new APIs. the _TOKEN object class will later be subclassed in the Vista profile when we add the privileges plugin. also adds sanity checks to _TOKEN objects and thus Fixes Issue #176.
|
2012-03-13 15:06:02 +00:00 |
|
|
mike.auty@gmail.com
|
0b51110890
|
Add in pointer64 fixes from pdbparse r67.
|
2012-03-13 01:49:20 +00:00 |
|
|
mike.auty@gmail.com
|
2be490ec92
|
Deprecate instantiating _MMVAD objects in the wrong address space. Use _EPROCESS.get_vads instead.
|
2012-03-13 01:32:08 +00:00 |
|
|
iMHLv2
|
4c2bd45cff
|
add driverirp plugin to devicetree.py file. checks for inline hooks of IRP functions will return after the ApiHooks plugin is committed. fixes issue #232.
|
2012-03-13 01:17:14 +00:00 |
|
|
mike.auty@gmail.com
|
3a26c25c0c
|
Fix up pointer arrays generated by a pdbparse that was set to parse pdbs for 32-bit systems.
|
2012-03-13 00:54:06 +00:00 |
|
|
mike.auty@gmail.com
|
f02e418c83
|
Restore call to parent __str__ to avoid recursive loop.
|
2012-03-13 00:35:36 +00:00 |
|
|
iMHLv2
|
8561e48e70
|
add psxview plugin for x86 and x64 windows. fixes issue #231
|
2012-03-12 00:57:13 +00:00 |
|
|
iMHLv2
|
2b7a65ddb5
|
replace raise StopIteration with return in callbacks.py, per scudette's recommedation - thanks.
|
2012-03-12 00:46:02 +00:00 |
|
|
mike.auty@gmail.com
|
e5c2571bf7
|
Ensure writes to ctype members don't raise an exception even after they succeeded.
|
2012-03-12 00:20:21 +00:00 |
|
|
mike.auty@gmail.com
|
883e05d96c
|
Enable individual writing of array elements.
|
2012-03-12 00:20:08 +00:00 |
|
|
mike.auty@gmail.com
|
f9326d1619
|
Fix up array indexing to accept negative positions.
|
2012-03-12 00:20:02 +00:00 |
|
|
mike.auty@gmail.com
|
dea4d32a9f
|
Fix up some small pylint errors.
|
2012-03-11 23:49:52 +00:00 |
|
|
mike.auty@gmail.com
|
c231468059
|
Make name a proper dependable member of all Address Spaces.
|
2012-03-11 23:32:32 +00:00 |
|
|
mike.auty@gmail.com
|
355dd280f3
|
Get rid of try/except for determining attribute presence.
|
2012-03-11 21:16:06 +00:00 |
|
|
mike.auty@gmail.com
|
95829672d5
|
Make sure we only use the appropriate bits from the DTB.
|
2012-03-11 19:58:19 +00:00 |
|
|
mike.auty@gmail.com
|
ce65efe00d
|
Restore is_utc that was lost in r565.
Fixes issue 218. Thanks to Jesse K for spotting the omission.
|
2012-03-10 22:44:39 +00:00 |
|
|
iMHLv2
|
35a8d1cfbd
|
add MAJOR_FUNCTIONS constants to devicetree.py, fix import statement in callbacks.py. later a driverirp plugin will be added to devicetree.py that also uses MAJOR_FUNCTIONS
|
2012-03-10 21:52:28 +00:00 |
|
|
iMHLv2
|
d809b6bafc
|
add callbacks.py and timers.py plugins. fixes issue #228. fixes issue #229.
|
2012-03-09 21:36:46 +00:00 |
|
|
mike.auty@gmail.com
|
0cc73c158d
|
Move registering global options to a helper function in volatility.registry.
|
2012-03-09 15:19:07 +00:00 |
|
|
iMHLv2
|
7b08839a37
|
add devicetree plugin to core - volatility/plugins/devicetree.py. fixes Issue #226.
|
2012-03-09 14:19:48 +00:00 |
|
|
mike.auty@gmail.com
|
e5aa86d908
|
Merge branch 'local/noregistry' into local/trunk
|
2012-03-08 23:39:19 +00:00 |
|
|
mike.auty@gmail.com
|
74293f8b06
|
Add in None default for PluginImporter.
|
2012-03-08 22:41:34 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
iMHLv2
|
e032b38ee8
|
make a future home for malware plugins in volatility/plugins/malware
|
2012-03-08 19:25:21 +00:00 |
|
|
iMHLv2
|
d3ec1f8ddc
|
move the access string code from FileScan.render_text into windows.FILE_OBJECT. Fixes Issue #225
|
2012-03-07 13:32:02 +00:00 |
|
|
mike.auty@gmail.com
|
691738f55d
|
Add in slight fix when using the deprecated add_types function, since merge_overlays can't merge a raw vtypes dictionary.
|
2012-03-05 22:10:14 +00:00 |
|
|
iMHLv2
|
4fc6403c0d
|
rename win2k3_* files to win2003* in support of changes made in r1483 to r1485
|
2012-03-02 21:21:15 +00:00 |
|
|
mike.auty@gmail.com
|
17aab084a3
|
Add in the correct docsting for windows 2008 R2.
|
2012-03-01 22:33:00 +00:00 |
|
|
mike.auty@gmail.com
|
abd87e03dd
|
Finish up removing 2k3 abbreviations.
|
2012-02-29 21:07:45 +00:00 |
|
|
mike.auty@gmail.com
|
b4efaf6d2b
|
Change 2K3 and 2K8 abbreviations to the full 2003, 2008. Fixes issue 222.
|
2012-02-29 21:05:43 +00:00 |
|
|
mike.auty@gmail.com
|
ee1ff54775
|
Add in Windows 2008 R2 profiles to avoid confusing users. This fixes
issue 221."
|
2012-02-29 20:58:38 +00:00 |
|
|
mike.auty@gmail.com
|
20acde45bd
|
Add in abstract function for ProfileModifications, to make the code more explicit.
|
2012-02-29 20:58:30 +00:00 |
|
|
mike.auty@gmail.com
|
4ae458e160
|
Remove all unnecessary trailing slashes.
|
2012-02-26 23:26:52 +00:00 |
|
|
mike.auty@gmail.com
|
beb854441f
|
Remove unnecessary comments from kdbgscan.
|
2012-02-26 22:55:03 +00:00 |
|
|
iMHLv2
|
8836dc23ff
|
change max fast refs for _EX_FAST_REF object on x64. fixes Issue #219
|
2012-02-25 16:26:59 +00:00 |
|
|
mike.auty@gmail.com
|
28868d27fd
|
Remove pointless Abstract checks, given that utils.load_as will not attempt to instantiate classes starting Abstract.
|
2012-02-24 22:16:11 +00:00 |
|
|
mike.auty@gmail.com
|
4fca0cd661
|
Add zread to the AddressSpaces API. See issue 57.
|
2012-02-24 21:59:04 +00:00 |
|
|
iMHLv2
|
2fb6316f03
|
remove the temporary patch applied in r1457. in the object parent loop, use obj_type instead of obj_name. fixes issue #216.
|
2012-02-22 14:39:55 +00:00 |
|
|
iMHLv2
|
fedf32fd7a
|
expose BaseObject._vol_theType through BaseObject.obj_type. see issue #216
|
2012-02-22 14:35:18 +00:00 |
|
|
iMHLv2
|
54a138eaf8
|
patch windows._MMVAD to fix the -o parameter to vadinfo (see issue #216), a bug introduced in r1195
|
2012-02-21 14:34:51 +00:00 |
|
|
mike.auty@gmail.com
|
a5c61cf540
|
Add in better coments regarding the profile cyclic dependency.
|
2012-02-20 22:47:38 +00:00 |
|
|
mike.auty@gmail.com
|
16580f567e
|
Remove the old handmade KGDTENTRY vtypes. Fixes issue 211.
|
2012-02-18 11:01:17 +00:00 |
|
|
mike.auty@gmail.com
|
e3e089b096
|
Merge the newprofile branch into trunk.
|
2012-02-18 10:33:47 +00:00 |
|
|
mike.auty@gmail.com
|
3285e6d6b6
|
Disable caching by default, it must now be explicitly enabled using --cache. Fixes issue 206.
|
2012-02-15 20:50:27 +00:00 |
|
|
iMHLv2
|
5c6c0b7bda
|
move some of the per-profile guess work done in taskmods.py into object classes
|
2012-02-14 17:35:03 +00:00 |
|
|
mike.auty@gmail.com
|
9bc7fd329a
|
Checks that the output from UNICODE_STRING is actually a string. Fixes issue 196.
|
2012-02-12 22:00:57 +00:00 |
|
|
iMHLv2
|
8a8e423ef1
|
modify thrdscan to instantiate ETHREAD objects with native_vm
|
2012-02-11 20:37:42 +00:00 |
|