 mike.auty@gmail.com
|
5dfdff5570
|
Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.
|
2012-03-15 22:35:56 +00:00 |
|
|
mike.auty@gmail.com
|
188e6a6cfa
|
Revert "Add in pointer to pointer64 fix from pdbparse."
This reverts commit b8d85f88000660f2b405f37bcdff20bfbaa1dda1.
|
2012-03-15 21:33:12 +00:00 |
|
|
mike.auty@gmail.com
|
0c1fbd0230
|
Add in pointer to pointer64 fix from pdbparse.
|
2012-03-15 20:17:55 +00:00 |
|
|
iMHLv2
|
d352ffdf7f
|
add a get_token() method to _EPROCESS. add a _TOKEN object class with get_sids() method. modify the getsids.py plugin to use these new APIs. the _TOKEN object class will later be subclassed in the Vista profile when we add the privileges plugin. also adds sanity checks to _TOKEN objects and thus Fixes Issue #176.
|
2012-03-13 15:06:02 +00:00 |
|
|
mike.auty@gmail.com
|
0b51110890
|
Add in pointer64 fixes from pdbparse r67.
|
2012-03-13 01:49:20 +00:00 |
|
|
mike.auty@gmail.com
|
2be490ec92
|
Deprecate instantiating _MMVAD objects in the wrong address space. Use _EPROCESS.get_vads instead.
|
2012-03-13 01:32:08 +00:00 |
|
|
iMHLv2
|
4c2bd45cff
|
add driverirp plugin to devicetree.py file. checks for inline hooks of IRP functions will return after the ApiHooks plugin is committed. fixes issue #232.
|
2012-03-13 01:17:14 +00:00 |
|
|
mike.auty@gmail.com
|
3a26c25c0c
|
Fix up pointer arrays generated by a pdbparse that was set to parse pdbs for 32-bit systems.
|
2012-03-13 00:54:06 +00:00 |
|
|
iMHLv2
|
8561e48e70
|
add psxview plugin for x86 and x64 windows. fixes issue #231
|
2012-03-12 00:57:13 +00:00 |
|
|
iMHLv2
|
2b7a65ddb5
|
replace raise StopIteration with return in callbacks.py, per scudette's recommedation - thanks.
|
2012-03-12 00:46:02 +00:00 |
|
|
mike.auty@gmail.com
|
355dd280f3
|
Get rid of try/except for determining attribute presence.
|
2012-03-11 21:16:06 +00:00 |
|
|
mike.auty@gmail.com
|
95829672d5
|
Make sure we only use the appropriate bits from the DTB.
|
2012-03-11 19:58:19 +00:00 |
|
|
mike.auty@gmail.com
|
ce65efe00d
|
Restore is_utc that was lost in r565.
Fixes issue 218. Thanks to Jesse K for spotting the omission.
|
2012-03-10 22:44:39 +00:00 |
|
|
iMHLv2
|
35a8d1cfbd
|
add MAJOR_FUNCTIONS constants to devicetree.py, fix import statement in callbacks.py. later a driverirp plugin will be added to devicetree.py that also uses MAJOR_FUNCTIONS
|
2012-03-10 21:52:28 +00:00 |
|
|
iMHLv2
|
d809b6bafc
|
add callbacks.py and timers.py plugins. fixes issue #228. fixes issue #229.
|
2012-03-09 21:36:46 +00:00 |
|
|
iMHLv2
|
7b08839a37
|
add devicetree plugin to core - volatility/plugins/devicetree.py. fixes Issue #226.
|
2012-03-09 14:19:48 +00:00 |
|
|
mike.auty@gmail.com
|
e5aa86d908
|
Merge branch 'local/noregistry' into local/trunk
|
2012-03-08 23:39:19 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
iMHLv2
|
e032b38ee8
|
make a future home for malware plugins in volatility/plugins/malware
|
2012-03-08 19:25:21 +00:00 |
|
|
iMHLv2
|
d3ec1f8ddc
|
move the access string code from FileScan.render_text into windows.FILE_OBJECT. Fixes Issue #225
|
2012-03-07 13:32:02 +00:00 |
|
|
iMHLv2
|
4fc6403c0d
|
rename win2k3_* files to win2003* in support of changes made in r1483 to r1485
|
2012-03-02 21:21:15 +00:00 |
|
|
mike.auty@gmail.com
|
17aab084a3
|
Add in the correct docsting for windows 2008 R2.
|
2012-03-01 22:33:00 +00:00 |
|
|
mike.auty@gmail.com
|
abd87e03dd
|
Finish up removing 2k3 abbreviations.
|
2012-02-29 21:07:45 +00:00 |
|
|
mike.auty@gmail.com
|
b4efaf6d2b
|
Change 2K3 and 2K8 abbreviations to the full 2003, 2008. Fixes issue 222.
|
2012-02-29 21:05:43 +00:00 |
|
|
mike.auty@gmail.com
|
ee1ff54775
|
Add in Windows 2008 R2 profiles to avoid confusing users. This fixes
issue 221."
|
2012-02-29 20:58:38 +00:00 |
|
|
mike.auty@gmail.com
|
4ae458e160
|
Remove all unnecessary trailing slashes.
|
2012-02-26 23:26:52 +00:00 |
|
|
mike.auty@gmail.com
|
beb854441f
|
Remove unnecessary comments from kdbgscan.
|
2012-02-26 22:55:03 +00:00 |
|
|
iMHLv2
|
8836dc23ff
|
change max fast refs for _EX_FAST_REF object on x64. fixes Issue #219
|
2012-02-25 16:26:59 +00:00 |
|
|
mike.auty@gmail.com
|
28868d27fd
|
Remove pointless Abstract checks, given that utils.load_as will not attempt to instantiate classes starting Abstract.
|
2012-02-24 22:16:11 +00:00 |
|
|
mike.auty@gmail.com
|
4fca0cd661
|
Add zread to the AddressSpaces API. See issue 57.
|
2012-02-24 21:59:04 +00:00 |
|
|
iMHLv2
|
2fb6316f03
|
remove the temporary patch applied in r1457. in the object parent loop, use obj_type instead of obj_name. fixes issue #216.
|
2012-02-22 14:39:55 +00:00 |
|
|
iMHLv2
|
54a138eaf8
|
patch windows._MMVAD to fix the -o parameter to vadinfo (see issue #216), a bug introduced in r1195
|
2012-02-21 14:34:51 +00:00 |
|
|
mike.auty@gmail.com
|
16580f567e
|
Remove the old handmade KGDTENTRY vtypes. Fixes issue 211.
|
2012-02-18 11:01:17 +00:00 |
|
|
mike.auty@gmail.com
|
e3e089b096
|
Merge the newprofile branch into trunk.
|
2012-02-18 10:33:47 +00:00 |
|
|
iMHLv2
|
5c6c0b7bda
|
move some of the per-profile guess work done in taskmods.py into object classes
|
2012-02-14 17:35:03 +00:00 |
|
|
mike.auty@gmail.com
|
9bc7fd329a
|
Checks that the output from UNICODE_STRING is actually a string. Fixes issue 196.
|
2012-02-12 22:00:57 +00:00 |
|
|
iMHLv2
|
8a8e423ef1
|
modify thrdscan to instantiate ETHREAD objects with native_vm
|
2012-02-11 20:37:42 +00:00 |
|
|
mike.auty@gmail.com
|
9b8b5c2bec
|
Restore the KPCR automatic search alogrithms removed in error as part of r1282.
|
2012-02-10 22:16:17 +00:00 |
|
|
mike.auty@gmail.com
|
a00966c887
|
Complete the fix, as patiently pointed out by Philippe Teuwen, thanks! 5:)
|
2012-02-09 23:20:05 +00:00 |
|
|
mike.auty@gmail.com
|
fac8e2286b
|
Fix up an off-by-one truncation bug in FileAddressSpace as discovered by Philippe Teuwen.
|
2012-02-09 20:41:31 +00:00 |
|
|
mike.auty@gmail.com
|
dae5774a0b
|
Add in a more elegant check pointed out by Philippe Teuwen rather than defining and then deleting the EWF address space class.
|
2012-02-08 22:21:38 +00:00 |
|
|
mike.auty@gmail.com
|
18f3c0e487
|
Fix volshell breakage since the move to obj_offset.
|
2012-02-06 15:56:08 +00:00 |
|
|
mike.auty@gmail.com
|
8e213fcae8
|
Pylint fix for plugins not everyone uses.
|
2012-02-06 11:24:10 +00:00 |
|
|
mike.auty@gmail.com
|
d649b5b9b0
|
Fix inconsistency in commands.command class capitalization.
|
2012-02-05 23:36:33 +00:00 |
|
|
mike.auty@gmail.com
|
db4eb63085
|
Fix up docstring for MultiStringFinderCheck.
|
2012-02-04 11:32:18 +00:00 |
|
|
iMHLv2
|
ab57801331
|
fix hivescan after the preamble patch. in the process, remove the hard-coded 4 and unnecessary pool alignment stuff
|
2012-02-02 20:01:46 +00:00 |
|
|
iMHLv2
|
2ba91bf443
|
modify ssdt.py for x64 support. fixes issue #189
|
2012-02-02 04:22:39 +00:00 |
|
|
iMHLv2
|
c1d662cadc
|
clean up the way AS's are used in netscan, now that we have native_vm. fixes issue #200
|
2012-02-02 04:09:38 +00:00 |
|
|
iMHLv2
|
efbbf8b6fc
|
fix the modscan plugin after the preamble patch in r1324
|
2012-02-02 01:02:53 +00:00 |
|
|
iMHLv2
|
0587f77192
|
fix pool scanners in netscan plugin after the preamble patch in r1324
|
2012-02-02 00:53:40 +00:00 |
|