 iMHLv2
|
d96cbdd0a2
|
update apihooks to detect JMP FAR instructions. contributed and tested on an SSDT root kit by Stewart McIntyre
|
2014-07-04 11:43:44 -05:00 |
|
|
Andrew C
|
32b4d762a2
|
Linux - update lsmod option to not conflict with linux_strings
|
2014-07-01 23:32:45 -05:00 |
|
|
Andrew C
|
29136e01d7
|
Linux - update malfind
|
2014-07-01 23:30:37 -05:00 |
|
|
Andrew C
|
da6b29ec3f
|
Mac - update dump_maps
|
2014-07-01 21:20:26 -05:00 |
|
|
Andrew C
|
e3fe3e5648
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2014-07-01 21:15:16 -05:00 |
|
|
Andrew C
|
263effcb54
|
Mac - update notesapp
|
2014-07-01 21:14:23 -05:00 |
|
|
Andrew C
|
e5e4d3698c
|
Mac - small update to netstat
|
2014-07-01 21:14:04 -05:00 |
|
|
gleeda
|
58ce54d3f1
|
small bug in cachedump. fixes issue #38
|
2014-07-01 15:46:05 -04:00 |
|
|
gleeda
|
3027478910
|
small bug in lsadump. fixes issue #39
|
2014-07-01 15:44:24 -04:00 |
|
|
gleeda
|
0b14a86955
|
removing trailing space
|
2014-07-01 15:00:54 -04:00 |
|
|
gleeda
|
c11111e582
|
vad_vtypes: adding current node to visited set before traversing children. see issue #37
|
2014-07-01 14:59:11 -04:00 |
|
|
iMHLv2
|
739f951a05
|
fixing svcscan for 8.1 and 2012 r2
|
2014-06-30 19:16:15 -05:00 |
|
|
iMHLv2
|
815157a817
|
add a --listhead option to timers in cases (esp win2003) where disasm fails to locate the list head
|
2014-06-27 20:46:08 -04:00 |
|
|
iMHLv2
|
825691eb32
|
fixes timers plugin on 8.1 and 2012 R2
|
2014-06-27 20:32:21 -04:00 |
|
|
iMHLv2
|
e916f99e57
|
fix the threads plugin to properly follow the --offset option
|
2014-06-27 19:44:32 -04:00 |
|
|
iMHLv2
|
68c40d3554
|
display possible dumpfiles filters in the --help menu
|
2014-06-27 19:28:59 -04:00 |
|
|
iMHLv2
|
9f33f7b383
|
prevent a stack trace in timers plugin when KiTimerTableListHead is not found
|
2014-06-27 19:24:50 -04:00 |
|
|
iMHLv2
|
eb2b7fe6f3
|
test bug check reason callback pointer validity
|
2014-06-27 19:14:36 -04:00 |
|
|
iMHLv2
|
7c87f84518
|
mask some warnings when enumerating imports
|
2014-06-27 12:42:30 -04:00 |
|
|
gleeda
|
d004afb5ab
|
extending the handle type column to accomodate handle types like WaitCompletionPacket
|
2014-06-26 16:58:12 -04:00 |
|
|
Andrew C
|
33f6bf2c33
|
Linux - update bash recovery to be much faster
|
2014-06-26 02:41:47 -05:00 |
|
|
Andrew C
|
19b9e690c0
|
Linux - update bash_env
|
2014-06-26 01:47:20 -05:00 |
|
|
gleeda
|
6f99735368
|
better error handling for lsadump/cachedump and hashdump
|
2014-06-26 11:07:28 -04:00 |
|
|
gleeda
|
ad6370a185
|
Merge branch 'master' of github.com:volatilityfoundation/volatility
|
2014-06-25 17:41:29 -04:00 |
|
|
gleeda
|
975165cc58
|
adding a 32bit pointer object. we need this in order to use 32bit pointers on 64bit systems
|
2014-06-25 17:39:50 -04:00 |
|
|
Andrew C
|
fb2a813e2d
|
Linux - fix bug in linux_process_hollow
|
2014-06-25 16:27:00 -05:00 |
|
|
Andrew C
|
9e4b28e065
|
Linux - update pkt quues to new netstat interface
|
2014-06-25 16:24:49 -05:00 |
|
|
Andrew C
|
025244f23e
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2014-06-25 16:21:39 -05:00 |
|
|
Andrew C
|
022c5da77e
|
Linux - remove debug print from ldrmodules
|
2014-06-25 16:21:25 -05:00 |
|
|
gleeda
|
bf86239480
|
adding xlsx output to psxview
|
2014-06-25 15:06:53 -04:00 |
|
|
gleeda
|
e91ab21744
|
checking if adsname is None
|
2014-06-24 16:06:11 -04:00 |
|
|
Andrew C
|
b39b656578
|
Linux - update enumerate_files
|
2014-06-16 03:16:03 -05:00 |
|
|
iMHLv2
|
fb5e2ea3f6
|
apply an overlay for _POOL_TRACKER_BIG_PAGES.Key
|
2014-06-22 12:42:16 -05:00 |
|
|
iMHLv2
|
01ba02a2b6
|
refs #34 update hivescan for 8.1/2012R2 x64
|
2014-06-21 21:37:39 -05:00 |
|
|
iMHLv2
|
632f8c5901
|
add the big pools plugin - book reference and also for finding CM10 on 8.1/2012R2 x64
|
2014-06-21 20:40:08 -05:00 |
|
|
iMHLv2
|
33c8261371
|
raw2dmp update: write the decoded KDBG block so windbg can interpret it properly
|
2014-06-21 10:25:59 -05:00 |
|
|
iMHLv2
|
dfc6533a39
|
fix two bugs in raw2dmp after the win8/2012 kdbg changes
|
2014-06-21 10:00:10 -05:00 |
|
|
iMHLv2
|
b3d64aff1c
|
enhance debug output for image copy errors
|
2014-06-21 09:48:59 -05:00 |
|
|
iMHLv2
|
6860c06c27
|
add a majority of types needed for gui subsystem plugins on windows 8/8.1
|
2014-06-20 23:48:19 -05:00 |
|
|
iMHLv2
|
0e695be0b6
|
remove the profile restriction from event hooks
|
2014-06-20 23:47:13 -05:00 |
|
|
iMHLv2
|
4468d32307
|
lift the profile restriction from clipboard and user handles
|
2014-06-20 22:46:11 -05:00 |
|
|
iMHLv2
|
9a14a95719
|
update the win32k_core for finding gahti on win8
|
2014-06-20 22:26:13 -05:00 |
|
|
iMHLv2
|
d5c3159076
|
remove the profile restriction on win8/2012 from atoms/gahti/wndscan plugins
|
2014-06-20 22:25:43 -05:00 |
|
|
iMHLv2
|
54b9ba552e
|
fixing a bug in atoms
|
2014-06-20 20:04:36 -05:00 |
|
|
iMHLv2
|
c45d108ed7
|
errant offset in tagCLIP data structure for windows 7
|
2014-06-20 18:36:25 -05:00 |
|
|
iMHLv2
|
e7612c1baf
|
override is_valid_profile for vmwareinfo since its applies to linux/mac
|
2014-06-20 13:31:48 -05:00 |
|
|
iMHLv2
|
4a1fb10e61
|
update error message when pe dumping plugins fail
|
2014-06-19 19:27:56 -05:00 |
|
|
iMHLv2
|
566521e151
|
closes #4 add default arg parameters to get_image and get_sections
|
2014-06-19 18:58:25 -05:00 |
|
|
iMHLv2
|
8b4ed02f00
|
closes #12 fix backtrace on enumerating desktop threads with psxview in win8/2012
|
2014-06-19 18:33:32 -05:00 |
|
|
iMHLv2
|
9a9815c9e7
|
closes #9 remove the CR dependency on vmware metadata files
|
2014-06-19 16:45:44 -05:00 |
|