 iMHLv2
|
8bd862b2aa
|
fix a UnicodeEncodeError when dlldump prints module names
|
2012-07-07 23:24:27 +00:00 |
|
|
mike.auty@gmail.com
|
ecd60b4767
|
Include malware in the python setup sections.
|
2012-07-07 19:26:43 +00:00 |
|
|
mike.auty@gmail.com
|
33cbf31032
|
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
|
2012-07-07 19:19:58 +00:00 |
|
|
mike.auty@gmail.com
|
6887750a98
|
Print the reason for a NoneObject in the NoneObject representation itself.
|
2012-07-01 16:27:17 +00:00 |
|
|
mike.auty@gmail.com
|
18a6841950
|
Ensure NoneObjects always display as strings, no matter the input format code.
|
2012-07-01 16:27:09 +00:00 |
|
|
iMHLv2
|
f2b24da4d9
|
tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278
|
2012-06-28 19:09:18 +00:00 |
|
|
iMHLv2
|
d6e2136a61
|
small tweak to what ldrmodules considers a mapped file, for better detection of stuxnet and other malware that could possibly overwrite the vad's FileName after loading
|
2012-06-28 15:25:45 +00:00 |
|
|
iMHLv2
|
0c70e45b66
|
use the MaxAddress volatility magic in yarascan
|
2012-06-28 13:52:54 +00:00 |
|
|
iMHLv2
|
a989a170ef
|
fix a bug in vaddump and introduce a VolMagic for getting the maximum address in an AS based on the size of a native addr
|
2012-06-28 13:36:48 +00:00 |
|
|
iMHLv2
|
74c678989a
|
the Limit column of GDT plugin should be addrpad
|
2012-06-25 20:39:38 +00:00 |
|
|
iMHLv2
|
6c91c521d1
|
apply Ikelos' patch for adding a format_value method to commands. use it in vaddump to properly format file names for x86 and x64 addresses
|
2012-06-25 19:54:44 +00:00 |
|
|
iMHLv2
|
b0fc9fab2e
|
fix a bitmasking issue with GDT 32-bit callgate address calculation. also make the Limit field for callgates 0 instead of a dash or it'll encounter a formatting bug when trying to print as hex
|
2012-06-25 19:18:14 +00:00 |
|
|
mike.auty@gmail.com
|
d2b99f97a0
|
Move hivedump to the printkey module, since it prints registry data, rather than having anything to do with crypto. Fixes issue 276.
|
2012-06-25 18:59:25 +00:00 |
|
|
iMHLv2
|
143e73a47d
|
the gdt selector column should be displayed as hex
|
2012-06-25 18:57:13 +00:00 |
|
|
iMHLv2
|
5a719d134d
|
bring back two components of the idt plugin output which was present in 2.0: print the PE section name of the IDT function and allow disasm of code when --verbose is enabled
|
2012-06-25 18:43:02 +00:00 |
|
|
iMHLv2
|
7572475254
|
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
|
2012-06-24 19:34:44 +00:00 |
|
|
iMHLv2
|
2c52ee66f6
|
bring back the -v option to driverirp that prints a disasm of each function (was in 2.0 version of the plugin from malware.py)
|
2012-06-23 22:59:11 +00:00 |
|
|
iMHLv2
|
9e0525da35
|
add a description to apihooks plugin
|
2012-06-23 05:44:45 +00:00 |
|
|
iMHLv2
|
ddf9de9edc
|
add apihooks plugin (x86) for IAT, EAT, Inline hooks in user and kernel mode, plus winsock proc table hooks (new), calls to unknown code pages (kernel), and ntdll syscall hooks
|
2012-06-21 14:26:48 +00:00 |
|
|
iMHLv2
|
3292d8e67b
|
add impscan plugin for x86 and x64
|
2012-06-18 16:06:11 +00:00 |
|
|
iMHLv2
|
f46a772538
|
the task_info dictionary in pstree is unnecessary
|
2012-06-18 15:07:54 +00:00 |
|
|
iMHLv2
|
cc2037ffe9
|
kpcrscan is more verbose now
|
2012-06-18 14:34:14 +00:00 |
|
|
mike.auty@gmail.com
|
9687a7484e
|
Fixes issue 273.
|
2012-06-15 22:36:07 +00:00 |
|
|
iMHLv2
|
b092cee309
|
convert pstree to ikelos' new table format
|
2012-06-13 16:17:08 +00:00 |
|
|
iMHLv2
|
696f9e1c59
|
fix the circular references bug in pstree. fixes Issue #239
|
2012-06-13 15:52:02 +00:00 |
|
|
iMHLv2
|
37c0703cbe
|
use a ProfileModification to apply the _SE_AUDIT_PROCESS_CREATION_INFO and _OBJECT_NAME_INFORMATION vtypes in pstree, to avoid the Deprecation warning from using profile.add_types
|
2012-06-13 15:33:30 +00:00 |
|
|
iMHLv2
|
801a51c745
|
fix the verbose > 1 check in pstree per issue #239
|
2012-06-13 15:22:10 +00:00 |
|
|
iMHLv2
|
fd035d1677
|
fix a bug from r1866 when kdbgscan is used with no profile
|
2012-06-13 15:00:37 +00:00 |
|
|
iMHLv2
|
b0bd25c6c2
|
kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268
|
2012-06-12 22:49:32 +00:00 |
|
|
iMHLv2
|
65f15dd893
|
fix a mis-understanding of the cases in which kpcrscan can serve as a backup for finding KDBG. in short, we iterate through the volmagic suggestions instead of accepting the first/best suggestion. for more details, please see issue #269. Fixes Issue #269.
|
2012-06-12 15:47:15 +00:00 |
|
|
iMHLv2
|
ed22db8c61
|
per request, avoid changing the number of variables yielded by IDT.calculate() and GDT.calculate() just to access the associated KPCRs. instead access the KPCR using the IDT or GDT entry's obj_parent
|
2012-06-12 14:07:40 +00:00 |
|
|
iMHLv2
|
f23dfc8f5b
|
when calculating the IDT for each CPU, make sure we use the GDT entries from the same CPU
|
2012-06-12 13:52:18 +00:00 |
|
|
iMHLv2
|
abf1668d84
|
per request, move the KPCR object classes from malware/idt.py to windows/overlays/kpcr_vtypes.py (since they aren't malware specific)
|
2012-06-12 13:45:01 +00:00 |
|
|
iMHLv2
|
e3b10c112c
|
per request, move envars plugin to a separate file in core
|
2012-06-12 13:26:55 +00:00 |
|
|
mike.auty@gmail.com
|
4162c00fab
|
Move to consistent output on the strings plugin (always hex).
|
2012-06-12 13:26:12 +00:00 |
|
|
mike.auty@gmail.com
|
ea4c153baa
|
Add a note to allow VolatilityMagic objects to be proxied when they're numeric.
|
2012-06-10 12:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
d726e1a3ae
|
Remove unnecessary .v() calls from raw2dmp and tidy a few bits.
|
2012-06-10 12:42:37 +00:00 |
|
|
mike.auty@gmail.com
|
63cd1962d0
|
Minor pylintage.
|
2012-06-10 11:51:02 +00:00 |
|
|
iMHLv2
|
9e228e87aa
|
volshell now supports 64bit disasm, according to current Profile/AS or as specified by the user
|
2012-06-05 23:38:18 +00:00 |
|
|
iMHLv2
|
05c3c015bb
|
leverage the new KDBG.kpcrs() to iterate quickly through all KPCRs in a memory dump. this allows us to display IDT, GDT, and Timers per-processor without relying on kpcrscan which is way too slow to actually be useful
|
2012-06-05 21:58:24 +00:00 |
|
|
iMHLv2
|
69a9c1c56c
|
remove the temporary CPU number hack from imageinfo now that we have object classes for x86 and x64 KPCR
|
2012-06-05 21:36:17 +00:00 |
|
|
iMHLv2
|
b754e88e4a
|
document our backup method of finding KDBG via KPCR. use object classes w/ inheritance to clearly indicate that finding KDBG via KPCR will not work on x64.
|
2012-06-05 21:21:51 +00:00 |
|
|
iMHLv2
|
bc357f0574
|
finish what was started in r1842
|
2012-06-05 20:37:53 +00:00 |
|
|
iMHLv2
|
34b909bbba
|
remove the function within a function: tasks.get_kdbg.verify_kdbg(). replace it with a call to kdbg.is_valid() which now performs the same validity check
|
2012-06-05 20:36:14 +00:00 |
|
|
iMHLv2
|
ad35cd7d8d
|
add _KDDEBUGGER_DATA64.processes() and _KDDEBUGGER_DATA64.modules() generators to replace much of the code in win32.tasks and win32.modules. this is mostly for API and ease-of-use. plus in the future if windows processes need to be enumerated differently, we can easily subclass _KDDEBUGGER_DATA64
|
2012-06-05 20:19:07 +00:00 |
|
|
iMHLv2
|
b9350c8c3e
|
add a description to the shimcache plugin
|
2012-06-05 20:03:01 +00:00 |
|
|
iMHLv2
|
02f0a22e37
|
imageinfo should acquire CPU count and service pack from KDBG, not process PEB. this is a more authoritative source and less likely to be paged. we can also now report the KPCR address for each CPU on multi-core systems instead of just one. Fixes Issue #267.
|
2012-06-05 19:59:46 +00:00 |
|
|
iMHLv2
|
c00de40450
|
add AW's crash dump x64 patch, including the raw2dmp plugin. Fixes Issue #177
|
2012-06-05 19:50:04 +00:00 |
|
|
iMHLv2
|
081806196c
|
add a plugin to print environment variables for x86 and x64 windows processes
|
2012-06-05 19:34:47 +00:00 |
|
|
iMHLv2
|
a482d07d08
|
fix a bug in malfind's hexdumps, they're not showing correct offsets
|
2012-06-05 17:52:48 +00:00 |
|