 iMHLv2
|
a5bb0bbfb2
|
tiny whitespace fix in mac_machine_info
|
2013-01-29 15:46:53 +00:00 |
|
|
iMHLv2
|
7f42ffbfeb
|
use debug.error() in mac_get_processors instead of sys.exit
|
2013-01-29 15:45:43 +00:00 |
|
|
iMHLv2
|
636643b630
|
use dereference_as() in mac_lsof. replace xrange(0, max) with enumerate(). yield object instead of object.a and object.b
|
2013-01-29 15:43:45 +00:00 |
|
|
iMHLv2
|
a57e80c0c3
|
use format() in mac_lsmod instead of %
|
2013-01-29 15:28:15 +00:00 |
|
|
iMHLv2
|
84b7a04d7a
|
use dereference_as() in mac_lsmod. fix while 1 loop to terminate when kmod is not valid
|
2013-01-29 15:27:43 +00:00 |
|
|
iMHLv2
|
54aa0c53f7
|
use table_header/table_row in mac_ls_logins
|
2013-01-29 06:03:51 +00:00 |
|
|
iMHLv2
|
31c20a6dd5
|
use table_header/table_row in mac_ip_filters
|
2013-01-29 05:59:22 +00:00 |
|
|
iMHLv2
|
32d9fc8507
|
use dereference_as() in mac_ifconfig, delete unused variable, use table_header/table_row
|
2013-01-29 05:54:51 +00:00 |
|
|
iMHLv2
|
dbf3649977
|
whitespace in mac_dump_maps, kwargs
|
2013-01-29 05:44:13 +00:00 |
|
|
iMHLv2
|
ef91ca77fb
|
use dereference_as() and outfd.write() in mac_dmesg
|
2013-01-29 05:40:56 +00:00 |
|
|
iMHLv2
|
e343a501ee
|
just some whitespace in mac_check_trap_table
|
2013-01-29 05:38:23 +00:00 |
|
|
iMHLv2
|
f60a4574bf
|
fix a variable assignment typo in mac_check_sysctl
|
2013-01-29 05:35:43 +00:00 |
|
|
iMHLv2
|
0d1c2d06d9
|
condense some code in mac_check_sysctl
|
2013-01-29 05:30:45 +00:00 |
|
|
iMHLv2
|
6924951d56
|
plugin docstrings all start with a word in caps
|
2013-01-29 05:24:04 +00:00 |
|
|
iMHLv2
|
979ba70c39
|
leverage dereference_as() in the mac_arp plugin instead of using obj.Object() twice
|
2013-01-29 05:21:14 +00:00 |
|
|
iMHLv2
|
78bd7c6c34
|
share a few functions between the mac arp and route plugins using inheritance instead of the common.py file
|
2013-01-29 05:18:30 +00:00 |
|
|
iMHLv2
|
602b96b23a
|
change some relative imports to absolute (i.e. import x -> import volatility.plugins.mac.x as x)
|
2013-01-29 03:36:04 +00:00 |
|
|
iMHLv2
|
ae931cacfd
|
change some relative imports to absolute (i.e. import x -> import volatility.plugins.mac.x as x)
|
2013-01-29 03:34:10 +00:00 |
|
|
atcuno
|
d57fc31fb1
|
Linux - add joes check evt arm patch
|
2013-01-29 01:05:51 +00:00 |
|
|
atcuno
|
b871fda79b
|
Linux - Add joes check syscall on ARM patch
|
2013-01-29 01:03:46 +00:00 |
|
|
atcuno
|
7c829bda80
|
Mac - update imports in common and lsmod
|
2013-01-28 23:35:53 +00:00 |
|
|
atcuno
|
3d914a19e8
|
Mac - fix mac_processors warning
|
2013-01-28 17:20:40 +00:00 |
|
|
iMHLv2
|
e99622ecd7
|
fix yarascan to skip MM_MAX_COMMIT on wow64. also see issue #306. we fixed vaddump and svcscan etc a while ago but missed yarascan
|
2013-01-27 05:26:03 +00:00 |
|
|
atcuno
|
093b2eb31f
|
Mac - update pslist for 10.7.x
|
2013-01-26 18:06:22 +00:00 |
|
|
atcuno
|
53493441e3
|
Mac - add list_sessions
|
2013-01-24 00:32:35 +00:00 |
|
|
atcuno
|
34a221ccf1
|
Mac - add pgrp hash table
|
2013-01-23 23:25:22 +00:00 |
|
|
atcuno
|
2325985d7c
|
Mac - add pgid to pslist
|
2013-01-23 23:24:19 +00:00 |
|
|
gleeda
|
91a5a8e456
|
shellbags: added a few bugfixes and added support for UserAssist data, since it can appear in some shellbag keys
|
2013-01-23 22:06:19 +00:00 |
|
|
atcuno
|
0b0457d569
|
Mac - add pid_hash_table
|
2013-01-23 21:47:57 +00:00 |
|
|
atcuno
|
200d5b5e31
|
Mac - add ls_logins
|
2013-01-23 20:44:11 +00:00 |
|
|
atcuno
|
88f482e515
|
Mac - add check_sysctl
|
2013-01-23 06:07:38 +00:00 |
|
|
iMHLv2
|
41d59d2df4
|
add a sanity check to the sockets plugin. this is related to issue #259 (remove hard-coded offsets in network.py and/or add sanity checks)
|
2013-01-22 19:36:45 +00:00 |
|
|
atcuno
|
fdcc3ca65c
|
Mac - add trap table plugin
|
2013-01-22 18:54:07 +00:00 |
|
|
atcuno
|
454794eb9f
|
Mac - add dump_map
|
2013-01-22 06:01:43 +00:00 |
|
|
atcuno
|
6786db6dca
|
Mac - updated psaux to use get_process_address_space
|
2013-01-22 06:01:24 +00:00 |
|
|
atcuno
|
103e4607d6
|
Mac - update proc_maps to yield proc struct
|
2013-01-22 06:00:50 +00:00 |
|
|
atcuno
|
5f75827c4c
|
Mac - add get_process_address_space to object_class
|
2013-01-22 06:00:14 +00:00 |
|
|
atcuno
|
c9f9b9abc1
|
Linux - switch dump_map to zread
|
2013-01-22 05:59:19 +00:00 |
|
|
atcuno
|
d88a0e8afe
|
Mac - update proc_maps to use table format and to print full path of maps
|
2013-01-22 05:00:53 +00:00 |
|
|
atcuno
|
bade5584c2
|
Mac - add start time to pslist
|
2013-01-22 04:06:53 +00:00 |
|
|
atcuno
|
194b85a44c
|
Mac - add pstree plugin
|
2013-01-22 03:45:12 +00:00 |
|
|
atcuno
|
532e5bc134
|
Mac - change dsymutil parsing to regular expression based to support all profiles
|
2013-01-21 23:21:17 +00:00 |
|
|
atcuno
|
011ec57872
|
Mac - print error when running psaux on a 32bit sample from a 64 bit kernel
|
2013-01-21 20:59:47 +00:00 |
|
|
atcuno
|
d275e2355f
|
Mac - update notifiers to not print invalid match strings
|
2013-01-21 20:54:00 +00:00 |
|
|
atcuno
|
cf3894f1cf
|
Mac - update macho address space to not use add_types
|
2013-01-21 20:43:39 +00:00 |
|
|
atcuno
|
008d0c9dfb
|
Mac - fix finding 32 bit dtb for 10.5.x, need test sample for 64 bit
|
2013-01-21 20:39:12 +00:00 |
|
|
atcuno
|
ac5503a648
|
Mac - fix convert tool
|
2013-01-21 20:38:17 +00:00 |
|
|
atcuno
|
15e67312b7
|
Mac - clean up macho address space
|
2013-01-21 20:23:11 +00:00 |
|
|
atcuno
|
c1aa7f2c86
|
Mac - update mac.py for 10.5.8
|
2013-01-21 18:53:00 +00:00 |
|
|
atcuno
|
66e5db3381
|
Mac - update convert.py for 10.5.8
|
2013-01-21 18:52:28 +00:00 |
|