 iMHLv2
|
d15e9e252e
|
yet another attempt to fix the negative numbers in vm_area_struct for linux when using proc_maps
|
2013-04-02 11:24:23 +00:00 |
|
|
iMHLv2
|
c3789edaa8
|
indicate the process ID and name in which bash history was found (it may not always be a process named bash, or there may be multiple bash processes running)
|
2013-04-02 04:00:53 +00:00 |
|
|
iMHLv2
|
8109e57928
|
when brute force scanning for linux bash history, we find objects in an unordered fashion. use timestamps to sort them, so the output resembles the actual order in which commands were typed. this cannot show order if more than one command was typed in the same second.
|
2013-04-02 03:57:35 +00:00 |
|
|
iMHLv2
|
22d51ddc18
|
add an option --scan-all/-A to linux_bash. by default when brute forcing, we only look in processes named bash. this new option overrides and scans everything - useful if you have a backdoor bash shell copied to /tmp/abc and you want to recover history from it
|
2013-04-02 03:38:24 +00:00 |
|
|
iMHLv2
|
d5a920dab7
|
complete the series of patches that will allow us to find bash history on linux without manually supplying the offset to history_list_pointer symbol
|
2013-04-02 02:33:49 +00:00 |
|
|
iMHLv2
|
dffa85d9e9
|
make the _hist_entry.is_valid() check more aggressive. this will assist in brute force scanning and allow us to remove the required --history address parameter (i.e. the plugin can work without previous reverse engineering for each system)
|
2013-04-02 02:21:16 +00:00 |
|
|
iMHLv2
|
50b816b2e4
|
patch linux_bash to show human-readable timestamps instead of integers like 1345254942 and allow the --tz command-line option to switch the timestamp time zones
|
2013-04-01 21:16:03 +00:00 |
|
|
iMHLv2
|
f30d49c20e
|
fix a typo in an error message - linux_pidhashtable
|
2013-03-29 22:41:10 +00:00 |
|
|
atcuno
|
17cd70e20b
|
Linux - filter out bad task_structs in pid_hashtable
|
2013-03-29 18:49:57 +00:00 |
|
|
iMHLv2
|
dcc234530f
|
small whitespace in linux_tty_check
|
2013-03-28 16:42:00 +00:00 |
|
|
iMHLv2
|
94631b577d
|
linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED
|
2013-03-25 16:00:52 +00:00 |
|
|
iMHLv2
|
edeee594a6
|
include the task ID in the table column for linux_proc_maps. otherwise when you view maps for multiple processes, you can't tell which range belongs to which process
|
2013-03-07 16:04:53 +00:00 |
|
|
iMHLv2
|
f78329f8f2
|
fix linux_dump_maps plugin: inherit from proc_maps for -p option, replace --outfile with --dump-dir so we can write multiple VMAs to separate files, use table_header/table_row for a summary. spotted by Edwin Smulders
|
2013-03-07 15:58:19 +00:00 |
|
|
iMHLv2
|
bbad6877e8
|
remove some whitespace in linux_pstree
|
2013-03-07 15:37:31 +00:00 |
|
|
iMHLv2
|
e8569a92d6
|
add **kwargs for all linux plugins
|
2013-03-07 15:28:36 +00:00 |
|
|
iMHLv2
|
f106698abf
|
bring the IGNORE_UNIX option back to linux_netstat. it was deleted it r2808 but the variable self._config.IGNORE_UNIX is still referenced in code
|
2013-02-22 18:31:28 +00:00 |
|
|
iMHLv2
|
a69bc6f84b
|
add a description to the linux_volshell command
|
2013-02-22 15:33:48 +00:00 |
|
|
iMHLv2
|
be4231481f
|
fix pydoc for linux_tmpfs function
|
2013-02-22 14:46:42 +00:00 |
|
|
iMHLv2
|
e317dfe58f
|
remove unused inode.i_size variable
|
2013-02-22 14:19:03 +00:00 |
|
|
iMHLv2
|
2605f7bfcc
|
remove some unnecessary variable reassignments in linux_tmpfs
|
2013-02-22 14:16:19 +00:00 |
|
|
iMHLv2
|
e899be9888
|
fix linux_tmpfs for --tz time zone handling and UnixTimeStamp
|
2013-02-22 14:07:38 +00:00 |
|
|
iMHLv2
|
676597f7cb
|
remove the sym_type parameter to AbstractMacProfile.get_symbol() and AbstractLinuxProfile.get_symbol(). its no longer needed after the pointer masking patch in r3127
|
2013-02-20 03:07:23 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
0cc8f8e4df
|
move the linux_common.get_partial_path() function to a dentry object class method
|
2013-02-19 20:52:38 +00:00 |
|
|
iMHLv2
|
a6a72d898b
|
some whitespace in linux_tmpfs
|
2013-02-19 20:06:57 +00:00 |
|
|
iMHLv2
|
4f7e22430b
|
remove the linux_common.S_ISREG and linux_common.S_ISDIR functions. replace them with an inode object class that has is_dir() and is_reg() methods
|
2013-02-19 20:05:32 +00:00 |
|
|
iMHLv2
|
300739da35
|
remove the deprecated walk_list_head() function from linux common
|
2013-02-19 19:54:45 +00:00 |
|
|
iMHLv2
|
49d57f9ae0
|
move online_cpus, get_per_cpu_symbol, and walk_per_cpu_var from AbstractLinuxCommand into linux_cpuinfo
|
2013-02-19 18:04:31 +00:00 |
|
|
iMHLv2
|
8ed0c4bdbc
|
move the linux get_task_start_time() API out of AbstractLinuxCommand - put it in the task_struct object class
|
2013-02-19 17:58:44 +00:00 |
|
|
iMHLv2
|
885087f009
|
remove the unnecessary AbstractLinuxCommand.get_profile_symbol(). plugins now call directly to the API
|
2013-02-19 17:44:04 +00:00 |
|
|
iMHLv2
|
0af575492f
|
replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead
|
2013-02-19 17:42:25 +00:00 |
|
|
iMHLv2
|
f28cf51411
|
fix some whitespace in linux_find_file
|
2013-02-13 21:36:27 +00:00 |
|
|
iMHLv2
|
5978db698a
|
fix a bug in linux_tmpfs, introduced after 2.2 when we converted the 'name' variable to a simple character buffer into a volatility String object. spotted by Sebastien Bourdon-Richard
|
2013-02-13 01:56:41 +00:00 |
|
|
iMHLv2
|
1e8e2d4ecd
|
the metadata memory_model value can be directly assigned to table_name in linux_check_syscall
|
2013-02-12 20:50:39 +00:00 |
|
|
iMHLv2
|
6e6a9f7fdc
|
we dont need the mask value in linux_check_syscalls if we switch from long to unsigned long
|
2013-02-12 20:47:53 +00:00 |
|
|
iMHLv2
|
1f48e304e7
|
remove unnecessary import from proc_maps
|
2013-02-12 20:44:10 +00:00 |
|
|
iMHLv2
|
728a6a21d3
|
some whitespace in proc_maps
|
2013-02-12 20:43:10 +00:00 |
|
|
iMHLv2
|
1fa8f1800d
|
we don't need to create a new super_block object in linux_proc_maps, we can leverage the auto-dereference capability when just accessing the inode.i_sb attribute
|
2013-02-12 20:40:56 +00:00 |
|
|
iMHLv2
|
27f6029040
|
create a super_block object class with 'major' and 'minor' properties
|
2013-02-12 20:37:54 +00:00 |
|
|
iMHLv2
|
2e5ebc6120
|
create a Flags object for handling rwx, r-x style output for linux, instead of using the format_perms() method attached to a specific plugin
|
2013-02-12 20:27:29 +00:00 |
|
|
iMHLv2
|
ffd749a839
|
remove the mask_number() method from linux_proc_maps, its no longer needed
|
2013-02-12 19:35:38 +00:00 |
|
|
iMHLv2
|
ebf0a9903f
|
some whitespace in linux_check_syscall_arm
|
2013-02-05 20:08:55 +00:00 |
|
|
iMHLv2
|
7185d06827
|
some whitespace in linux_check_evt_arm
|
2013-02-05 20:08:00 +00:00 |
|
|
iMHLv2
|
7cbab87f06
|
move the plugin description for linux_check_evt_arm to proper place for pydoc
|
2013-02-05 20:05:06 +00:00 |
|
|
iMHLv2
|
3cd0e2c881
|
add the linux_moddump plugin
|
2013-02-05 20:02:31 +00:00 |
|
|
iMHLv2
|
8932135e0f
|
add the linux yarascan plugin
|
2013-02-05 15:53:57 +00:00 |
|
|
iMHLv2
|
ee0ac2406a
|
change the Pgoff column in linux_proc_maps to [addr] instead of decimal 6-char width
|
2013-02-05 04:51:13 +00:00 |
|
|
atcuno
|
dd44c49f8e
|
Linux - update proc_maps interface and add search_process_memory
|
2013-02-05 03:15:37 +00:00 |
|
|
iMHLv2
|
6a0a1c603b
|
add an initial mac_volshell plugin
|
2013-02-04 15:15:05 +00:00 |
|
|
iMHLv2
|
e65c61bf20
|
refactor linux_volshell to share more code with the existing windows volshell command
|
2013-02-04 14:32:04 +00:00 |
|