 iMHLv2
|
ec3cd90739
|
refs #15 fix a few bugs in the linux strings plugin
|
2014-01-28 16:22:54 -06:00 |
|
|
iMHLv2
|
7edb7d9bf0
|
initial commit of revised strings plugin to work with linux and mac
|
2014-01-28 15:24:32 -06:00 |
|
|
iMHLv2
|
c21b24e585
|
update mount to better filter invalid entries
https://github.com/iMHLv2/voldb/commit/dabf036bd2f118bc35572f970f3a1bf8e
2ef9ab9
|
2014-01-17 20:43:33 -06:00 |
|
|
iMHLv2
|
29d4c90177
|
Linux - add saving the virt and phys offset of IDT descriptors
https://github.com/iMHLv2/voldb/commit/1933c4354f4f921201a1825e152c5193c
9c545ff
|
2014-01-17 20:33:25 -06:00 |
|
|
iMHLv2
|
d04cd56dd4
|
change the linux_lsmod -S parameter to -A
https://github.com/iMHLv2/voldb/commit/a77f29ed052e9f30c5bafecb1bd2e5862
dc99ae6
|
2014-01-17 20:14:13 -06:00 |
|
|
iMHLv2
|
cde7d1efa5
|
a few updates to linux_common
https://github.com/iMHLv2/voldb/commit/a77f29ed052e9f30c5bafecb1bd2e5862
dc99ae6
|
2014-01-17 20:11:11 -06:00 |
|
|
iMHLv2
|
3743a20ec3
|
update the check_fops plugin to use file_file
|
2014-01-17 20:07:24 -06:00 |
|
|
iMHLv2
|
79042c90a0
|
Add new generic-elf api, update vboxelf to work with it, add linux_library_list
https://github.com/iMHLv2/voldb/commit/04477c868e28307995fde709a6ad54395
b006366
|
2014-01-17 19:28:20 -06:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
atcuno
|
c02298dd35
|
Linux - update ifconfig to understand virtual addresses
|
2013-09-30 06:40:19 +00:00 |
|
|
atcuno
|
510097f60f
|
Linux - clean up keyboard notifier
|
2013-09-27 14:58:03 +00:00 |
|
|
atcuno
|
96b488d3e7
|
Linux - cleanup check tty
|
2013-09-26 22:25:35 +00:00 |
|
|
atcuno
|
9a5a6245c9
|
Linux - add table address to generator in check syscall
|
2013-09-26 19:28:22 +00:00 |
|
|
atcuno
|
94c7f96202
|
Linux - update check_syscall to do all work in calculate
|
2013-09-26 18:52:13 +00:00 |
|
|
atcuno
|
ad4bf2d0cb
|
Linux - simplify logic in check_idt
|
2013-09-26 18:11:25 +00:00 |
|
|
atcuno
|
644d47d9ea
|
Linux - check_idt - move symbol name resolution to calculate
|
2013-09-26 14:56:45 +00:00 |
|
|
atcuno
|
948ee07b66
|
Linux - make linux_find_file more API family
|
2013-09-25 23:51:10 +00:00 |
|
|
atcuno
|
0e06d5d408
|
Linux - add linux_banner plugin
|
2013-09-25 15:51:06 +00:00 |
|
|
atcuno
|
6c4cd1cec9
|
Linux - fix route cache plugin for >= 3.6
|
2013-08-20 07:50:50 +00:00 |
|
|
iMHLv2
|
5c283ad4f7
|
AbstractLinuxCommand.known_addrs should be a dict initially, not a list and then set to a dict from plugins
|
2013-08-17 17:31:30 +00:00 |
|
|
iMHLv2
|
d566437cc4
|
fix an exception in linux_netstat on a missing inet_sock.inet_dport. reported by Edwin Smulders. at the same time, create some APIs for linux's inet_sock object. fixes issue #434
|
2013-07-17 14:30:28 +00:00 |
|
|
iMHLv2
|
6a4dfbf869
|
move the linux command line function to the object class rather than the plugin
|
2013-07-03 19:03:08 +00:00 |
|
|
atcuno
|
d0df9706a5
|
Linux - add modules function to linux_volshell
|
2013-05-30 16:53:24 +00:00 |
|
|
atcuno
|
209e68ccf1
|
Linux - add support for architecutre specific plugins
|
2013-04-11 20:14:49 +00:00 |
|
|
iMHLv2
|
2c14edefe7
|
add a condition to the BashTypes profile modification to prevent it from being applied when windows profiles are in use
|
2013-04-09 19:11:15 +00:00 |
|
|
iMHLv2
|
d15e9e252e
|
yet another attempt to fix the negative numbers in vm_area_struct for linux when using proc_maps
|
2013-04-02 11:24:23 +00:00 |
|
|
iMHLv2
|
c3789edaa8
|
indicate the process ID and name in which bash history was found (it may not always be a process named bash, or there may be multiple bash processes running)
|
2013-04-02 04:00:53 +00:00 |
|
|
iMHLv2
|
8109e57928
|
when brute force scanning for linux bash history, we find objects in an unordered fashion. use timestamps to sort them, so the output resembles the actual order in which commands were typed. this cannot show order if more than one command was typed in the same second.
|
2013-04-02 03:57:35 +00:00 |
|
|
iMHLv2
|
22d51ddc18
|
add an option --scan-all/-A to linux_bash. by default when brute forcing, we only look in processes named bash. this new option overrides and scans everything - useful if you have a backdoor bash shell copied to /tmp/abc and you want to recover history from it
|
2013-04-02 03:38:24 +00:00 |
|
|
iMHLv2
|
d5a920dab7
|
complete the series of patches that will allow us to find bash history on linux without manually supplying the offset to history_list_pointer symbol
|
2013-04-02 02:33:49 +00:00 |
|
|
iMHLv2
|
dffa85d9e9
|
make the _hist_entry.is_valid() check more aggressive. this will assist in brute force scanning and allow us to remove the required --history address parameter (i.e. the plugin can work without previous reverse engineering for each system)
|
2013-04-02 02:21:16 +00:00 |
|
|
iMHLv2
|
50b816b2e4
|
patch linux_bash to show human-readable timestamps instead of integers like 1345254942 and allow the --tz command-line option to switch the timestamp time zones
|
2013-04-01 21:16:03 +00:00 |
|
|
iMHLv2
|
f30d49c20e
|
fix a typo in an error message - linux_pidhashtable
|
2013-03-29 22:41:10 +00:00 |
|
|
atcuno
|
17cd70e20b
|
Linux - filter out bad task_structs in pid_hashtable
|
2013-03-29 18:49:57 +00:00 |
|
|
iMHLv2
|
dcc234530f
|
small whitespace in linux_tty_check
|
2013-03-28 16:42:00 +00:00 |
|
|
iMHLv2
|
94631b577d
|
linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED
|
2013-03-25 16:00:52 +00:00 |
|
|
iMHLv2
|
edeee594a6
|
include the task ID in the table column for linux_proc_maps. otherwise when you view maps for multiple processes, you can't tell which range belongs to which process
|
2013-03-07 16:04:53 +00:00 |
|
|
iMHLv2
|
f78329f8f2
|
fix linux_dump_maps plugin: inherit from proc_maps for -p option, replace --outfile with --dump-dir so we can write multiple VMAs to separate files, use table_header/table_row for a summary. spotted by Edwin Smulders
|
2013-03-07 15:58:19 +00:00 |
|
|
iMHLv2
|
bbad6877e8
|
remove some whitespace in linux_pstree
|
2013-03-07 15:37:31 +00:00 |
|
|
iMHLv2
|
e8569a92d6
|
add **kwargs for all linux plugins
|
2013-03-07 15:28:36 +00:00 |
|
|
iMHLv2
|
f106698abf
|
bring the IGNORE_UNIX option back to linux_netstat. it was deleted it r2808 but the variable self._config.IGNORE_UNIX is still referenced in code
|
2013-02-22 18:31:28 +00:00 |
|
|
iMHLv2
|
a69bc6f84b
|
add a description to the linux_volshell command
|
2013-02-22 15:33:48 +00:00 |
|
|
iMHLv2
|
be4231481f
|
fix pydoc for linux_tmpfs function
|
2013-02-22 14:46:42 +00:00 |
|
|
iMHLv2
|
e317dfe58f
|
remove unused inode.i_size variable
|
2013-02-22 14:19:03 +00:00 |
|
|
iMHLv2
|
2605f7bfcc
|
remove some unnecessary variable reassignments in linux_tmpfs
|
2013-02-22 14:16:19 +00:00 |
|
|
iMHLv2
|
e899be9888
|
fix linux_tmpfs for --tz time zone handling and UnixTimeStamp
|
2013-02-22 14:07:38 +00:00 |
|
|
iMHLv2
|
676597f7cb
|
remove the sym_type parameter to AbstractMacProfile.get_symbol() and AbstractLinuxProfile.get_symbol(). its no longer needed after the pointer masking patch in r3127
|
2013-02-20 03:07:23 +00:00 |
|