 mike.auty@gmail.com
|
c318153737
|
Add in the all-important proper VM for dereferencing as a different type.
|
2011-12-29 13:35:43 +00:00 |
|
|
mike.auty@gmail.com
|
f95a6644b5
|
Fix up EX_FAST_REF to use the highest VM available.
|
2011-12-29 13:35:38 +00:00 |
|
|
mike.auty@gmail.com
|
0129921aa8
|
Add in changes to the object model to support higher level VMs, with lower level offsets.
|
2011-12-29 13:35:31 +00:00 |
|
|
mike.auty@gmail.com
|
a36b41dd84
|
Remove old _member support in favour of @property handling.
|
2011-12-29 13:25:32 +00:00 |
|
|
mike.auty@gmail.com
|
c590d8a41a
|
Minor pylint on utils.py.
|
2011-12-26 20:44:21 +00:00 |
|
|
mike.auty@gmail.com
|
7d669cdc4a
|
Apply the IOError exception catching in a few more places.
|
2011-12-19 23:02:18 +00:00 |
|
|
mike.auty@gmail.com
|
ad3d4fc6fe
|
Add in better NoneObject support, and return NoneObject for failed reads in intel/legacyintel. Fixes issue 57.
|
2011-12-19 23:02:10 +00:00 |
|
|
mike.auty@gmail.com
|
3b6b429f48
|
Pylint clean-up of windows.py.
|
2011-12-19 23:02:04 +00:00 |
|
|
iMHLv2
|
a72723ec57
|
add the _HANDLE_TABLE_ENTRY.GrantedAccess to _OBJECT_HEADER members so they can be printed by the handles plugin. resolves half of Issue #135
|
2011-12-16 05:39:54 +00:00 |
|
|
iMHLv2
|
d033fad81b
|
dont print the ControlArea for VADs marked private, the CA is only valid for shared memory. Fixes Issue #164
|
2011-12-15 21:53:26 +00:00 |
|
|
iMHLv2
|
6c001d4c36
|
add new auto-generated profiles for all windows OS for consistent support of BitField/Enum types. related to issue 144
|
2011-12-15 21:38:40 +00:00 |
|
|
awalters
|
00edcdc5c4
|
As suggested by scudette, we need to tighten the constraint to verify that the prototype flag is not set. This is consistent with the Windows page fault handler. Closes issue 147.
|
2011-12-15 00:30:31 +00:00 |
|
|
iMHLv2
|
7fa861b1f6
|
move the vad start/end sanity check from vaddump into _MMVAD_SHORT.get_data. now it applies to any/all plugins that carve data and not just vaddump
|
2011-12-14 21:52:41 +00:00 |
|
|
iMHLv2
|
9dd68998e0
|
allow volshell's dt() to accept an address space, handle callable offsets/members. Fixes Issue #172
|
2011-12-14 21:30:57 +00:00 |
|
|
iMHLv2
|
f5b6e91def
|
add proper handling of BIG_DATA registry values, gleeda's patch. Fixes Issue #169
|
2011-12-13 14:58:48 +00:00 |
|
|
iMHLv2
|
832158af80
|
fix VALUE_TYPES with REG_UNKNOWN usage. Fixes Issue #171
|
2011-12-13 14:55:39 +00:00 |
|
|
iMHLv2
|
f41f5ac3ed
|
add --silent option to handles command to suppress less meaningful results. Fixes Issue #153.
|
2011-11-30 18:38:48 +00:00 |
|
|
iMHLv2
|
bbd15a5dd0
|
allow dlldump to work on PE's not in the PEB list. remove try/except block from moddump. Fixes Issue #109
|
2011-11-30 18:25:17 +00:00 |
|
|
mike.auty@gmail.com
|
06a4cfeb5e
|
Allow overwriting of empty files using imagecopy.
|
2011-11-25 08:33:13 +00:00 |
|
|
mike.auty@gmail.com
|
04245a8665
|
Add in ieee1394 comment for broken hardware.
|
2011-11-25 08:33:05 +00:00 |
|
|
iMHLv2
|
d10e5f3fb3
|
changed handles plugin to print the offset of the object's Body and not the _OBJECT_HEADER itself. Fixes Issue #152
|
2011-11-14 18:01:58 +00:00 |
|
|
iMHLv2
|
c211476a8f
|
small update to version check for the Issue #156 patch
|
2011-10-27 23:51:50 +00:00 |
|
|
iMHLv2
|
fcbcea1476
|
create object classes for PE header structs, add sanity checks for MZ and PE signatures. Fixes Issue #155
|
2011-10-27 23:41:33 +00:00 |
|
|
gleeda
|
1cb340d828
|
Committing changes to network.py that differentiate between XP and 2K3. Fixes issue 156, though we may want to reopen it at some point to heed MHL's suggestions.
|
2011-10-27 13:56:26 +00:00 |
|
|
iMHLv2
|
1220d59ba7
|
move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160
|
2011-10-26 20:10:43 +00:00 |
|
|
mike.auty@gmail.com
|
0d7bdaefc5
|
Fix bug where pages in transition are not considered valid.
Applied this to legacyintel as well, and corrected indentation.
(cherry picked from commit 7e4b037c75174290564089354d6340286b9cfcb3)
|
2011-10-05 18:24:00 +00:00 |
|
|
mike.auty@gmail.com
|
b9b33dcbd1
|
Actual fix for issue 139. Check if the Name is a NoneObject, not just the NameBlock. We don't use not because Name might be valid but empty.
|
2011-10-02 22:35:28 +00:00 |
|
|
mike.auty@gmail.com
|
5215cbcf42
|
Add in scudette's fix for NoneObject strings, and clean out unused code/comments. Fixes issue 139.
|
2011-10-02 22:31:38 +00:00 |
|
|
mike.auty@gmail.com
|
b12ae5b0ad
|
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
|
2011-10-01 16:19:51 +00:00 |
|
|
gleeda
|
6179777603
|
putting back the highly requested missing render_dot for psscan
|
2011-09-26 20:46:01 +00:00 |
|
|
gleeda
|
56cbef4ce8
|
committing MHL's cool _MMVAD helper functions. fixes issue 133.
|
2011-09-15 14:56:48 +00:00 |
|
|
gleeda
|
e320cb8861
|
Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.
|
2011-09-15 14:03:56 +00:00 |
|
|
gleeda
|
4fb85730a0
|
userassist: replaced old hexdump function w/new one
|
2011-09-09 14:49:31 +00:00 |
|
|
gleeda
|
3fcb3f3cff
|
added two more known sids (http://support.microsoft.com/kb/956572)
|
2011-09-02 21:40:38 +00:00 |
|
|
iMHLv2
|
d546e9f662
|
change Hexdump formula ord(x) < 100 to ord(x) < 127. otherwise we skip all lowercase letters above d
|
2011-08-21 18:20:44 +00:00 |
|
|
iMHLv2
|
984f9f4a30
|
add scudette's hexdump to volatility.utils. fix lsadump, printkey, volshell to use it
|
2011-08-20 16:05:02 +00:00 |
|
|
iMHLv2
|
adae6745ca
|
remove object type from filescan.py plugins. Fixes Issue #130.
|
2011-08-13 23:03:15 +00:00 |
|
|
iMHLv2
|
e9019d2005
|
Move EX_FAST_REF to windows.py so its accessible to XP profiles. Fix getsids plugin to properly treat EPROCESS.Token as an EX_FAST_REF
|
2011-08-08 17:52:39 +00:00 |
|
|
mike.auty@gmail.com
|
1419262549
|
Move checkname to be an attribute, so we can reuse the class for 64-bit support with different checks.
|
2011-08-06 16:03:13 +00:00 |
|
|
iMHLv2
|
eb0c6fbb93
|
credit frank for countless bug reports, enhancement ideas, and testing of malware plugins
|
2011-08-02 16:47:01 +00:00 |
|
|
mike.auty@gmail.com
|
a6280a7330
|
Bump trunk version to 2.1_alpha.
|
2011-07-31 17:49:56 +00:00 |
|
|
mike.auty@gmail.com
|
03d0aa4d41
|
Finally bump to volatility 2.0.
2.0
|
2011-07-31 17:44:32 +00:00 |
|
|
mike.auty@gmail.com
|
da93fab070
|
Fix small typo in CREDITS file.
|
2011-07-31 14:18:42 +00:00 |
|
|
awalters
|
6a3048c4ed
|
Files were updated for the 2.0 release.
|
2011-07-31 12:37:20 +00:00 |
|
|
mike.auty@gmail.com
|
0f3ea35f8a
|
Remove hibdump in favour of the generic imagecopy plugin.
|
2011-07-27 22:07:01 +00:00 |
|
|
gleeda
|
d2ec6c0f10
|
Changing the type of CreateTime for _ETHREAD from ThreadCreateTimeStamp to WinTimeStamp starting with 2k3 SP1. Fixes issue 122
|
2011-07-25 19:03:58 +00:00 |
|
|
mike.auty@gmail.com
|
314b7531fc
|
Add in a fix for py2exe not pulling in xml.etree.ElementTree. Also add in a fake import for the yara dependency which external plugins don't want to carry about themselves.
|
2011-07-19 22:54:50 +00:00 |
|
|
mike.auty@gmail.com
|
9113e9b3aa
|
Update the wiki and other documentation to support the change to trunk and 2.0.
|
2011-06-29 21:07:58 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|
|
mike.auty@gmail.com
|
dcc3004e03
|
Move Volatility trunk to 1.3.3 branch in preparation for the 2.0 move to trunk.
|
2011-06-29 20:59:55 +00:00 |
|