 iMHLv2
|
3f3969b333
|
oops, virtual addresses in strings output should still be in hex
|
2014-03-13 11:35:27 -05:00 |
|
|
iMHLv2
|
241199ed7b
|
don't ignore strings in free/dealloc blocks. format physical offsets as decimal to match the input format
|
2014-03-13 10:26:10 -05:00 |
|
|
iMHLv2
|
067c31db04
|
fix a bug in strings line stripping
|
2014-01-29 13:02:23 -06:00 |
|
|
iMHLv2
|
8d124ed50b
|
refs #15 swap the order back to kernel first and then process
|
2014-01-28 15:42:39 -06:00 |
|
|
iMHLv2
|
7edb7d9bf0
|
initial commit of revised strings plugin to work with linux and mac
|
2014-01-28 15:24:32 -06:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
65690943aa
|
change Strings.parse_line() to staticmethod so it can be used in other plugins without inheritance
|
2013-08-20 20:22:12 +00:00 |
|
|
iMHLv2
|
2fe72e3975
|
make Strings.get_reverse_map() a staticmethod so it can be accessed by other plugins without inheritance
|
2013-08-20 20:01:37 +00:00 |
|
|
iMHLv2
|
f1c1900aba
|
the strings plugin consumes 1.2 GB RAM when parsing 180 MB of strings, because it reads them all at once and collects them into a list before processing. this patch reads one line at a time, processes it, then throws it away before fetching the next line
|
2013-05-15 18:21:16 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
482a144f66
|
automatically translate kernel addresses in the strings output to identify the owning kernel module. fixes issue #363
|
2013-01-17 02:12:52 +00:00 |
|
|
mike.auty@gmail.com
|
4162c00fab
|
Move to consistent output on the strings plugin (always hex).
|
2012-06-12 13:26:12 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|