 Andrew C
|
fe00a2ee9b
|
Mac - update plugin descriptions
|
2014-08-03 17:24:58 -05:00 |
|
|
Andrew C
|
3d4c4992d2
|
Linux - update description strings
|
2014-08-03 17:12:11 -05:00 |
|
|
iMHLv2
|
5285ee84c5
|
update crashinfo to support WindowsCrashDumpSpace64BitMap. update DumpType to include 0x5 bitmap dumps
|
2014-08-03 16:37:55 -05:00 |
|
|
iMHLv2
|
73e8db886d
|
mac_adium supports both ascii and unicode string searches
|
2014-08-03 16:37:55 -05:00 |
|
|
iMHLv2
|
33b3f99e26
|
mac_adium wasn't working due to a case mismatch
|
2014-08-03 16:37:55 -05:00 |
|
|
AAron Walters
|
c7dd766250
|
Added a new address space to support Win8 Bitmap crash files
|
2014-08-03 15:42:47 -04:00 |
|
|
AAron Walters
|
ed6e9c858c
|
Added a new assertion to filter unsupported types (win8)
|
2014-08-03 15:30:39 -04:00 |
|
|
gleeda
|
925220362d
|
Merge branch 'master' of github.com:volatilityfoundation/volatility
|
2014-07-31 16:05:04 -04:00 |
|
|
gleeda
|
17f8304f0c
|
some fixes to registryapi
|
2014-07-31 16:04:49 -04:00 |
|
|
gleeda
|
285ac56aa1
|
removed extra ImageDate type from list
|
2014-07-31 14:22:58 -04:00 |
|
|
gleeda
|
fdff0d492a
|
fixed so that the Registry filter will work correctly
|
2014-07-31 14:19:36 -04:00 |
|
|
iMHLv2
|
043b3bb3ee
|
refs #58 miscalculation in VAD is_valid check
|
2014-07-30 23:47:53 -05:00 |
|
|
Andrew C
|
bbe9172280
|
Mac
|
2014-07-30 23:06:17 -05:00 |
|
|
gleeda
|
a8b600cfa0
|
shellbags: adding back one check
|
2014-07-30 17:50:08 -04:00 |
|
|
gleeda
|
39e1448db4
|
now that we have fix f3cb0464a3, we don't need to do extra check
|
2014-07-30 16:31:34 -04:00 |
|
|
gleeda
|
f3cb0464a3
|
registry pointers should be 32bit. also adding check to make sure Parent key is correct
|
2014-07-30 16:30:53 -04:00 |
|
|
iMHLv2
|
edb44a2f1d
|
add pydocs plugin description for cmdline
|
2014-07-28 19:50:46 -05:00 |
|
|
Andrew Case
|
d10075b060
|
Linux - move malfind to overlays
|
2014-07-26 19:20:07 -05:00 |
|
|
Andrew Case
|
727c72abdf
|
Linux - update netfilter
|
2014-07-26 18:54:15 -05:00 |
|
|
Andrew Case
|
d49f544926
|
Linux - update lsof & netstat api
|
2014-07-26 18:50:39 -05:00 |
|
|
Andrew Case
|
a3f462f632
|
Linux - move ldrmodules to overlay
|
2014-07-26 14:08:40 -05:00 |
|
|
Andrew Case
|
db04f99482
|
Linux - update ldrmodules and minor proc_maps
|
2014-07-26 13:49:58 -05:00 |
|
|
Andrew Case
|
0f7325f18f
|
Linux - update ifconfig
|
2014-07-26 12:53:07 -05:00 |
|
|
Andrew Case
|
e6e7a671da
|
Linux - update cpuinfo
|
2014-07-26 12:29:59 -05:00 |
|
|
Andrew Case
|
fe113f5d92
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2014-07-26 12:16:33 -05:00 |
|
|
Andrew Case
|
0dd31c6f1b
|
Linux - update kernel inline
|
2014-07-26 12:16:18 -05:00 |
|
|
gleeda
|
44883bb00f
|
svcscan: removing unused variable and making sure to avoid nulls in values
|
2014-07-25 20:06:39 -04:00 |
|
|
Andrew Case
|
3253ca993d
|
Linux - update bash hash to be 1000x faster
|
2014-07-25 17:46:57 -05:00 |
|
|
Andrew Case
|
ec57367da4
|
Linux - update bash to use overlay
|
2014-07-25 16:13:21 -05:00 |
|
|
Andrew Case
|
fd9dfbf843
|
Linux - change linux_list_promisc to linux_list_raw
|
2014-07-25 11:59:57 -05:00 |
|
|
Andrew Case
|
25553c4226
|
Linux - update ARP API
|
2014-07-25 09:26:12 -07:00 |
|
|
Andrew Case
|
9e9c23dddf
|
Linux - update process thread gathering to be an overlay
|
2014-07-25 08:40:23 -07:00 |
|
|
Andrew C
|
b9511c4758
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2014-07-22 00:51:36 -05:00 |
|
|
Andrew C
|
11531b8b0e
|
Update mac and linux yarascan to resprect name option
|
2014-07-22 00:51:19 -05:00 |
|
|
iMHLv2
|
26e73d1571
|
fixes #29 add support for win8/8.1/2012/2012 both 32 and 64 bit TCP/UDP activity
|
2014-07-21 12:36:30 -05:00 |
|
|
Andrew C
|
024bf4a487
|
Mac - update check trap table for 10.9.x
|
2014-07-19 11:02:10 -05:00 |
|
|
Andrew C
|
46d07df54b
|
Mac - more updates from mass testing
|
2014-07-19 08:19:48 -05:00 |
|
|
Andrew C
|
782372bc16
|
Mac - a bunch of changes for 64 bit apps on 32 bit kernels and other fixes
|
2014-07-18 22:11:17 -05:00 |
|
|
gleeda
|
4b31987412
|
fixing printkey to print out the registry name even if the registry was specified by offset on commandline
|
2014-07-18 16:39:15 -04:00 |
|
|
iMHLv2
|
4b1f428dd1
|
closes #28 session image lists aren't maintained in win8/2012
|
2014-07-18 14:38:30 -05:00 |
|
|
gleeda
|
05641b9402
|
Merge branch 'master' of github.com:volatilityfoundation/volatility
|
2014-07-18 15:07:49 -04:00 |
|
|
gleeda
|
5d91d56a53
|
making sure not to go past the root key
|
2014-07-18 15:07:18 -04:00 |
|
|
iMHLv2
|
24cd99bbdb
|
closes #42 patch from Matt McCormack to fix dumped PE file image base with --fix option
|
2014-07-18 12:24:40 -05:00 |
|
|
Andrew C
|
cfe8b18aac
|
Mac - update librarydump, procdump, and add load_diff
|
2014-07-18 11:11:55 -05:00 |
|
|
Andrew C
|
d6c88befc0
|
Linux & Mac - Fix volshell with -p is used
|
2014-07-17 15:54:20 -05:00 |
|
|
Andrew C
|
cd320d85fb
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility
|
2014-07-17 01:54:11 -05:00 |
|
|
gleeda
|
ddc9e54ae1
|
Merge branch 'master' of github.com:volatilityfoundation/volatility
|
2014-07-17 16:23:29 -04:00 |
|
|
gleeda
|
7ce940a1c6
|
making sure that object_type's are strings. see issue #40
|
2014-07-17 16:22:31 -04:00 |
|
|
iMHLv2
|
550e57d1fc
|
breaking out the bulk of raw2dmp into a @staticmethod for accessibility from other plugins / frameworks
|
2014-07-17 13:07:08 -05:00 |
|
|
iMHLv2
|
7561cbf502
|
raw2dmp would crash on everything but win8/2012 x64
|
2014-07-17 12:40:38 -05:00 |
|