03d0aa4d41
Finally bump to volatility 2.0.
2011-07-31 17:44:32 +00:00
da93fab070
Fix small typo in CREDITS file.
2011-07-31 14:18:42 +00:00
6a3048c4ed
Files were updated for the 2.0 release.
2011-07-31 12:37:20 +00:00
0f3ea35f8a
Remove hibdump in favour of the generic imagecopy plugin.
2011-07-27 22:07:01 +00:00
d2ec6c0f10
Changing the type of CreateTime for _ETHREAD from ThreadCreateTimeStamp to WinTimeStamp starting with 2k3 SP1. Fixes issue 122
2011-07-25 19:03:58 +00:00
314b7531fc
Add in a fix for py2exe not pulling in xml.etree.ElementTree. Also add in a fake import for the yara dependency which external plugins don't want to carry about themselves.
2011-07-19 22:54:50 +00:00
9113e9b3aa
Update the wiki and other documentation to support the change to trunk and 2.0.
2011-06-29 21:07:58 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
dcc3004e03
Move Volatility trunk to 1.3.3 branch in preparation for the 2.0 move to trunk.
2011-06-29 20:59:55 +00:00
540f522665
Gleeda wanted this change in order to support sql backends. This may need to be revisited and possibly pushed to the plugin.
2010-01-25 04:34:21 +00:00
9c80a7f205
Bug reported by gleeda. commands assumed the output format was stored in output not output-format. Changed the variable to now be outputformat for storage. Could not change to output since it would conflict with other plugins (ie dmp2raw).
2010-01-25 04:03:31 +00:00
f9f48e7b60
Add in bugfix for sockscan2 issue.
...
Sockscan2 on certain images would create a buffer address space of a
particular size, then try to locate objects within it. If the object
started late on in the buffer, the scanner would try and access objects
beyond the end of the buffer. Read would return '' rather than None,
and cause an Exception.
This initial fix ensures that obj reads always return None if the
address space return either None or ''.
2009-11-10 10:18:44 +00:00
cfa9acba00
Fix up infinite loop in process_ldrs for modified ModuleLists.
2009-10-25 13:32:16 +00:00
c47049c736
Resolved command long option conflict between standard parser and raw2dmp/dmp2raw. Thanks ikelos for submitting a patch
2009-10-25 05:10:18 +00:00
2b2ddf40ec
Updated format_time function to handle bad values
2009-08-09 18:29:46 +00:00
c50cc8922a
Simplified the code to leverage the zread function
2009-08-09 17:50:00 +00:00
bf53993b8f
Fixed the way vaddump deals with invalid pages
2009-07-29 21:27:49 +00:00
5735bef246
Fix some argument names in scan2.py
2009-07-07 18:00:41 +00:00
cf9f67d5c4
Backing out the change to avoid object definition collisions until we find a way to have it break fewer things
2009-05-16 02:21:50 +00:00
bb136b422c
Fix read_string_buf regression
2009-05-15 13:45:26 +00:00
b506b3db52
Introduce BufferAddressSpace and refactor
2009-04-10 21:18:28 +00:00
552c1d813b
Add support for inactive hiberfiles to hibinfo
2009-04-08 23:31:00 +00:00
57b8dc0da1
Pool scanning enhancements
2009-04-08 23:14:42 +00:00
7e0366e4d7
GC Volatility
2009-04-08 22:16:13 +00:00
26ca3f6faf
GC Volatility
2009-04-08 22:08:55 +00:00
8f7afd8543
Initial directory structure.
2009-04-03 20:46:49 +00:00
mike.auty@gmail.com