volatilityfoundation-volatility

addrspaces

Broaden the conditions under which we skip duplicate PTE entries in the get_available_pages API. It used to apply only to 64-bit Windows 10, but we've started seeing similar entries on Windows 8 / Server 2012.

2017-07-11 13:37:57 -05:00

gui

Merge pull request #307 from bridgeythegeek/patch-1

2017-03-29 06:52:13 -05:00

linux

Linux - update system call API

2017-08-17 22:57:27 -05:00

mac

Merge branch 'master' of https://github.com/volatilityfoundation/volatility

2017-08-24 12:18:18 -05:00

malware

Adding support for svcscan on 32- and 64-bit Windows 10 15063 (Creators Update)

2017-04-17 12:31:59 -05:00

overlays

avoid analyzing hollowed exes - needs testing from mhl

2017-11-08 15:53:24 -06:00

registry

sometimes a basic.String() instance may evaluate to None, but not be a NoneObject, thus .reason won't be available, and an AttributeError will be raised

2017-03-18 20:44:14 -05:00

__init__.py

Match the help message to the plugin path separator.

2013-03-27 08:51:26 +00:00

bigpagepools.py

Add a new set of big page table values for GUID 96D97527892B4BD19B68BEA3E36FBBA5 (Win2012R2x64) and strengthen the sanity checks to check the address and size are both multiples of a 4K page

2017-07-28 12:24:37 -05:00

bioskbd.py

more pretty print

2015-03-18 11:14:55 +00:00

cmdline.py

cmdline:

2016-05-19 15:39:14 -04:00

common.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

connections.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

connscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

crashinfo.py

converted crashinfo

2015-02-23 09:08:10 -05:00

dlldump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

drivermodule.py

drivermodule fixes:

2017-09-08 15:42:48 -04:00

dumpcerts.py

need to check for yara before using it

2015-08-26 15:48:43 -04:00

dumpfiles.py

removing unneeded comments

2015-03-16 11:44:14 +00:00

envars.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

evtlogs.py

eventlogs: fix for issue #315

2016-07-20 18:06:13 -04:00

fileparam.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

filescan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

getservicesids.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

getsids.py

getsids: fixing missing backslashes

2016-08-30 10:32:20 -04:00

handles.py

the --object-type/-t option to handles is no longer case sensitive

2015-10-12 15:20:06 -05:00

heaps.py

fixing address

2015-06-29 14:29:17 -04:00

hibinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

hpakinfo.py

better fixes to the hpak extract / decompress function

2014-06-16 12:27:31 -05:00

iehistory.py

the iehistory plugin needs a Url property

2016-10-11 14:51:16 -05:00

imagecopy.py

Update imagecopy.py to provide bytes copied stats

2015-02-27 17:35:24 +00:00

imageinfo.py

imageinfo: Fixing backtrace when instantiating with non Windows

2017-03-29 09:44:29 -04:00

joblinks.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

kdbgscan.py

a better description of the --kdbg parameter for win 8 and above

2015-10-13 23:59:40 -05:00

kpcrscan.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

machoinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

mbrparser.py

bug fix: boot_code may become 'NoneType' object

2016-05-18 09:48:33 +08:00

mftparser.py

changes to mftparser

2015-06-08 20:11:03 -04:00

moddump.py

prevent the inherited --name option from displaying for moddump

2015-09-05 17:28:47 +02:00

modscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

modules.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

multiscan.py

Remove invalid callbacks from multiscan for Windows XP and earlier

2015-04-10 18:41:48 +02:00

netscan.py

Add additional fixes for windows 10 x86. Fix a possible issue with the windows 10 x64 TCP_ENDPOINT RemotePort offset

2017-04-04 09:31:41 -04:00

notepad.py

fixing spacing on notepad

2017-03-27 11:24:03 -04:00

objtypescan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

patcher.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

patchguard.py

update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)

2014-03-30 11:11:37 +02:00

pooltracker.py

refs #66 prevent MemoryError in pool tracker plugin

2015-10-14 09:33:48 -05:00

privileges.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

procdump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

pstree.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

raw2dmp.py

Add basic error handling to raw2dmp

2016-12-15 10:25:05 +01:00

sockets.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

sockscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

ssdt.py

abort the parsing of windows ssdt structures if we encounter an invalid descriptor

2015-06-26 18:18:14 -05:00

strings.py

Merge pull request #243 from bridgeythegeek/master

2016-01-18 16:49:18 -05:00

taskmods.py

Fix DLL LoadCount for Win8 and Win10. Add DLL LoadTime to dlllist output (will be blank for < Win7)

2017-03-29 06:41:51 -05:00

tcaudit.py

prevent a backtrace on truecryptmaster when finding devices with invalid device extensions

2016-05-06 11:43:57 -05:00

timeliner.py

making LoadTime all macb

2016-08-01 10:18:58 -07:00

vadinfo.py

refs #333 add a 1gb default maximum memory range size to vaddump and yarascan

2016-10-12 08:13:56 -05:00

vboxinfo.py

add qemuinfo plugin

2015-04-01 22:24:11 -05:00

verinfo.py

small fix spotted by Beni U.

2015-02-02 11:08:43 -05:00

vmwareinfo.py

override is_valid_profile for vmwareinfo since its applies to linux/mac

2014-06-20 13:31:48 -05:00

volshell.py

volshell: list_entry

2016-01-20 17:06:47 -05:00

win10cookie.py

add Win10x64 and Win10x86 profiles

2015-10-14 09:08:58 -05:00