volatilityfoundation-volatility

addrspaces

remove big-endian lime magic from the AS assertion, replace it with a debug message. mem dumps from big-endian ARM won't work anyway because parse_lime only checks for the little-endian magic (not to mention everything else)

2012-10-20 05:03:16 +00:00

gui

add a new set of message hook offsets for win32k.sys 5.1.2600.6149

2012-11-12 19:53:39 +00:00

linux

Linux - add joes plugins for detecting in-kernel keyloggers

2012-10-15 18:28:55 +00:00

mac

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

malware

patch from gleeda to conform the search_process_memory API call in svcscan to the new format (which accepts a list of strings instead of a single string)

2012-11-01 23:06:13 +00:00

overlays

remove the Debian2632 profile, it shouldn't be there. it was deleted from trunk a long time about but snuck back in when 2.3-devel was merged into trunk

2012-10-19 21:44:21 +00:00

registry

adding descriptions and removing an uneeded comment

2012-10-24 14:10:34 +00:00

__init__.py

Deprecate the semi-colon separated plugin syntax and follow the help message.

2012-09-14 15:14:37 +00:00

bioskbd.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00

common.py

Apply basic windows restrictions to most windows plugins.

2012-05-18 09:53:27 +00:00

connections.py

fix some typos in the connections.Connections class pydoc

2012-07-10 14:13:53 +00:00

connscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

crashinfo.py

Speed up crashdump by not searching for an unnecessary virtual space.

2012-10-14 01:10:57 +00:00

dlldump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

envars.py

per request, move envars plugin to a separate file in core

2012-06-12 13:26:55 +00:00

evtlogs.py

small fix to evtlogs

2012-09-05 15:47:45 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

gleeda's filescan patch to prepend the device name to files. this is already done for files in the handles plugin

2012-08-17 21:01:21 +00:00

getservicesids.py

Basic pylint fixes for getservicesids.

2012-09-20 21:51:30 +00:00

getsids.py

Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.

2012-05-14 23:06:56 +00:00

handles.py

Convert handles plugin across to using table formatting.

2012-05-22 08:27:12 +00:00

hibinfo.py

small fix: the header is actually PO_MEMORY_IMAGE not IMAGE_HIBER_HEADER

2012-08-30 13:35:10 +00:00

iehistory.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

imagecopy.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00

imageinfo.py

kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268

2012-06-12 22:49:32 +00:00

kdbgscan.py

Ensure that kdbgscan ignores non-windows profiles.

2012-08-19 10:16:20 +00:00

kpcrscan.py

kpcrscan is more verbose now

2012-06-18 14:34:14 +00:00

mbrparser.py

removed unneeded comment

2012-10-24 15:51:56 +00:00

mftparser.py

put back full name for $SI attributes in body output. cleaned up some code, added comments and fixed a couple of logic errors that made is_valid too strict and process_attr_list() not strict enough when needed

2012-11-13 20:48:05 +00:00

moddump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

modscan.py

Convert over modscan and thrdscan to the table formatting.

2012-05-22 08:27:19 +00:00

modules.py

Convert modules plugin over to table formatting, and clean-up the output and column ordering.

2012-05-22 08:27:34 +00:00

netscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

patcher.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

procdump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

pstree.py

the task_info dictionary in pstree is unnecessary

2012-06-18 15:07:54 +00:00

raw2dmp.py

Fix direct use of config.LOCATION to find the size of an image.

2012-10-04 20:23:51 +00:00

sockets.py

make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.

2012-07-10 14:11:47 +00:00

sockscan.py

make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.

2012-07-10 14:11:47 +00:00

ssdt.py

Apply basic windows restrictions to most windows plugins.

2012-05-18 09:53:27 +00:00

strings.py

Move to consistent output on the strings plugin (always hex).

2012-06-12 13:26:12 +00:00

taskmods.py

fix a minor caps mistake in pslist plugin description

2012-08-29 15:18:20 +00:00

userassist.py

Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.

2012-05-14 23:06:56 +00:00

vadinfo.py

apply a remedy for issue 306 - vaddump on wow64 processes with MM_MAX_COMMIT. we don't want to dump these multi terabyte ranges with no valid pages. see issue 306 for details and analysis...the issue will remain open while we consider other ways to address the problem, however this patch should resolve it well enough for the stability of the 2.1 release

2012-07-24 14:47:37 +00:00

vboxinfo.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

vmwareinfo.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

volshell.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00