volatilityfoundation-volatility

__init__.py

Merge in most of linux-support.

2012-08-16 11:00:06 +00:00

arp.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

bash.py

Linux - dont try to extract bash history from processes whose mm pointer is invalid (i.e. no way to get process AS)

2012-09-10 16:34:14 +00:00

check_afinfo.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

check_creds.py

Linux - remove block string comment from check_creds.py. moving the comment to wiki command reference

2012-09-10 16:40:11 +00:00

check_evt_arm.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_fops.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_idt.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_modules.py

Linux - PEP8 in check_modules.py, fix plugin description, move block string comment to wiki command reference

2012-09-10 15:47:55 +00:00

check_syscall_arm.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_syscall.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

common.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

cpuinfo.py

move online_cpus, get_per_cpu_symbol, and walk_per_cpu_var from AbstractLinuxCommand into linux_cpuinfo

2013-02-19 18:04:31 +00:00

dentry_cache.py

move the linux_common.get_partial_path() function to a dentry object class method

2013-02-19 20:52:38 +00:00

dmesg.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

dump_map.py

Linux - switch dump_map to zread

2013-01-22 05:59:19 +00:00

find_file.py

remove the linux_common.S_ISREG and linux_common.S_ISDIR functions. replace them with an inode object class that has is_dir() and is_reg() methods

2013-02-19 20:05:32 +00:00

flags.py

create a Flags object for handling rwx, r-x style output for linux, instead of using the format_perms() method attached to a specific plugin

2013-02-12 20:27:29 +00:00

ifconfig.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

iomem.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

keyboard_notifier.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

linux_volshell.py

add an initial mac_volshell plugin

2013-02-04 15:15:05 +00:00

linux_yarascan.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

lsmod.py

remove the sym_type parameter to AbstractMacProfile.get_symbol() and AbstractLinuxProfile.get_symbol(). its no longer needed after the pointer masking patch in r3127

2013-02-20 03:07:23 +00:00

lsof.py

Pylint, formatting and styles fixes for all linux plugins.

2012-09-10 15:06:57 +00:00

mount_cache.py

Linux - update mount_cache to work with 2.6.18

2012-09-17 00:55:46 +00:00

mount.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

netstat.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

pidhashtable.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

pkt_queues.py

Linux - change .next to m.next in pkt_queues

2012-09-11 17:15:08 +00:00

proc_maps.py

remove unnecessary import from proc_maps

2013-02-12 20:44:10 +00:00

psaux.py

Linux - fix psaux table formatting

2012-10-15 17:38:26 +00:00

pslist_cache.py

Pylint, formatting and styles fixes for all linux plugins.

2012-09-10 15:06:57 +00:00

pslist.py

move the linux get_task_start_time() API out of AbstractLinuxCommand - put it in the task_struct object class

2013-02-19 17:58:44 +00:00

pstree.py

Linux - prevent a 'NoneObject as string: Pointer cred invalid' from being displayed in pstree output when analyzing a task_struct that are being deallocated or that started after insmod (i.e. the mm and cred pointers aren't valid

2012-09-11 20:16:44 +00:00

psxview.py

Linux - remove unnecesary TODOs and change some to FUTURE

2012-09-10 20:12:35 +00:00

route_cache.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

sk_buff_cache.py

Minor pylint tidy up.

2012-10-14 01:00:31 +00:00

slab_info.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

tmpfs.py

remove some unnecessary variable reassignments in linux_tmpfs

2013-02-22 14:16:19 +00:00

tty_check.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

vma_cache.py

move the linux_common.get_partial_path() function to a dentry object class method

2013-02-19 20:52:38 +00:00