mike.auty@gmail.com 54a987d2cd Remove VolatilityMagic for HiveListOffset and HiveListPoolSize, since these can be calculated from the profiles directly.

2012-01-18 12:42:35 +00:00

..

addrspaces

Add in 64-bit address space support.

2012-01-04 22:22:54 +00:00

overlays

Remove VolatilityMagic for HiveListOffset and HiveListPoolSize, since these can be calculated from the profiles directly.

2012-01-18 12:42:35 +00:00

registry

Remove VolatilityMagic for HiveListOffset and HiveListPoolSize, since these can be calculated from the profiles directly.

2012-01-18 12:42:35 +00:00

__init__.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

bioskbd.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

common.py

Add in pool alignment changes for future profile types.

2012-01-02 14:19:36 +00:00

connections.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

connscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

crashinfo.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

dlldump.py

allow dlldump to work on PE's not in the PEB list. remove try/except block from moddump. Fixes Issue #109

2011-11-30 18:25:17 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

Add in pool alignment changes for future profile types.

2012-01-02 14:19:36 +00:00

getsids.py

added two more known sids (http://support.microsoft.com/kb/956572)

2011-09-02 21:40:38 +00:00

handles.py

create an object class for _CM_KEY_BODY and remove the full_key_name function from handles plugin

2011-12-31 23:13:48 +00:00

hibinfo.py

Remove hibdump in favour of the generic imagecopy plugin.

2011-07-27 22:07:01 +00:00

imagecopy.py

Allow overwriting of empty files using imagecopy.

2011-11-25 08:33:13 +00:00

imageinfo.py

Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.

2011-10-01 16:19:51 +00:00

kdbgscan.py

Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.

2011-10-01 16:19:51 +00:00

kpcrscan.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

moddump.py

allow dlldump to work on PE's not in the PEB list. remove try/except block from moddump. Fixes Issue #109

2011-11-30 18:25:17 +00:00

modscan.py

Rename nativevm to native_vm to improve readability and fix muscle-memory typos.

2011-12-30 15:37:51 +00:00

modules.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

netscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

patcher.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

procdump.py

create object classes for PE header structs, add sanity checks for MZ and PE signatures. Fixes Issue #155

2011-10-27 23:41:33 +00:00

pstree.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

sockets.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

sockscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

ssdt.py

Ensure SSDT only runs on profiles that work correctly.

2012-01-13 23:43:01 +00:00

strings.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

taskmods.py

move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160

2011-10-26 20:10:43 +00:00

unittests.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

userassist.py

userassist: replaced old hexdump function w/new one

2011-09-09 14:49:31 +00:00

vadinfo.py

add textual vad protection and vad type output to vadinfo. Fixes Issue #143

2012-01-11 19:49:27 +00:00

volshell.py

allow volshell's dt() to accept an address space, handle callable offsets/members. Fixes Issue #172

2011-12-14 21:30:57 +00:00