iMHLv2 60404a00a2 some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.

2012-04-11 13:49:36 +00:00

..

addrspaces

Add in gleeda's awesome hibernation patch!

2012-04-06 22:40:55 +00:00

malware

some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.

2012-04-11 13:49:36 +00:00

overlays

fudge the build number for win2003sp2 to be 5.2.3791. currently it conflicts with win2003sp1 using 5.2.3790 and there's no way to differentiate other than using __class__.__name__ which we're trying to avoid. also fixup the hibernate profile mod so it still applies to all win2003.

2012-04-10 19:58:01 +00:00

registry

fix a NoneType is not iterable error in hashdump.py. after doing that, it was realized that a debug.error statement in HashDump.render_text was preventing the plugin from finishing so it was changed to debug.debug.

2012-04-02 16:16:19 +00:00

__init__.py

Merge branch 'local/noregistry' into local/trunk

2012-03-08 23:39:19 +00:00

bioskbd.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

common.py

Change pool_alignment fix from r1271, so that none-plugins don't turn up as plugins.

2012-01-21 11:50:30 +00:00

connections.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

connscan.py

Remove all unnecessary trailing slashes.

2012-02-26 23:26:52 +00:00

crashinfo.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

dlldump.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

update modscan, filescan, and driverscan to suppress NoneObject as string warnings (see r1563).

2012-03-23 14:17:51 +00:00

getsids.py

add a get_token() method to _EPROCESS. add a _TOKEN object class with get_sids() method. modify the getsids.py plugin to use these new APIs. the _TOKEN object class will later be subclassed in the Vista profile when we add the privileges plugin. also adds sanity checks to _TOKEN objects and thus Fixes Issue #176.

2012-03-13 15:06:02 +00:00

handles.py

Add in encoding support in strings.

2012-03-21 23:25:23 +00:00

hibinfo.py

Remove the old handmade KGDTENTRY vtypes. Fixes issue 211.

2012-02-18 11:01:17 +00:00

imagecopy.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

imageinfo.py

change how the PEB.CSDVersion string in imageinfo and the function name string in _LDR_DATA_TABLE_ENTRY.getprocaddress() are handled

2012-04-10 01:07:11 +00:00

kdbgscan.py

Remove while 1 loop from scanning code.

2012-04-06 22:30:26 +00:00

kpcrscan.py

Remove while 1 loop from scanning code.

2012-04-06 22:30:26 +00:00

moddump.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

modscan.py

update modscan, filescan, and driverscan to suppress NoneObject as string warnings (see r1563).

2012-03-23 14:17:51 +00:00

modules.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

netscan.py

Remove all unnecessary trailing slashes.

2012-02-26 23:26:52 +00:00

patcher.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

procdump.py

fix a bug in all plugins that inherit from ProcExeDump. in particular, they crash when extracting a PE whose size of headers (nt_header.OptionalHeader.SizeOfHeaders) encompasses one or more pages that are unavailable. use zread instead of read.

2012-04-10 17:09:08 +00:00

pstree.py

Backported the pstree fix which would cause it to fail when pid/ppid relations were circular.

2012-04-06 17:36:21 +00:00

sockets.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

sockscan.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

ssdt.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

strings.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

taskmods.py

few modifications to strings in dlllist's output. this may end up just being temporary if other changes to unicode strings are made to the core, but might as well keep them consistent with how other plugins are printing strings at the moment.

2012-04-10 16:32:51 +00:00

userassist.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

vadinfo.py

since at least r630 we've been instantiating the root vad (EPROCESS.VadRoot) in kernel AS and all child nodes in process AS. in r1548 we attemped to add consistency and instantiate all from process AS, but that was the wrong decision. this patch reverts the changes made in r1548 and ensures all MMVADs are in kernel AS but that actual vad data comes from process AS. the get_data() and get_vads() helpers go away. we introduce some helper APIs for the malware plugins to filter vads based on MMVAD flags and data

2012-04-07 16:02:15 +00:00

volshell.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00