volatilityfoundation-volatility

addrspaces

Add APIs to paged address spaces (Intel x86 and AMD64 so far) to allow easy lookups of PTE flags.

2016-01-11 09:01:09 -05:00

gui

Added undo info for pre-Vista.

2016-05-03 20:51:40 +01:00

linux

Merge pull request #301 from haco20292/linux_dmesg_bugfix

2016-05-09 12:38:12 -07:00

mac

Merge pull request #297 from williamshowalter/mac-getprofile-10.11

2016-05-09 12:37:11 -07:00

malware

Update svcscan.py

2016-03-09 22:41:18 +01:00

overlays

Linux - fix overlay for uid/euid/gid

2016-05-09 14:20:47 -05:00

registry

shutdowntime: handle None value

2015-12-21 16:17:44 -05:00

__init__.py

Match the help message to the plugin path separator.

2013-03-27 08:51:26 +00:00

bigpagepools.py

big pools distance map should be an array, so we can store offsets for various versions of the same profile (this fixes registry plugins for a number of memory samples)

2015-12-15 11:35:42 -06:00

bioskbd.py

more pretty print

2015-03-18 11:14:55 +00:00

cmdline.py

more pretty print

2015-03-18 11:14:55 +00:00

common.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

connections.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

connscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

crashinfo.py

converted crashinfo

2015-02-23 09:08:10 -05:00

dlldump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

drivermodule.py

add a header and pydoc to the drivermodule plugin

2015-10-14 09:52:58 -05:00

dumpcerts.py

need to check for yara before using it

2015-08-26 15:48:43 -04:00

dumpfiles.py

removing unneeded comments

2015-03-16 11:44:14 +00:00

envars.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

evtlogs.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

fileparam.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

filescan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

getservicesids.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

getsids.py

update the well known SIDs for windows in getsids.py

2015-09-29 14:12:09 -05:00

handles.py

the --object-type/-t option to handles is no longer case sensitive

2015-10-12 15:20:06 -05:00

heaps.py

fixing address

2015-06-29 14:29:17 -04:00

hibinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

hpakinfo.py

better fixes to the hpak extract / decompress function

2014-06-16 12:27:31 -05:00

iehistory.py

refs #206 limit iehistory scan to vads that contain index.dat

2015-04-02 09:17:49 -05:00

imagecopy.py

Update imagecopy.py to provide bytes copied stats

2015-02-27 17:35:24 +00:00

imageinfo.py

Unified output for imageinfo plugin.

2015-05-13 16:35:19 -04:00

joblinks.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

kdbgscan.py

a better description of the --kdbg parameter for win 8 and above

2015-10-13 23:59:40 -05:00

kpcrscan.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

machoinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

mbrparser.py

converting mbrparser

2015-03-17 11:54:58 +00:00

mftparser.py

changes to mftparser

2015-06-08 20:11:03 -04:00

moddump.py

prevent the inherited --name option from displaying for moddump

2015-09-05 17:28:47 +02:00

modscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

modules.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

multiscan.py

Remove invalid callbacks from multiscan for Windows XP and earlier

2015-04-10 18:41:48 +02:00

netscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

notepad.py

add the notepad plugin

2014-07-12 10:27:20 -05:00

objtypescan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

patcher.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

patchguard.py

update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)

2014-03-30 11:11:37 +02:00

pooltracker.py

refs #66 prevent MemoryError in pool tracker plugin

2015-10-14 09:33:48 -05:00

privileges.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

procdump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

pstree.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

raw2dmp.py

refs #250 fix the raw2dmp plugin after the recent pull request (https://github.com/volatilityfoundation/volatility/pull/185 ) modified imagecopy

2015-10-13 19:33:57 -05:00

sockets.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

sockscan.py

allow the CheckPoolIndex value to be a callable as well as a single integer value - adds better support for pool scanning on big memory/cpu systems

2015-10-20 22:25:26 -05:00

ssdt.py

abort the parsing of windows ssdt structures if we encounter an invalid descriptor

2015-06-26 18:18:14 -05:00

strings.py

Merge pull request #243 from bridgeythegeek/master

2016-01-18 16:49:18 -05:00

taskmods.py

refs #672 ensure the memmap plugin's dumpfileoffset column is properly synced with the offsets of memdump's data.

2015-10-12 14:09:37 -05:00

tcaudit.py

prevent a backtrace on truecryptmaster when finding devices with invalid device extensions

2016-05-06 11:43:57 -05:00

timeliner.py

removed unneeded import

2014-12-29 15:10:31 -05:00

vadinfo.py

fix a bug info vadtree's dot renderer wrt fill color

2015-10-07 16:20:19 -04:00

vboxinfo.py

add qemuinfo plugin

2015-04-01 22:24:11 -05:00

verinfo.py

small fix spotted by Beni U.

2015-02-02 11:08:43 -05:00

vmwareinfo.py

override is_valid_profile for vmwareinfo since its applies to linux/mac

2014-06-20 13:31:48 -05:00

volshell.py

volshell: list_entry

2016-01-20 17:06:47 -05:00

win10cookie.py

add Win10x64 and Win10x86 profiles

2015-10-14 09:08:58 -05:00