volatilityfoundation-volatility

Linux - switch a minor status information from debug.warning to debug.debug in arm.py

2013-09-25 15:45:40 +00:00

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

linux

Linux - make linux_find_file more API family

2013-09-25 23:51:10 +00:00

mac

Mac - change lsof instantiation to inherit command line options

2013-06-05 01:41:58 +00:00

malware

DiscontigYaraScanner should honor maxlen if its specified

2013-08-14 15:07:45 +00:00

overlays

Linux - check for paged out command line args before reading

2013-09-24 17:51:58 +00:00

registry

fixed a small bug

2013-03-07 16:29:23 +00:00

__init__.py

Match the help message to the plugin path separator.

2013-03-27 08:51:26 +00:00

bioskbd.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00

common.py

Apply basic windows restrictions to most windows plugins.

2012-05-18 09:53:27 +00:00

connections.py

a column length is not needed for Pid in connections, because its the last column on the right

2013-01-17 01:10:58 +00:00

connscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

crashinfo.py

this patch changes inheritance with address spaces. amd64 and ARM no longer inherit from intel, which didn't make sense to begin with. vmware, virtualbox, and crash (and several others) are now run based address spaces instead of base address spaces. AS that are not purely virtual (like amd64 and intel) should not have a vtop(), rather we use a common translate(). patch mostly written by ikelos and aaron, tested by MHL

2013-05-13 14:33:43 +00:00

dlldump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

dumpcerts.py

Windows - add debug import to dumpcerts

2013-06-16 06:02:02 +00:00

envars.py

per request, move envars plugin to a separate file in core

2012-06-12 13:26:55 +00:00

evtlogs.py

fix evtlogs to detect and skip corrupt records (based on invalid SID length). spotted by Wyatt Roersma

2013-02-21 18:01:41 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

the creation time column of symlinkscan plugin elides

2013-05-29 12:49:46 +00:00

getservicesids.py

Basic pylint fixes for getservicesids.

2012-09-20 21:51:30 +00:00

getsids.py

Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.

2012-05-14 23:06:56 +00:00

handles.py

Convert handles plugin across to using table formatting.

2012-05-22 08:27:12 +00:00

hibinfo.py

small fix: the header is actually PO_MEMORY_IMAGE not IMAGE_HIBER_HEADER

2012-08-30 13:35:10 +00:00

hpakinfo.py

a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set

2012-11-22 02:55:52 +00:00

iehistory.py

making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319

2013-02-06 00:02:16 +00:00

imagecopy.py

patch to imageinfo and hibernation file address space to default to zread on unreadable data

2013-04-08 20:24:53 +00:00

imageinfo.py

kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268

2012-06-12 22:49:32 +00:00

kdbgscan.py

Ensure that kdbgscan ignores non-windows profiles.

2012-08-19 10:16:20 +00:00

kpcrscan.py

Cleaning up and consolidating the IA32 and AMD64 address spaces

2013-05-14 20:21:18 +00:00

machoinfo.py

add the machoinfo plugin

2013-04-06 15:26:58 +00:00

mbrparser.py

s/^0x// from the beginning of Hex output for mbrparser

2013-08-21 14:36:19 +00:00

mftparser.py

some minor fixups to is_valid() functions for mftparser

2013-05-24 23:59:53 +00:00

moddump.py

fix a % to format() in moddump

2013-02-05 20:09:37 +00:00

modscan.py

making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319

2013-02-06 00:02:16 +00:00

modules.py

modules plugin: small fix for UnicodeEncodeError

2013-07-10 20:38:53 +00:00

netscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

patcher.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

privileges.py

add the privileges plugin

2012-11-20 21:38:46 +00:00

procdump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

pstree.py

fixed output in pstree to show full time. it was chopped off after updating the timestamps to UTC. fixes issue 389

2013-03-07 14:23:52 +00:00

raw2dmp.py

the last patch to finalize raw2dmp support for all address spaces. 1) fixed method of patching the kernel CONTEXT for when the KPCR does not fully land inside a BLOCKSIZE chunk 2) adjust the calculation for number of pages in the crash dump to better handle run-based address spaces 3) enable write support for crash

2013-02-10 20:04:42 +00:00

sockets.py

increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)

2013-01-17 01:13:27 +00:00

sockscan.py

increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)

2013-01-17 01:13:27 +00:00

ssdt.py

use distorm3's DecomposeGenerator instead of Decompose, otherwise large amounts of memory can be consumed when data is all decomposed at once. fixes issue #400 reported by carl pulley

2013-04-03 16:25:48 +00:00

strings.py

change Strings.parse_line() to staticmethod so it can be used in other plugins without inheritance

2013-08-20 20:22:12 +00:00

taskmods.py

convert DllList.virtual_process_from_physical_offset() from a plugin class method into a @staticmethod so it can be used/called by external code

2013-07-03 15:23:08 +00:00

timeliner.py

move the timeliner plugin from the contrib folder into core (so it will be in the compiled pyinstaller exe and because its used frequently by volatility users

2013-07-03 20:09:40 +00:00

userassist.py

making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319

2013-02-06 00:02:16 +00:00

vadinfo.py

apply a remedy for issue 306 - vaddump on wow64 processes with MM_MAX_COMMIT. we don't want to dump these multi terabyte ranges with no valid pages. see issue 306 for details and analysis...the issue will remain open while we consider other ways to address the problem, however this patch should resolve it well enough for the stability of the 2.1 release

2012-07-24 14:47:37 +00:00

vboxinfo.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

vmwareinfo.py

cleanup the vmwareinfo plugin and allow it to dump/extract the PNG screenshot upon request

2013-05-15 14:30:55 +00:00

volshell.py

volshell: modified to allow 16bit disassembly if specified

2013-06-04 14:38:38 +00:00