volatilityfoundation-volatility

addrspaces

make all run based address spaces writeable. without it, the higher level support in IA32, IA32PAE, and AMD64 for writing has no effect

2014-07-06 16:19:52 -05:00

gui

closes #28 session image lists aren't maintained in win8/2012

2014-07-18 14:38:30 -05:00

linux

Linux - move ldrmodules to overlay

2014-07-26 14:08:40 -05:00

mac

Update mac and linux yarascan to resprect name option

2014-07-22 00:51:19 -05:00

malware

svcscan: removing unused variable and making sure to avoid nulls in values

2014-07-25 20:06:39 -04:00

overlays

Linux - move ldrmodules to overlay

2014-07-26 14:08:40 -05:00

registry

fixing printkey to print out the registry name even if the registry was specified by offset on commandline

2014-07-18 16:39:15 -04:00

__init__.py

Match the help message to the plugin path separator.

2013-03-27 08:51:26 +00:00

bigpagepools.py

apply an overlay for _POOL_TRACKER_BIG_PAGES.Key

2014-06-22 12:42:16 -05:00

bioskbd.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

cmdline.py

add command line windows plugin

2014-05-29 22:02:48 -05:00

common.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

connections.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

connscan.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

crashinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

dlldump.py

update error message when pe dumping plugins fail

2014-06-19 19:27:56 -05:00

dumpcerts.py

condense ProcExeDump and ProcMemDump

2014-01-27 18:20:25 -06:00

dumpfiles.py

display possible dumpfiles filters in the --help menu

2014-06-27 19:28:59 -04:00

envars.py

add the --silent flag to envars, to mask well known environment variables

2014-01-28 10:16:50 -06:00

evtlogs.py

moving remove_printable into utils since it's in more than one place

2014-07-10 15:21:50 -04:00

fileparam.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

filescan.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

getservicesids.py

changing email

2014-07-08 18:36:25 -04:00

getsids.py

resolve user and service sids in getsids

2014-02-27 09:38:26 -06:00

handles.py

extending the handle type column to accomodate handle types like WaitCompletionPacket

2014-06-26 16:58:12 -04:00

heaps.py

add the heaps profile modification

2014-01-17 20:59:31 -06:00

hibinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

hpakinfo.py

better fixes to the hpak extract / decompress function

2014-06-16 12:27:31 -05:00

iehistory.py

iehistory plugin didn't adhere to --offset correctly

2014-01-23 21:55:47 -08:00

imagecopy.py

enhance debug output for image copy errors

2014-06-21 09:48:59 -05:00

imageinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

joblinks.py

adding back full path

2014-07-10 13:14:07 -04:00

kdbgscan.py

refs #12 fixing the --kdbg parameter on win8/2012 x64

2014-01-27 16:02:14 -06:00

kpcrscan.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

machoinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

mbrparser.py

changing email

2014-07-08 18:36:25 -04:00

mftparser.py

few more cleanups

2014-07-14 18:48:21 -04:00

moddump.py

condense ProcExeDump and ProcMemDump

2014-01-27 18:20:25 -06:00

modscan.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

modules.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

multiscan.py

multiscanner plugin works for callbacks on x64

2014-07-10 23:51:51 -05:00

netscan.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

notepad.py

add the notepad plugin

2014-07-12 10:27:20 -05:00

objtypescan.py

adding the objtypescan plugin

2014-07-12 11:05:23 -05:00

patcher.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

patchguard.py

update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)

2014-03-30 11:11:37 +02:00

pooltracker.py

only apply PoolTrackTagOverlay to windows profiles

2014-07-12 17:57:36 -05:00

privileges.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

procdump.py

closes #42 patch from Matt McCormack to fix dumped PE file image base with --fix option

2014-07-18 12:24:40 -05:00

pstree.py

catch exceptions in pstree when duplicate child/parents are found

2014-03-07 14:56:29 -06:00

raw2dmp.py

breaking out the bulk of raw2dmp into a @staticmethod for accessibility from other plugins / frameworks

2014-07-17 13:07:08 -05:00

sockets.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

sockscan.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

ssdt.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

strings.py

oops, virtual addresses in strings output should still be in hex

2014-03-13 11:35:27 -05:00

taskmods.py

clarify the --physical-offset parameter to pslist

2014-06-14 18:52:43 -05:00

tcaudit.py

setting a minimum tc password length (prevents FPs)

2014-07-16 10:00:10 -05:00

timeliner.py

making sure not to run commands that are not supported

2014-07-16 18:41:11 -04:00

vadinfo.py

adding comments about changes. ref: issue #49

2014-07-11 11:37:23 -04:00

vboxinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

verinfo.py

move some PE file version information code to APIs

2014-07-13 22:07:34 -05:00

vmwareinfo.py

override is_valid_profile for vmwareinfo since its applies to linux/mac

2014-06-20 13:31:48 -05:00

volshell.py

add a recursive option to volshell's dt() command

2014-06-14 18:52:42 -05:00