iMHLv2 d15e9e252e yet another attempt to fix the negative numbers in vm_area_struct for linux when using proc_maps

2013-04-02 11:24:23 +00:00

..

__init__.py

Merge in most of linux-support.

2012-08-16 11:00:06 +00:00

arp.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

bash.py

indicate the process ID and name in which bash history was found (it may not always be a process named bash, or there may be multiple bash processes running)

2013-04-02 04:00:53 +00:00

check_afinfo.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

check_creds.py

Linux - remove block string comment from check_creds.py. moving the comment to wiki command reference

2012-09-10 16:40:11 +00:00

check_evt_arm.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_fops.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

check_idt.py

linux check_idt, null/unimplemented handlers shouldn't be reported as HOOKED

2013-03-25 16:00:52 +00:00

check_modules.py

Linux - PEP8 in check_modules.py, fix plugin description, move block string comment to wiki command reference

2012-09-10 15:47:55 +00:00

check_syscall_arm.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

check_syscall.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

common.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

cpuinfo.py

move online_cpus, get_per_cpu_symbol, and walk_per_cpu_var from AbstractLinuxCommand into linux_cpuinfo

2013-02-19 18:04:31 +00:00

dentry_cache.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

dmesg.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

dump_map.py

fix linux_dump_maps plugin: inherit from proc_maps for -p option, replace --outfile with --dump-dir so we can write multiple VMAs to separate files, use table_header/table_row for a summary. spotted by Edwin Smulders

2013-03-07 15:58:19 +00:00

find_file.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

flags.py

create a Flags object for handling rwx, r-x style output for linux, instead of using the format_perms() method attached to a specific plugin

2013-02-12 20:27:29 +00:00

ifconfig.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

iomem.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

keyboard_notifier.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

linux_volshell.py

add an initial mac_volshell plugin

2013-02-04 15:15:05 +00:00

linux_yarascan.py

add a description to the linux_volshell command

2013-02-22 15:33:48 +00:00

lsmod.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

lsof.py

Pylint, formatting and styles fixes for all linux plugins.

2012-09-10 15:06:57 +00:00

mount_cache.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

mount.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

netstat.py

bring the IGNORE_UNIX option back to linux_netstat. it was deleted it r2808 but the variable self._config.IGNORE_UNIX is still referenced in code

2013-02-22 18:31:28 +00:00

pidhashtable.py

fix a typo in an error message - linux_pidhashtable

2013-03-29 22:41:10 +00:00

pkt_queues.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

proc_maps.py

yet another attempt to fix the negative numbers in vm_area_struct for linux when using proc_maps

2013-04-02 11:24:23 +00:00

psaux.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

pslist_cache.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

pslist.py

move the linux get_task_start_time() API out of AbstractLinuxCommand - put it in the task_struct object class

2013-02-19 17:58:44 +00:00

pstree.py

remove some whitespace in linux_pstree

2013-03-07 15:37:31 +00:00

psxview.py

Linux - remove unnecesary TODOs and change some to FUTURE

2012-09-10 20:12:35 +00:00

route_cache.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

sk_buff_cache.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

slab_info.py

replace all the calls to self.get_profile_symbol() from linux plugins, use self.addr_space.profile.get_symbol() instead

2013-02-19 17:42:25 +00:00

tmpfs.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00

tty_check.py

small whitespace in linux_tty_check

2013-03-28 16:42:00 +00:00

vma_cache.py

add **kwargs for all linux plugins

2013-03-07 15:28:36 +00:00