volatilityfoundation-volatility

__init__.py

2012-10-13 21:31:29 +00:00

arp.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

check_syscall_table.py

make the changes described in r3125 to the new mac check_syscall plugin

2013-02-19 23:58:46 +00:00

check_sysctl.py

fix the mac_check_sysctl for 10.7.x

2013-04-05 05:06:03 +00:00

check_trap_table.py

fix the plugin description for mac_check_trap_table plugin

2013-04-08 14:28:31 +00:00

common.py

remove the random printme variable in mac common

2013-04-05 04:49:41 +00:00

dead_procs.py

rename the file containing the mac_dead_procs plugin

2013-03-31 21:45:04 +00:00

dmesg.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

dump_map.py

Mac - fix dump_maps

2013-01-31 23:41:20 +00:00

find_aslr_shift.py

Mac - change header of find_aslr_shift

2013-03-30 00:03:56 +00:00

ifconfig.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

ip_filters.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

list_zones.py

Mac - update list zones to support < 10.8.x

2013-03-31 16:04:37 +00:00

ls_logins.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

lsmod.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

lsof.py

add a FIXME comment to mac_lsof to say when and why we should replace the current code

2013-04-03 16:15:04 +00:00

mac_volshell.py

Mac - update volshell to inherit from mac_tasks

2013-03-31 21:56:51 +00:00

mac_yarascan.py

change the description for mac_yarascan plugin

2013-04-07 16:32:28 +00:00

machine_info.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

mount.py

Mac - expand print size for larger mount points

2013-03-29 23:23:12 +00:00

netstat.py

prevent 'NoneObject as string: Pointer f_fglob invalid' message when using mac_netstat

2013-04-01 01:11:25 +00:00

notifiers.py

modify convert.py to properly handle mac classes. update the mac_notifiers plugin to choose the correct vtype name based on whether the target OS uses struct or class naming convention

2013-04-05 03:32:10 +00:00

pgrp_hash_table.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

pid_hash_table.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

print_boot_cmdline.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

proc_maps.py

add an API to mac's proc object for enumerating process memory regions (proc.get_proc_maps())

2013-04-03 14:28:25 +00:00

psaux.py

prevent NoneObject Pointer task invalid warning in mac_psaux

2013-04-04 21:23:01 +00:00

pslist.py

prevent a 'NoneObject as string: Pointer task invalid' message when accessing a dead/terminated processe's task object

2013-04-03 20:49:32 +00:00

pstasks.py

Mac - implement pid filtering logic in mac_tasks

2013-03-31 22:04:31 +00:00

pstree.py

small change to mac_pstree to remove while 1:

2013-04-01 16:54:44 +00:00

psxview.py

make mac_tasks inherit from mac_pslist so it prints the same columns as other process-related plugins. this requires changing what mac_tasks.calculate() yields from task objects to proc objects, and consequently we must update mac_psxview to expect proc objects

2013-03-31 21:32:17 +00:00

route.py

prevent mac_route from looping in some cases. replace while 1 with while rn.is_valid()

2013-04-01 16:36:32 +00:00

session_hash_table.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

trustedbsd.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

version.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00

vfs_events.py

Mac - remove the AbstractMacCommand.get_profile_symbol(), replace all the calls to that API with direct calls to AddressSpace.profile.get_symbol()

2013-02-19 23:54:47 +00:00