B Lebel aeaeda538a Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

..

addrspaces

proto and trans PTEs are windows specific

2015-05-15 11:46:55 -04:00

gui

converted deskscan

2015-04-08 14:28:56 -04:00

linux

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

mac

backtrace in mac_strings when using -p

2015-04-24 15:15:16 -05:00

malware

Merge pull request #188 from TakahiroHaruyama/ignore_fake_ret

2015-04-01 22:42:21 -05:00

overlays

fixing small error

2015-06-03 12:02:40 -04:00

registry

initial commit of amcache plugin

2015-06-03 16:20:01 -04:00

__init__.py

Match the help message to the plugin path separator.

2013-03-27 08:51:26 +00:00

bigpagepools.py

more pretty print

2015-03-18 11:14:55 +00:00

bioskbd.py

more pretty print

2015-03-18 11:14:55 +00:00

cmdline.py

more pretty print

2015-03-18 11:14:55 +00:00

common.py

determine V or P offset based on self._config.VIRTUAL for scanners

2014-03-03 09:39:11 -06:00

connections.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

connscan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

crashinfo.py

converted crashinfo

2015-02-23 09:08:10 -05:00

dlldump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

drivermodule.py

Unified output for drivermodule plugin.

2015-05-18 10:57:30 -04:00

dumpcerts.py

small mod to dumpcerts so the rules and type_map can be accessed by another plugin without having to create an instance of DumpCerts()

2015-04-01 20:52:57 -05:00

dumpfiles.py

removing unneeded comments

2015-03-16 11:44:14 +00:00

envars.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

evtlogs.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

fileparam.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

filescan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

getservicesids.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

getsids.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

handles.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

heaps.py

add the heaps profile modification

2014-01-17 20:59:31 -06:00

hibinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

hpakinfo.py

better fixes to the hpak extract / decompress function

2014-06-16 12:27:31 -05:00

iehistory.py

refs #206 limit iehistory scan to vads that contain index.dat

2015-04-02 09:17:49 -05:00

imagecopy.py

enhance debug output for image copy errors

2014-06-21 09:48:59 -05:00

imageinfo.py

Unified output for imageinfo plugin.

2015-05-13 16:35:19 -04:00

joblinks.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

kdbgscan.py

refs #74 enhance kdbgscan performance for win8/2012 x64

2014-08-18 19:23:49 -05:00

kpcrscan.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

machoinfo.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

mbrparser.py

converting mbrparser

2015-03-17 11:54:58 +00:00

mftparser.py

mftparser: fixing unified output

2015-05-22 20:20:33 -04:00

moddump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

modscan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

modules.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

multiscan.py

Remove invalid callbacks from multiscan for Windows XP and earlier

2015-04-10 18:41:48 +02:00

netscan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

notepad.py

add the notepad plugin

2014-07-12 10:27:20 -05:00

objtypescan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

patcher.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

patchguard.py

update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)

2014-03-30 11:11:37 +02:00

pooltracker.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

privileges.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

procdump.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

pstree.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

raw2dmp.py

refs #89 fixing raw2dmp - make sure to set the DumpType since its now an assertion in the crash AS

2014-09-17 19:10:37 -05:00

sockets.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

sockscan.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

ssdt.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

strings.py

fix a bug in strings translation

2015-01-04 15:50:31 -06:00

taskmods.py

adding back pretty printing.

2015-03-18 09:59:02 +00:00

tcaudit.py

spelling correction

2014-12-15 15:24:44 -05:00

timeliner.py

removed unneeded import

2014-12-29 15:10:31 -05:00

vadinfo.py

vadinfo: small fixups

2015-04-08 14:41:14 -04:00

vboxinfo.py

add qemuinfo plugin

2015-04-01 22:24:11 -05:00

verinfo.py

small fix spotted by Beni U.

2015-02-02 11:08:43 -05:00

vmwareinfo.py

override is_valid_profile for vmwareinfo since its applies to linux/mac

2014-06-20 13:31:48 -05:00

volshell.py

refs #54 displaying types with dynamic attributes (i.e. callable offsets) is not supported in volshell

2014-08-16 14:49:54 -05:00