B Lebel aeaeda538a Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

..

__init__.py

Merge in most of linux-support.

2012-08-16 11:00:06 +00:00

apihooks.py

adding back render_text to linux_apihooks because

2014-12-02 19:05:39 -05:00

arp.py

Linux - update ARP API

2014-07-25 09:26:12 -07:00

banner.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

bash_hash.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

bash.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_afinfo.py

Linux - update lsof & netstat api

2014-07-26 18:50:39 -05:00

check_creds.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_evt_arm.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

check_fops.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_idt.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_inline_kernel.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_modules.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_syscall_arm.py

converted linux_check_syscall_arm

2014-12-02 13:57:33 -05:00

check_syscall.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

common.py

Linux - unify elf dumping plugins

2015-01-05 12:30:27 -06:00

cpuinfo.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

dentry_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

dmesg.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

dump_map.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

elfs.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

enumerate_files.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

find_file.py

Linux - fix find_file bug

2015-03-03 13:30:02 -06:00

flags.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

getcwd.py

Linux - add linux_getcwd

2014-10-24 12:33:24 -05:00

hidden_modules.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

ifconfig.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

info_regs.py

Linux - restrict info_regs to Intel samples

2014-12-02 21:41:06 -06:00

iomem.py

Linux - update iomem from book vm

2014-03-20 14:03:46 -05:00

kernel_opened_files.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

keyboard_notifiers.py

Linux - rename keyboard_notifier to keyboard_notifiers

2014-05-27 09:23:59 -05:00

ld_env.py

Linux - update dynamic_env

2015-02-09 11:57:48 -06:00

ldrmodules.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

libc_env.py

Linux - update dynamic environment handling

2015-02-09 11:47:08 -06:00

library_list.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

librarydump.py

Linux - unify elf dumping plugins

2015-01-05 12:30:27 -06:00

lime.py

Linux - add the new limeinfo plugin

2014-03-20 14:57:56 -05:00

linux_strings.py

refs #15 fix a few bugs in the linux strings plugin

2014-01-28 16:22:54 -06:00

linux_truecrypt.py

add linux true crypt passphrase plugin

2014-05-27 11:05:21 -05:00

linux_volshell.py

Linux - speed up virtual_process_from_physical_offset

2014-10-06 14:55:12 -05:00

linux_yarascan.py

Update mac and linux yarascan to resprect name option

2014-07-22 00:51:19 -05:00

list_raw.py

Linux - find list_raw bug

2014-12-02 21:18:47 -06:00

lsmod.py

remove old debug statement

2014-09-18 00:49:36 -05:00

lsof.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

malfind.py

Linux - move malfind to overlays

2014-07-26 19:20:07 -05:00

mount_cache.py

Linux - fix mount_cache

2014-12-02 22:04:40 -06:00

mount.py

Linux - protect against corruption in mount data structures

2014-12-29 17:09:21 -06:00

netfilter.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

netscan.py

Linux - update netscan

2015-02-10 00:03:55 -06:00

netstat.py

linux - update netstat api

2014-09-09 20:23:04 -05:00

pidhashtable.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

pkt_queues.py

Linux - update pkt quues to new netstat interface

2014-06-25 16:24:49 -05:00

plthook.py

Linux - update APIs

2014-08-15 11:11:09 -05:00

proc_maps_rb.py

Linux - add all the new plugins from book

2014-03-20 15:10:48 -05:00

proc_maps.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

procdump.py

Linux - unify elf dumping plugins

2015-01-05 12:30:27 -06:00

process_hollow.py

Linux - fix bug in linux_process_hollow

2014-06-25 16:27:00 -05:00

process_info.py

Linux - edit plugin

2014-07-12 23:31:44 -05:00

process_stack.py

Linux - add all the new plugins from book

2014-03-20 15:10:48 -05:00

psaux.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

psenv.py

adding back pretty printing

2015-03-18 11:01:39 +00:00

pslist_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

pslist.py

linux_pslist: removing extra indent

2015-03-19 16:13:07 +00:00

pstree.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

psxview.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

recover_filesystem.py

Linux - update description strings

2014-08-03 17:12:11 -05:00

route_cache.py

Linux - linux_route_cache - add optional hostname resolution

2014-05-27 09:20:15 -05:00

sk_buff_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

slab_info.py

Linux - fix bug in dentry cache reported by Golden

2014-05-27 08:04:59 -05:00

threads.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

tmpfs.py

Linux - update tmpfs help menu

2015-02-07 16:07:24 -06:00

tty_check.py

Linux - tty check

2014-04-15 16:17:31 -05:00

vma_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00