volatilityfoundation-volatility

addrspaces

Mac - update macho address space to not use add_types

2013-01-21 20:43:39 +00:00

gui

add a new set of message hook offsets for win32k.sys 5.1.2600.6149

2012-11-12 19:53:39 +00:00

linux

Linux - add joes check evt arm patch

2013-01-29 01:05:51 +00:00

mac

Mac - fix dump_maps

2013-01-31 23:41:20 +00:00

malware

fix yarascan to skip MM_MAX_COMMIT on wow64. also see issue #306 . we fixed vaddump and svcscan etc a while ago but missed yarascan

2013-01-27 05:26:03 +00:00

overlays

remove unused import from mac.py

2013-01-31 22:56:33 +00:00

registry

shellbags: added a few bugfixes and added support for UserAssist data, since it can appear in some shellbag keys

2013-01-23 22:06:19 +00:00

__init__.py

Deprecate the semi-colon separated plugin syntax and follow the help message.

2012-09-14 15:14:37 +00:00

bioskbd.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00

common.py

Apply basic windows restrictions to most windows plugins.

2012-05-18 09:53:27 +00:00

connections.py

a column length is not needed for Pid in connections, because its the last column on the right

2013-01-17 01:10:58 +00:00

connscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

crashinfo.py

Speed up crashdump by not searching for an unnecessary virtual space.

2012-10-14 01:10:57 +00:00

dlldump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

envars.py

per request, move envars plugin to a separate file in core

2012-06-12 13:26:55 +00:00

evtlogs.py

slight change to allow access to raw timestamps

2012-12-13 17:03:42 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

remove an extranous / unnecessary import statement in filescan.py

2013-01-06 02:01:21 +00:00

getservicesids.py

Basic pylint fixes for getservicesids.

2012-09-20 21:51:30 +00:00

getsids.py

Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.

2012-05-14 23:06:56 +00:00

handles.py

Convert handles plugin across to using table formatting.

2012-05-22 08:27:12 +00:00

hibinfo.py

small fix: the header is actually PO_MEMORY_IMAGE not IMAGE_HIBER_HEADER

2012-08-30 13:35:10 +00:00

hpakinfo.py

a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set

2012-11-22 02:55:52 +00:00

iehistory.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

imagecopy.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00

imageinfo.py

kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268

2012-06-12 22:49:32 +00:00

kdbgscan.py

Ensure that kdbgscan ignores non-windows profiles.

2012-08-19 10:16:20 +00:00

kpcrscan.py

kpcrscan is more verbose now

2012-06-18 14:34:14 +00:00

mbrparser.py

added is_bootable_and_used() as a better check for the partition table since we need a bootable partition that is valid and non-empty

2012-11-13 21:31:42 +00:00

mftparser.py

Small fix in body output. Thanks to Bart I. for reporting!

2013-01-15 13:53:19 +00:00

moddump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

modscan.py

Convert over modscan and thrdscan to the table formatting.

2012-05-22 08:27:19 +00:00

modules.py

add the unloadedmodules plugin for detecting recently loaded but then quickly unloaded drivers

2012-11-21 20:26:55 +00:00

netscan.py

Fix a minor error in netscan, and pylint the rest of the recently changed code.

2012-07-12 20:00:04 +00:00

patcher.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

privileges.py

add the privileges plugin

2012-11-20 21:38:46 +00:00

procdump.py

remove the outfd parameter to ProcExeDump.get_code, get_image, and dump_pe. this addresses item 4 from comment #5 of issue #291 . the API breakage is documented on the APIChangePerVersion wiki page

2012-08-10 15:08:07 +00:00

pstree.py

the task_info dictionary in pstree is unnecessary

2012-06-18 15:07:54 +00:00

raw2dmp.py

Fix direct use of config.LOCATION to find the size of an image.

2012-10-04 20:23:51 +00:00

sockets.py

increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)

2013-01-17 01:13:27 +00:00

sockscan.py

increase the width of the Pid column for sockets and sockscan so we don't display something like 22...3 when the Pid is larger than normal (for when we find partially recycled socket pools)

2013-01-17 01:13:27 +00:00

ssdt.py

Apply basic windows restrictions to most windows plugins.

2012-05-18 09:53:27 +00:00

strings.py

automatically translate kernel addresses in the strings output to identify the owning kernel module. fixes issue #363

2013-01-17 02:12:52 +00:00

taskmods.py

prevent volatility argument parser from silently ignoring when people accidentally enter non-intergers as the -p argument. note: this has nothing to do with being able to enter comma separated value strings like -p 2,3,4 its preventing things like -p foo. fixes issue #279

2013-01-05 20:11:56 +00:00

userassist.py

Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.

2012-05-14 23:06:56 +00:00

vadinfo.py

apply a remedy for issue 306 - vaddump on wow64 processes with MM_MAX_COMMIT. we don't want to dump these multi terabyte ranges with no valid pages. see issue 306 for details and analysis...the issue will remain open while we consider other ways to address the problem, however this patch should resolve it well enough for the stability of the 2.1 release

2012-07-24 14:47:37 +00:00

vboxinfo.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

vmwareinfo.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

volshell.py

all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles

2012-08-26 17:14:46 +00:00