iMHLv2 fc33d7dcce add threads plugin. fixes issue #249

2012-05-08 15:53:02 +00:00

..

addrspaces

Add in gleeda's awesome hibernation patch!

2012-04-06 22:40:55 +00:00

malware

add threads plugin. fixes issue #249

2012-05-08 15:53:02 +00:00

overlays

Add in generic IPv6 Address.

2012-05-03 19:19:29 +00:00

registry

Add in Gleeda's registryapi module and shimcache plugin.

2012-05-06 23:16:26 +00:00

__init__.py

Merge branch 'local/noregistry' into local/trunk

2012-03-08 23:39:19 +00:00

bioskbd.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

common.py

Change pool_alignment fix from r1271, so that none-plugins don't turn up as plugins.

2012-01-21 11:50:30 +00:00

connections.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

connscan.py

Remove all unnecessary trailing slashes.

2012-02-26 23:26:52 +00:00

crashinfo.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

dlldump.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

update modscan, filescan, and driverscan to suppress NoneObject as string warnings (see r1563).

2012-03-23 14:17:51 +00:00

getsids.py

add a get_token() method to _EPROCESS. add a _TOKEN object class with get_sids() method. modify the getsids.py plugin to use these new APIs. the _TOKEN object class will later be subclassed in the Vista profile when we add the privileges plugin. also adds sanity checks to _TOKEN objects and thus Fixes Issue #176.

2012-03-13 15:06:02 +00:00

handles.py

Add in encoding support in strings.

2012-03-21 23:25:23 +00:00

hibinfo.py

Remove the old handmade KGDTENTRY vtypes. Fixes issue 211.

2012-02-18 11:01:17 +00:00

imagecopy.py

Fix inconsistency in commands.command class capitalization.

2012-02-05 23:36:33 +00:00

imageinfo.py

change how the PEB.CSDVersion string in imageinfo and the function name string in _LDR_DATA_TABLE_ENTRY.getprocaddress() are handled

2012-04-10 01:07:11 +00:00

kdbgscan.py

Improve KDBG performance.

2012-04-14 13:47:11 +00:00

kpcrscan.py

Remove while 1 loop from scanning code.

2012-04-06 22:30:26 +00:00

moddump.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

modscan.py

update modscan, filescan, and driverscan to suppress NoneObject as string warnings (see r1563).

2012-03-23 14:17:51 +00:00

modules.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

netscan.py

Remove all unnecessary trailing slashes.

2012-02-26 23:26:52 +00:00

patcher.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

procdump.py

fix a bug in all plugins that inherit from ProcExeDump. in particular, they crash when extracting a PE whose size of headers (nt_header.OptionalHeader.SizeOfHeaders) encompasses one or more pages that are unavailable. use zread instead of read.

2012-04-10 17:09:08 +00:00

pstree.py

Backported the pstree fix which would cause it to fail when pid/ppid relations were circular.

2012-04-06 17:36:21 +00:00

sockets.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

sockscan.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

ssdt.py

Pylint some files.

2012-04-30 11:56:50 +00:00

strings.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

taskmods.py

few modifications to strings in dlllist's output. this may end up just being temporary if other changes to unicode strings are made to the core, but might as well keep them consistent with how other plugins are printing strings at the moment.

2012-04-10 16:32:51 +00:00

userassist.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00

vadinfo.py

since at least r630 we've been instantiating the root vad (EPROCESS.VadRoot) in kernel AS and all child nodes in process AS. in r1548 we attemped to add consistency and instantiate all from process AS, but that was the wrong decision. this patch reverts the changes made in r1548 and ensures all MMVADs are in kernel AS but that actual vad data comes from process AS. the get_data() and get_vads() helpers go away. we introduce some helper APIs for the malware plugins to filter vads based on MMVAD flags and data

2012-04-07 16:02:15 +00:00

volshell.py

Convert all *args to *args, **kwargs in __init__ functions.

2012-03-08 20:58:06 +00:00