volatilityfoundation-volatility

__init__.py

Merge in most of linux-support.

2012-08-16 11:00:06 +00:00

apihooks.py

adding back render_text to linux_apihooks because

2014-12-02 19:05:39 -05:00

arp.py

Linux - hardend arp against smear

2017-04-29 12:03:43 -05:00

aslr_shift.py

Linux - add support for kernel physical ASLR in 4.9+ kernels

2017-05-04 18:06:37 -05:00

banner.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

bash_hash.py

Linux - remove print and add infinite loop protection to bash_hash

2016-10-25 16:03:35 -05:00

bash.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_afinfo.py

Linux - update lsof & netstat api

2014-07-26 18:50:39 -05:00

check_creds.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

check_evt_arm.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

check_fops.py

Linux - update check_fop through 4.13 and with more checks

2017-08-14 19:01:48 -05:00

check_idt.py

Linux - fix check_idt for old kernels

2015-07-03 15:51:02 -05:00

check_inline_kernel.py

Fix exception when prev_op is None

2015-08-03 15:05:33 +02:00

check_modules.py

Update kref reference counter handling for 4.12

2017-07-31 13:07:26 -05:00

check_syscall_arm.py

converted linux_check_syscall_arm

2014-12-02 13:57:33 -05:00

check_syscall.py

Linux - make type check specific in check_syscall

2018-06-11 09:49:41 -05:00

common.py

Linux - update operations member checking to avoid RedHat stupidity

2018-10-10 22:43:57 -05:00

cpuinfo.py

Linux - add support through Linux 4.9 for cpuinfo

2016-11-18 10:28:09 -06:00

dentry_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

dmesg.py

Linux - harden dmesg against smear

2017-04-29 12:00:09 -05:00

dump_map.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

elfs.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

enumerate_files.py

linux_enumerate_files: the inode address and number column headings were swapped

2015-07-01 13:43:52 -05:00

find_file.py

Linux - sanity check height member

2018-06-12 13:38:15 -05:00

flags.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

getcwd.py

Linux - add linux_getcwd

2014-10-24 12:33:24 -05:00

hidden_modules.py

Linux - add support for module scanning, extraction, and enumeration through 4.13

2017-07-31 14:11:01 -05:00

ifconfig.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

info_regs.py

fixing address

2015-06-29 14:29:17 -04:00

iomem.py

Linux - update iomem from book vm

2014-03-20 14:03:46 -05:00

kernel_opened_files.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

keyboard_notifiers.py

Linux - remove dead code from keyboard_notifiers

2017-08-01 09:29:42 -05:00

ld_env.py

Linux - update dynamic_env

2015-02-09 11:57:48 -06:00

ldrmodules.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

libc_env.py

Linux - update dynamic environment handling

2015-02-09 11:47:08 -06:00

library_list.py

fixing address

2015-06-29 14:29:17 -04:00

librarydump.py

Linux - unify elf dumping plugins

2015-01-05 12:30:27 -06:00

lime.py

Linux - add the new limeinfo plugin

2014-03-20 14:57:56 -05:00

linux_strings.py

fixing address

2015-06-29 14:29:17 -04:00

linux_truecrypt.py

add linux true crypt passphrase plugin

2014-05-27 11:05:21 -05:00

linux_volshell.py

Linux - speed up virtual_process_from_physical_offset

2014-10-06 14:55:12 -05:00

linux_yarascan.py

Update mac and linux yarascan to resprect name option

2014-07-22 00:51:19 -05:00

list_raw.py

Linux - find list_raw bug

2014-12-02 21:18:47 -06:00

lsmod.py

Linux - remove prints and update api for linux_moddump

2017-08-17 04:01:55 -05:00

lsof.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

malfind.py

Linux - make malfind print disasm correctly

2016-04-26 15:46:01 -05:00

mount_cache.py

Linux - fix mount_cache

2014-12-02 22:04:40 -06:00

mount.py

Linux - avoid corruption in mount

2016-04-26 15:46:29 -05:00

netfilter.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

netscan.py

Linux - don't print default entries in netscan

2016-04-26 15:47:00 -05:00

netstat.py

add unified output

2018-03-24 17:22:36 -04:00

pidhashtable.py

Add support for the new process tracking radix tree in kernels 4.15+

2018-10-01 12:41:25 -05:00

pkt_queues.py

Refactor pkt_queues.linux_pkt_queues.render_text, because calculate expected an older version of linux_netstat.calculate() from prior to commit d49f544926

2015-03-02 14:33:32 -08:00

plthook.py

Linux - update APIs

2014-08-15 11:11:09 -05:00

proc_maps_rb.py

Linux - add all the new plugins from book

2014-03-20 15:10:48 -05:00

proc_maps.py

Added unified outputs to some modules. Also, added "offset" to the output allowing easier manual exploration of the file. Finally added "addr_limit" output to threads as it can be used to detect processess that leverage exploits to expand the addr_limit in order to modify kernel objects (e.g. Towelroot on Android).

2015-06-04 11:33:02 -04:00

procdump.py

Linux - unify elf dumping plugins

2015-01-05 12:30:27 -06:00

process_hollow.py

Linux - fix bug in linux_process_hollow

2014-06-25 16:27:00 -05:00

process_info.py

fixing address

2015-06-29 14:29:17 -04:00

process_stack.py

fixing address

2015-06-29 14:29:17 -04:00

psaux.py

adding back pretty printing

2015-03-18 11:01:00 +00:00

psenv.py

adding back pretty printing

2015-03-18 11:01:39 +00:00

pslist_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

pslist.py

Linux - add linux_psscan

2016-06-06 16:33:04 -05:00

psscan.py

Linux - update psscan to debug.warning instead of debug.error

2018-02-22 14:24:28 -06:00

pstree.py

Linux - change pstree logic

2015-09-09 21:18:32 -05:00

psxview.py

Linux - fix two bugs

2016-10-07 09:36:31 -05:00

recover_filesystem.py

Linux - update description strings

2014-08-03 17:12:11 -05:00

route_cache.py

Linux - linux_route_cache - add optional hostname resolution

2014-05-27 09:20:15 -05:00

sk_buff_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

slab_info.py

Linux - fix bug in dentry cache reported by Golden

2014-05-27 08:04:59 -05:00

threads.py

Use read_long_long_phys for LinuxAMD64PagedMemory address space insted of read_long_phys

2017-04-13 06:38:51 +02:00

tmpfs.py

Linux - update tmpfs help menu

2015-02-07 16:07:24 -06:00

tty_check.py

Linux - tty check

2014-04-15 16:17:31 -05:00

vma_cache.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00