This updates the ssdt, truecrypt, drivermodule, driverirp, and verinfo
plugins to use the new method signatures from the Modules plugin, and
updates the requirement version numbers as well.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the ShimcacheMem plugins with the version bumps on the
modules and pslist requirements, updates the corresponding method calls,
and does a major version bump of its own due to a required breaking
method signature change.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the ScheduledTasks plugin with an updated hivelist
requirement version number, changes the corresponding method call, and
does a major version bump of its own due to a changed parameter name.
Co-authored-by: Andrew Case <andrew@dfir.org>
This fixes a simple InvalidAddressException traceback by just catching
the exception on the member access and continuing.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the netstat plugin to use the new method signature in the
modules plugin; however, this requires a breaking change of its own
which is done here as well. The major version is bumped accordingly;
this plugin has no dependents that require updates at this time.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the svcdiff plugin to use the latest changes from svclist
and svcscan, updating the requirement version numbers, and giving itself
a major version bump due to a changed method signature.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows SvcScan plugin with the latest changes from
hivelist/pslist, fixing up method calls and bumping requirement version
numbers. In order to use the new method signatures, breaking changes
were required to the svscan public methods, so a major version bump has
been added.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the svclist plugin with breaking changes to its public
methods in order to update calls to the svcscan methods. Both
requirement and plugin version numbers have been updated accordingly
here.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the orphan kernel threads plugin to use the latest changes
from the modules plugin, updating method signatures and bumping the
requirement version number. This required breaking interface changes in
the plugin itself, so the major version number has been bumped.
Co-authored-by: Andrew Case <andrew@dfir.org>
This uses the latest changes from windows.pslist, updated the
requirement version number. It also required breaking changes of its
own, so the Strings version number has been given a major version bump
as well.
Co-authored-by: Andrew Case <andrew@dfir.org>
This update the unhooked system calls plugin to use the latest changes
from pslist, updating the requirement version numbers and bumping its
own major version number due to a changed method signature.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the threads version number to the latest (2.0.0) and adds a
missing plugin requirement for thrdscan.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the poolscanner plugin with an additional method,
`generate_pool_scan_extended`, and does the corresponding minor version
bump.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the Windows Amcache plugin to use the latest changes in
Windows HiveList. It requires a major version bump of its own due to a
breaking method signature change, and is therefore in its own commit.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates all plugins that depend on windows.hivelist.HiveList to use
the updated method signature, and bumps their dependency version
accordingly.
Co-authored-by: Andrew Case <andrew@dfir.org>
This simplifies the `build_module_collection` signature to take a single
`kernel_module_name` parameter instead of `layer_name` and
`symbol_table_name` parameters, both of which would only ever belong to
the kernel anyway. This will prevent future confusion for consumers of
this method.
Co-authored-by: Andrew Case <andrew@dfir.org>
This cleans up the APIs for some methods in the modscan/modules plugins
that currently take separate symbol_table_name and layer_name
parameters, when it really makes more sense to just pass in the context
and the kernel module name.
It also updates the pslist plugin requirement version, and uses the
updated method signatures.
Co-authored-by: Andrew Case <andrew@dfir.org>
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.
Also updates the documentation to reflect pslist method signature
change.
Co-authored-by: Andrew Case <andrew@dfir.org>
