Mike Auty
2dc3d2928d
Fix more typing issues.
2018-06-04 23:28:26 +01:00
Mike Auty
816db6b626
Fix up some missing logging names that slipped through the review net.
2018-06-04 10:10:44 +01:00
Mike Auty
d3782c0519
Fix typo as identified by @imhlv2.
2018-06-03 23:51:46 +01:00
Mike Auty
9740c4af84
Add in configwriter plugin, fixes issue #26 .
2018-05-31 11:50:40 +01:00
Michael Ligh
17924a0667
refs #27 use _KLDR_DATA_TABLE_ENTRY on windows if its available
2018-05-30 13:55:20 -05:00
Mike Auty
87d0f97f52
Remove the unnecessary exception and add in a better one.
2018-05-23 19:41:40 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
f8b592c236
Make the config path for plugins dynamic.
2018-05-15 00:11:31 +01:00
Michael Ligh
21b2eb7ecc
malfind is reading chunks, not technically pages, so change PAGE_SIZE to CHUNK_SIZE
2018-05-13 18:49:11 -05:00
Michael Ligh and ikelos
deb81aa1c8
address a few of @ikelos comments in the PR
2018-05-13 23:30:03 +01:00
Michael Ligh and ikelos
a01e4e41b0
commit malfind
2018-05-13 23:30:03 +01:00
Mike Auty
577b6c4b5b
Fix strings not being displayed fully because they featured 'non-word' characters.
2018-05-08 23:59:59 +01:00
Mike Auty
b9fbf272d1
Add support for filename requirements
...
At the moment these are no different than strings, but they allow us to
do things like add URI handlers to file names if no scheme is provided,
and eventually do file existence testing. This also allows the web URI
to allow uploads as a means of passing a file in.
The configuration will only store the filename, because otherwise
someone could add a huge file which would need to be carried around in
the config forever after. Handling file existence errors is up to the
UI after the volatility library returns a "file not found" type
exception.
2018-05-08 23:54:08 +01:00
Mike Auty
38e9c8f50b
Add in initial version of the strings plugin.
2018-05-08 00:57:16 +01:00
Mike Auty
2cb5435911
Change the signature for add_process_layer to match linux.
2018-05-07 17:45:40 +01:00
Mike Auty
84c72c9ffc
Remove the unnecessary Volshell check in timeliner.
...
Given that volshell's plugins are now separate and not stored in the
core plugins list, there is no need to protect against it (and there are
no other "interactive" plugins, which will likely be barred from being
in the core set).
2018-05-06 19:39:07 +01:00
Mike Auty
035bada7b7
Refactor volshell from a plugin to a standalone program.
2018-05-06 18:11:15 +01:00
Mike Auty
38eff91371
Remove vestigal update_configuration methods.
2018-05-06 01:24:40 +01:00
Mike Auty
f25d059d49
Add in file producer/consumer API.
2018-04-14 19:51:49 +01:00
Mike Auty
2e50cde2e7
Fix minor typing issues.
2018-04-11 20:50:11 +01:00
Mike Auty
a55d1c0cab
Add in basic pstree plugin.
2018-04-02 13:44:17 +01:00
Mike Auty
e4d57b639f
Add in basic, extremely crude version of timeliner.
...
(So crude, I heard it say the word 'bum' just a moment ago!) 5;P
2018-03-27 00:33:51 +01:00
Mike Auty
2c196c2d79
Ensure looking up recurse doesn't cause an exception.
2018-03-26 01:15:24 +01:00
Mike Auty
90ffe2de99
Add in basic page statistics plugin (runs much quicker under pypy).
2018-03-24 00:31:44 +00:00
Mike Auty
550a361143
Make __init__ calls more flexible and minor linting.
2018-03-23 15:49:54 +00:00
Dave Lassalle and ikelos
1ae43783aa
create utility function for converting windows timestamps
2018-03-21 18:42:38 +00:00
Michael Ligh and ikelos
205af99a3e
Rev2 after rev1 comments
2018-03-19 22:35:00 +00:00
Michael Ligh and ikelos
8282df5893
Initial versions of vadinfo and vaddump
2018-03-19 22:35:00 +00:00
Mike Auty
77dec0d30c
Handle the condition where physical isn't set (since it's optional).
2018-03-14 01:08:13 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
30673d428a
Fix up incorrect typing information.
2018-03-10 19:40:50 +00:00
Mike Auty
f8e87ede69
Convert merged changes from helper_ properties to get_ methods.
2018-03-10 19:33:29 +00:00
ikelos and GitHub
ca7405413b
Merge pull request #15 from volatilityfoundation/dave-pslist-columns
...
additional columns in windows.pslist
Just need to adapt it from `helper_` properties to `get_` methods...
2018-03-10 19:29:17 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Dave Lassalle
a56d3468ef
re-order columns
2018-03-07 11:41:57 -06:00
Dave Lassalle
8b6f88aa0c
additional columns in windows.pslist
2018-03-07 11:03:03 -06:00
Mike Auty
0f93caeebf
Forgot the TODO tag.
2018-02-08 00:06:59 +00:00
Mike Auty
b27705d1e7
Add in pid filtering based on the pid config option.
2018-02-08 00:05:33 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
60e1aebaf8
Improve the plugin help descriptions.
2017-11-25 16:19:47 +00:00
Mike Auty
2322a1b071
Pass the keypath through the recursion rather than expensively regenerating it.
2017-11-23 01:02:06 +00:00
Dave Lassalle
fdcab2760e
change name of ntsymbols and call to get_key
2017-11-22 16:03:55 -06:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
330832e546
Just to make it easier in case of renames, etc.
2017-11-13 01:20:08 +00:00
Mike Auty
327c8cb073
Make use of the hivelist plugin when no offset is provided to printkey.
2017-11-13 01:19:54 +00:00
Mike Auty
a60fcba32f
Make sure we don't assume that the primary layer's config lives under our own.
2017-11-13 01:18:54 +00:00
Mike Auty
769e1226c4
Make creating subconfigs simpler from configurables.
2017-11-13 00:59:01 +00:00
Mike Auty
18f1e5ae90
Re-order the output of the printkey plugin.
2017-11-10 18:08:06 +00:00
Mike Auty