 Andrew Case
|
2fa4bf245d
|
implement a smear proof mac lsmod
|
2020-10-23 12:45:54 -05:00 |
|
|
Mike Auty
|
c53655e40c
|
Poolscanner: Infomasks can be 0
|
2020-10-18 01:07:36 +01:00 |
|
|
Mike Auty
|
82b3477613
|
Objects: Prevent recursion on uninitialized objects
Adds in guards to prevent attribute access if the object hasn't been
initalized correctly (for example from pickling or deepcopy).
Fixes #358.
|
2020-10-18 00:22:09 +01:00 |
|
|
iMHLv2andikelos
|
0d4075355a
|
refs #332 catch invalid address exceptions when reading DllBase
|
2020-10-07 23:16:14 +01:00 |
|
|
Mike Auty
|
7e63ed4815
|
Plugins: Allow None types in the configuration tree as values
|
2020-10-03 22:02:40 +01:00 |
|
|
memoryforensics1andikelos
|
b17a9e1977
|
Update __init__.py
|
2020-10-03 21:45:37 +01:00 |
|
|
memoryforensics1andikelos
|
ce22fc59fa
|
Update __init__.py
|
2020-10-03 21:45:37 +01:00 |
|
|
memoryforensics1andikelos
|
b2aaf53d86
|
Fix XP buges for privileges and environment_variables
|
2020-10-03 21:45:37 +01:00 |
|
|
Mike Auty
|
4c633f3ee9
|
Windows: Add PointerCount check to improve poolscanning
|
2020-10-01 09:06:19 +01:00 |
|
|
Mike Auty
|
640f2584e4
|
Windows: Reduce complexity by using built-in inet_ntop
|
2020-09-24 01:20:37 +01:00 |
|
|
Mike Auty
|
dc8bec199f
|
Windows: Minor formatting and typing improvements
|
2020-09-24 01:01:51 +01:00 |
|
|
Mike Auty
|
b07ce5bd38
|
Crash64: Add support for type 0x01 to crashdump64
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
577c4acec3
|
Layers: Crash64 improve logging
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
c4ff2da9be
|
Layers: Fix context cloning infinite loop with crashdumps
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
31e251e108
|
Layers: Initial crashdump64 implementation
|
2020-09-23 20:28:23 +01:00 |
|
|
iMHLv2andikelos
|
8baf13d3e3
|
refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps
|
2020-09-23 19:27:37 +01:00 |
|
|
memoryforensics1andikelos
|
9048c04aa4
|
envars plugin
parse environment variables
|
2020-09-22 20:03:19 +01:00 |
|
|
Mike Auty
|
c436882f4d
|
Windows: Fix up the sids JSON slightly
|
2020-09-22 19:49:34 +01:00 |
|
|
memoryforensics1andikelos
|
0f34c82b6c
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
004fc1480b
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
15bce1ce72
|
privileges plugin
added privileges plugin
|
2020-09-22 19:49:01 +01:00 |
|
|
Mike Auty
|
f3e77ad645
|
Windows: Minor typos and JSON name change in sids plugins
|
2020-09-22 19:38:36 +01:00 |
|
|
memoryforensics1andikelos
|
d1264e0134
|
Update __init__.py
|
2020-09-22 18:30:54 +01:00 |
|
|
memoryforensics1andikelos
|
30be4ee2ec
|
fix get_sids function
fix get_sids function in broken images
|
2020-09-22 18:30:54 +01:00 |
|
|
memoryforensics1andikelos
|
31080ad416
|
fix
|
2020-09-22 18:21:58 +01:00 |
|
|
memoryforensics1andikelos
|
a5d5ff2bda
|
getsids getservicesids
|
2020-09-22 18:21:58 +01:00 |
|
|
Mike Auty
|
77312e193a
|
Plugins: Update the banner plugin filename.
|
2020-09-22 00:25:20 +01:00 |
|
|
Mike Auty
|
0ac26d40a1
|
Plugins: Support mac banners as well
|
2020-09-22 00:21:13 +01:00 |
|
|
Mike Auty
|
0a57a49572
|
Plugins: Add LinuxBanners plugin
|
2020-09-22 00:21:13 +01:00 |
|
|
Andrew Caseandikelos
|
e58e55b433
|
Update code for better variable names and minor version bump
|
2020-09-16 17:35:49 +01:00 |
|
|
Andrew Caseandikelos
|
afe39eee1b
|
Add new method for safe walking of generic list heads. Convert pslist to use it.
|
2020-09-16 17:35:49 +01:00 |
|
|
Mike Auty
|
c82ad2fbd0
|
Windows: Fix callbacks is_vista_or_later
|
2020-09-15 01:28:48 +01:00 |
|
|
Andrew Caseandikelos
|
5e53440b43
|
Add the socket filters plugin for OSX
|
2020-09-13 22:06:09 +01:00 |
|
|
Andrew Caseandikelos
|
40eafa03e6
|
Change bad copy/descriptions for Mac that say Linux
|
2020-09-11 01:37:56 +01:00 |
|
|
Andrew Caseandikelos
|
98d6844ac0
|
Address ikelos's review comments
|
2020-09-11 01:28:14 +01:00 |
|
|
Andrew Caseandikelos
|
6673d4774c
|
Add cached file listing plugin for Mac
|
2020-09-11 01:28:14 +01:00 |
|
|
lyles6andikelos
|
85775239b5
|
changed back to same format as get_parent
|
2020-09-10 09:13:31 +01:00 |
|
|
slyles1001andikelos
|
720f46a962
|
provides for vadnode and core
|
2020-09-10 09:13:31 +01:00 |
|
|
Mike Auty
|
8bf7ab9218
|
Bugfix: Vadinfo invalid exception
|
2020-09-10 01:39:10 +01:00 |
|
|
Mike Auty
|
00dcddbeb8
|
Framework: Prep master for additional commits
|
2020-09-10 00:07:00 +01:00 |
|
|
cecioandikelos
|
6972ae1cc8
|
in vadinfo.py, modified an exception handling and maxsize comparison
|
2020-09-08 23:32:54 +01:00 |
|
|
cesareandikelos
|
d74032fd53
|
Added maxsize option to vadinfo as optional parameter, as in Vol2.
Right now the default is set to 0 (no limit) as opposed to Vol2 where it is
set to 1GB.
|
2020-09-08 23:32:54 +01:00 |
|
|
cecioandikelos
|
61d4ee3c0e
|
some mods in comments
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
9c5dcda6e9
|
"pe" imported directly and little modification to comment
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
d060a5cbdb
|
dump of processes extracted by psscan (Issue #318)
|
2020-09-08 22:36:09 +01:00 |
|
|
Mike Auty
|
6b9ec5a079
|
Poolscanner: More native_layer validity checks
|
2020-09-08 02:45:20 +01:00 |
|
|
Mike Auty
|
b04329e2e9
|
Poolscanner: Ensure File.Buffer checks right layer
|
2020-09-08 02:23:32 +01:00 |
|
|
Mike Auty
|
4a8ce9f104
|
Plugins: Relent on not allow default to be Optional
|
2020-09-02 11:27:53 +01:00 |
|
|
Mike Auty
|
752a62a216
|
Windows: Convert pstree to non-inheritted plugin
|
2020-09-02 11:13:39 +01:00 |
|
|
Mike Auty
|
96b68b9cdc
|
Plugins: Don't ever insert an invalid value
|
2020-09-02 11:13:39 +01:00 |
|