 Mike Auty
|
bbaf4f22d6
|
Plugins: Remove unnecessary dependency for yarascan
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
3eb463475b
|
Core: Refactor versioning and associated requirements
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
2c39489790
|
Yarascan: Move most of yarascanning into a versionable plugin
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
54b62709d1
|
Hashdump: Reformat and convert to proper byte handling
|
2020-07-28 20:49:27 +01:00 |
|
|
Jack Wengerandikelos
|
465a7ca6ad
|
Added documentation and logging
|
2020-07-28 17:59:57 +01:00 |
|
|
Jack Wengerandikelos
|
72bc40ee69
|
added hashdump
|
2020-07-28 17:59:57 +01:00 |
|
|
Mike Auty
|
9295f41586
|
Plugins: Convert existing plugins over to use a list for PIDs
|
2020-07-23 02:02:01 +01:00 |
|
|
Mike Auty
|
31600254b9
|
Codebase: Apply yapf across the codebase.
|
2020-07-23 01:31:41 +01:00 |
|
|
Janandikelos
|
e5d51eb9b7
|
adds dynamic length of pool header alignments
|
2020-07-17 18:07:23 +01:00 |
|
|
Mike Auty
|
af1b8c03e7
|
Renderer: Rename StrLike to MultiTypeData
|
2020-07-16 19:44:18 +01:00 |
|
|
Dave Lassalleandikelos
|
42a97dd10c
|
Registry: handle ints, multi strings, and binary data with StrLike
|
2020-07-16 19:44:18 +01:00 |
|
|
Mike Auty
|
ecddc40781
|
Printkey: Bump the required framework version due to the API changes.
|
2020-07-16 19:44:18 +01:00 |
|
|
Mike Auty
|
a5fc7323ec
|
Registry: Don't make assumptions about the default
|
2020-07-16 19:44:18 +01:00 |
|
|
Mike Auty
|
5571f19b09
|
Registry: Move StringLike from conversion to StrLike format_hint.
|
2020-07-16 19:44:18 +01:00 |
|
|
Mike Auty
|
1b774bc69d
|
Yarascan: Bump plugin to include rule name (issue/PR #253)
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
|
2020-07-13 10:52:04 +01:00 |
|
|
Michael Lighandikelos
|
87ff6dd87c
|
refs #200 raise ValueError if an object doesn't have a name
|
2020-07-01 20:51:22 +01:00 |
|
|
Mike Auty
|
0ffe318cb0
|
Project: Update copyright headers for files added in 2020.
|
2020-06-10 21:13:37 +01:00 |
|
|
superponibleandikelos
|
69be2157fb
|
fix typo
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
48e33c2b98
|
create property for HiveGenerator invalid member
|
2020-05-27 23:16:18 +01:00 |
|
|
Mike Auty
|
a0da5fef83
|
Issue #186: Rebase and apply yapf
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
36c19735ee
|
issue #186 - hivelist with new hivescan/bigpools
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
002758c7f2
|
issue #186 - hivescan and hivelist with bigpools
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
a21ab89019
|
issue #186 - add bigpools plugin
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
054d144f9b
|
issue #186 - walk forward, backward, scan if needed
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
a4301afe22
|
issue #186 - skip type check on CMHIVE
|
2020-05-27 23:16:18 +01:00 |
|
|
Mike Auty
|
0c43beb42d
|
Core: Apply yapf across all files again.
|
2020-05-05 22:14:33 +01:00 |
|
|
Mike Auty
|
edecd64703
|
Yarascan: Fixes #209 by returning matched strings
|
2020-04-14 23:45:08 +01:00 |
|
|
Michael Ligh
|
d5bdf9633d
|
refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type
|
2020-04-07 09:22:52 -05:00 |
|
|
Mike Auty
|
bd2a382d88
|
CLI & windows.handles: Improve exception handling
|
2020-03-16 22:34:03 +00:00 |
|
|
Mike Auty
|
77be83edc4
|
Layers: Change mapping signature to return domain length
|
2020-03-04 20:29:42 +00:00 |
|
|
Mike Auty
|
f00453e366
|
Procdump: Remove redundant line as caught by @iMHLv2
|
2020-01-22 19:49:11 +00:00 |
|
|
Michael Lighandikelos
|
1d7da6402b
|
svcscan cleanup: win10 before 15063 uses win8 types
|
2020-01-22 19:23:30 +00:00 |
|
|
Mike Auty
|
9fe6e6ba37
|
registry: Add the hivedump plugin
|
2020-01-17 17:22:04 +00:00 |
|
|
Mike Auty
|
2d408491bd
|
Printkey: Slightly improve subkey name determination.
|
2020-01-15 02:19:12 +00:00 |
|
|
Mike Auty
|
3f5b96f3c7
|
Yapf: Clean-up the whole codebase.
|
2020-01-14 15:44:07 +00:00 |
|
|
Mike Auty
|
b7ba877727
|
procdump: Enure proc_id is defined.
|
2020-01-14 15:36:54 +00:00 |
|
|
doomedravenandikelos
|
07b94abc1e
|
Update procdump.py
|
2020-01-14 10:52:05 +00:00 |
|
|
doomedravenandikelos
|
cdc0835863
|
Update procdump.py
|
2020-01-14 10:52:05 +00:00 |
|
|
doomedravenandikelos
|
e4d7b7975f
|
expose process_dump to other plugins
|
2020-01-14 10:52:05 +00:00 |
|
|
iMHLv2andGitHub
|
f7cc94a244
|
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
Use a kernel layer to read vad protection constants
|
2020-01-04 10:02:59 -06:00 |
|
|
Michael Ligh
|
b7b6c44eab
|
remove unused variable in vaddump.py
|
2020-01-04 09:35:51 -06:00 |
|
|
Mike Auty
|
d2daa12564
|
Malfind: Rename the layer_name parameter to be more descripttive
|
2020-01-03 22:12:04 +00:00 |
|
|
William LIN
|
e6656c96af
|
VadDump: Fix incorrect variable out_of_range in vad_dump
|
2019-12-26 19:51:13 +01:00 |
|
|
Michael Ligh
|
cd841616af
|
refs #144 use a kernel layer to read vad protection constants
|
2019-12-08 07:46:02 -06:00 |
|
|
Mike Auty
|
f34958a16d
|
Poolscanner: Add necessary exception handling.
|
2019-12-04 22:11:42 +00:00 |
|
|
Mike Auty
|
386f94d9ee
|
Pool: Make object_header type checking the plugin's responsibility.
|
2019-12-04 22:11:42 +00:00 |
|
|
Mike Auty
|
8691c68604
|
Pool: Refactor pool extension to its own file.
|
2019-12-04 22:11:42 +00:00 |
|
|
Michael Lighandikelos
|
d0f9cf9a2f
|
refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299
|
2019-12-04 21:19:19 +00:00 |
|
|
Mike Auty
|
b6d807ff51
|
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
|
2019-11-27 11:30:14 +00:00 |
|
|
Mike Auty
|
b0b868d79c
|
Typing: General typing fixes across the tree
|
2019-11-27 11:30:14 +00:00 |
|