Mike Auty
38e9c8f50b
Add in initial version of the strings plugin.
2018-05-08 00:57:16 +01:00
Mike Auty
2cb5435911
Change the signature for add_process_layer to match linux.
2018-05-07 17:45:40 +01:00
Mike Auty
84c72c9ffc
Remove the unnecessary Volshell check in timeliner.
...
Given that volshell's plugins are now separate and not stored in the
core plugins list, there is no need to protect against it (and there are
no other "interactive" plugins, which will likely be barred from being
in the core set).
2018-05-06 19:39:07 +01:00
Mike Auty
035bada7b7
Refactor volshell from a plugin to a standalone program.
2018-05-06 18:11:15 +01:00
Mike Auty
38eff91371
Remove vestigal update_configuration methods.
2018-05-06 01:24:40 +01:00
Mike Auty
f25d059d49
Add in file producer/consumer API.
2018-04-14 19:51:49 +01:00
Mike Auty
2e50cde2e7
Fix minor typing issues.
2018-04-11 20:50:11 +01:00
Mike Auty
a55d1c0cab
Add in basic pstree plugin.
2018-04-02 13:44:17 +01:00
Mike Auty
e4d57b639f
Add in basic, extremely crude version of timeliner.
...
(So crude, I heard it say the word 'bum' just a moment ago!) 5;P
2018-03-27 00:33:51 +01:00
Mike Auty
2c196c2d79
Ensure looking up recurse doesn't cause an exception.
2018-03-26 01:15:24 +01:00
Mike Auty
90ffe2de99
Add in basic page statistics plugin (runs much quicker under pypy).
2018-03-24 00:31:44 +00:00
Mike Auty
550a361143
Make __init__ calls more flexible and minor linting.
2018-03-23 15:49:54 +00:00
Dave Lassalle and ikelos
1ae43783aa
create utility function for converting windows timestamps
2018-03-21 18:42:38 +00:00
Michael Ligh and ikelos
205af99a3e
Rev2 after rev1 comments
2018-03-19 22:35:00 +00:00
Michael Ligh and ikelos
8282df5893
Initial versions of vadinfo and vaddump
2018-03-19 22:35:00 +00:00
Mike Auty
77dec0d30c
Handle the condition where physical isn't set (since it's optional).
2018-03-14 01:08:13 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
30673d428a
Fix up incorrect typing information.
2018-03-10 19:40:50 +00:00
Mike Auty
f8e87ede69
Convert merged changes from helper_ properties to get_ methods.
2018-03-10 19:33:29 +00:00
ikelos and GitHub
ca7405413b
Merge pull request #15 from volatilityfoundation/dave-pslist-columns
...
additional columns in windows.pslist
Just need to adapt it from `helper_` properties to `get_` methods...
2018-03-10 19:29:17 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Dave Lassalle
a56d3468ef
re-order columns
2018-03-07 11:41:57 -06:00
Dave Lassalle
8b6f88aa0c
additional columns in windows.pslist
2018-03-07 11:03:03 -06:00
Mike Auty
0f93caeebf
Forgot the TODO tag.
2018-02-08 00:06:59 +00:00
Mike Auty
b27705d1e7
Add in pid filtering based on the pid config option.
2018-02-08 00:05:33 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
60e1aebaf8
Improve the plugin help descriptions.
2017-11-25 16:19:47 +00:00
Mike Auty
2322a1b071
Pass the keypath through the recursion rather than expensively regenerating it.
2017-11-23 01:02:06 +00:00
Dave Lassalle
fdcab2760e
change name of ntsymbols and call to get_key
2017-11-22 16:03:55 -06:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
330832e546
Just to make it easier in case of renames, etc.
2017-11-13 01:20:08 +00:00
Mike Auty
327c8cb073
Make use of the hivelist plugin when no offset is provided to printkey.
2017-11-13 01:19:54 +00:00
Mike Auty
a60fcba32f
Make sure we don't assume that the primary layer's config lives under our own.
2017-11-13 01:18:54 +00:00
Mike Auty
769e1226c4
Make creating subconfigs simpler from configurables.
2017-11-13 00:59:01 +00:00
Mike Auty
18f1e5ae90
Re-order the output of the printkey plugin.
2017-11-10 18:08:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
7c6970212f
Fix recursion (it wasn't being passed the argument).
2017-11-08 01:00:15 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
28036c9405
Add in the ability to recurse keys (off by default).
2017-10-23 17:11:15 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
957fa23af2
Move the registry plugin to an appropriate location.
2017-10-09 00:19:05 +01:00
Mike Auty
930c8a2e08
Make the registry test plugin work with keys and offset parameters.
2017-10-09 00:19:05 +01:00
Mike Auty
a12246a423
Shift the order of the columns.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
38b6e12ec5
Minor changes to the testrig.
2017-10-09 00:19:05 +01:00
Mike Auty
0f1e84139f
Remove the extra regtest plugin.
2017-10-09 00:18:15 +01:00
Mike Auty
27e5dbfcc6
Add in testing plugin temporarily.
2017-10-09 00:18:15 +01:00
Mike Auty