Mike Auty
77dec0d30c
Handle the condition where physical isn't set (since it's optional).
2018-03-14 01:08:13 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
30673d428a
Fix up incorrect typing information.
2018-03-10 19:40:50 +00:00
Mike Auty
f8e87ede69
Convert merged changes from helper_ properties to get_ methods.
2018-03-10 19:33:29 +00:00
ikelos and GitHub
ca7405413b
Merge pull request #15 from volatilityfoundation/dave-pslist-columns
...
additional columns in windows.pslist
Just need to adapt it from `helper_` properties to `get_` methods...
2018-03-10 19:29:17 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Dave Lassalle
a56d3468ef
re-order columns
2018-03-07 11:41:57 -06:00
Dave Lassalle
8b6f88aa0c
additional columns in windows.pslist
2018-03-07 11:03:03 -06:00
Mike Auty
0f93caeebf
Forgot the TODO tag.
2018-02-08 00:06:59 +00:00
Mike Auty
b27705d1e7
Add in pid filtering based on the pid config option.
2018-02-08 00:05:33 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
60e1aebaf8
Improve the plugin help descriptions.
2017-11-25 16:19:47 +00:00
Mike Auty
2322a1b071
Pass the keypath through the recursion rather than expensively regenerating it.
2017-11-23 01:02:06 +00:00
Dave Lassalle
fdcab2760e
change name of ntsymbols and call to get_key
2017-11-22 16:03:55 -06:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
330832e546
Just to make it easier in case of renames, etc.
2017-11-13 01:20:08 +00:00
Mike Auty
327c8cb073
Make use of the hivelist plugin when no offset is provided to printkey.
2017-11-13 01:19:54 +00:00
Mike Auty
a60fcba32f
Make sure we don't assume that the primary layer's config lives under our own.
2017-11-13 01:18:54 +00:00
Mike Auty
769e1226c4
Make creating subconfigs simpler from configurables.
2017-11-13 00:59:01 +00:00
Mike Auty
18f1e5ae90
Re-order the output of the printkey plugin.
2017-11-10 18:08:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
7c6970212f
Fix recursion (it wasn't being passed the argument).
2017-11-08 01:00:15 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
28036c9405
Add in the ability to recurse keys (off by default).
2017-10-23 17:11:15 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
957fa23af2
Move the registry plugin to an appropriate location.
2017-10-09 00:19:05 +01:00
Mike Auty
930c8a2e08
Make the registry test plugin work with keys and offset parameters.
2017-10-09 00:19:05 +01:00
Mike Auty
a12246a423
Shift the order of the columns.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
38b6e12ec5
Minor changes to the testrig.
2017-10-09 00:19:05 +01:00
Mike Auty
0f1e84139f
Remove the extra regtest plugin.
2017-10-09 00:18:15 +01:00
Mike Auty
27e5dbfcc6
Add in testing plugin temporarily.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
6c6d0473a1
Fixed table names will no longer work since tables are prefix-named.
2017-09-03 23:17:40 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
9b835b1baf
Remove excess windows volshell local variables.
2017-08-29 23:55:34 +01:00
Mike Auty
f40665f1b7
Split volshell into windows and base/os-agnostic versions.
2017-08-29 23:54:11 +01:00
Mike Auty
cdf64ae08e
Add in initial implementation, currently with windows specific bits.
2017-08-29 01:06:46 +01:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
570a2d35be
Make the DllList import a little more sensible/consistent.
2017-08-10 10:07:57 +01:00
Mike Auty
c19ad1cb22
Placeholder change to ensure even if we don't change it to a from statement, it isn't bizarre.
2017-08-10 10:03:39 +01:00
Mike Auty
8be6869a84
Tidy up imports and adhere to the coding style of never directly importing objects.
2017-08-09 22:22:43 +01:00
Mike Auty
775ece3cb2
Convert the 'ntkrnlmp' requirement into an 'nt' requirement.
2017-07-24 15:43:34 +01:00
Mike Auty
8ad9fbfd24
Ensure imported plugins have their correct requirements fulfilled (even if they change).
2017-07-24 15:41:47 +01:00
ikelos and GitHub
fe66301cf3
Merge pull request #8 from volatilityfoundation/mhl-cmhive
...
move the hive name decision to _CMHIVE extension for hivelist (and ot…
2017-07-19 20:43:05 +01:00
Mike Auty