 Mike Auty
|
6a12361977
|
Fix up minor typo in info plugin.
|
2019-05-29 22:14:25 +01:00 |
|
|
Andrew Case
|
2a8a1523e5
|
Mac - add lsof plugin
|
2019-05-29 14:49:55 -05:00 |
|
|
Andrew Case
|
66690bcbfe
|
Merge branch 'master' of https://github.com/volatilityfoundation/volatility3
|
2019-05-29 14:07:06 -05:00 |
|
|
Andrew Case
|
600af7299b
|
Mac - add check_sysctl plugin
|
2019-05-29 14:06:51 -05:00 |
|
|
Analystandikelos
|
a90f3ed1a7
|
fixup an instance of is_windows_7 in poolscanner
|
2019-05-29 14:46:22 +01:00 |
|
|
Mike Auty
|
4ff137bc18
|
Fix up a is_windows_8_or_later call.
|
2019-05-29 14:46:22 +01:00 |
|
|
Mike Auty
|
38f249aef2
|
Change the os-distguisher to make it more flexible.
|
2019-05-29 14:46:22 +01:00 |
|
|
Mike Auty
|
867edc9501
|
Add in the os-distinguisher code.
|
2019-05-29 14:46:22 +01:00 |
|
|
Andrew Case
|
15e546c23c
|
Mac - add check_trap_table
|
2019-05-28 22:01:28 -05:00 |
|
|
Mike Auty
|
2b6007857e
|
Fix up type signature of filter_func for windows pslist.
|
2019-05-26 20:45:24 +01:00 |
|
|
Dave Lassalleandikelos
|
61f9173bb6
|
initial hivescan plugin
|
2019-04-27 14:02:07 +01:00 |
|
|
Mike Auty
|
754b3f0bc6
|
Refactor create_filter to create_pid_filter.
|
2019-04-18 01:10:07 +01:00 |
|
|
Mike Auty
|
90ef8f363f
|
Have hivelist traverse in both directions in case of invalid addresses.
|
2019-04-11 00:38:46 +01:00 |
|
|
Mike Auty
|
5b8645bd1f
|
Revert IntFlag change until we drop python 3.5 support.
|
2019-04-05 22:56:36 +01:00 |
|
|
Mike Auty
|
af7d969ace
|
Fix up variable type assignment.
|
2019-04-05 14:51:23 +01:00 |
|
|
Mike Auty
|
87bf1da424
|
Don't use mutable defaults.
|
2019-04-05 14:50:39 +01:00 |
|
|
Mike Auty
|
fa94ef3271
|
Use the flag type for flags.
|
2019-04-05 14:49:44 +01:00 |
|
|
Analyst
|
d44049121f
|
pefile APIs for accessing VS_FIXEDFILEINFO changed. this patch attempts to handle both older and newer versions
|
2019-03-30 16:06:09 -05:00 |
|
|
Analyst
|
9c4bd556f6
|
add the symlinkscan plugin
|
2019-03-07 09:00:19 -06:00 |
|
|
Mike Auty
|
7904be3fd2
|
Yapf reformat all files.
|
2019-03-04 22:11:44 +00:00 |
|
|
Mike Auty
|
01a9e63f09
|
Fix up an additional import in driverirp.
|
2019-03-04 21:51:31 +00:00 |
|
|
Analyst
|
801ba5840f
|
add the driverirp plugin
|
2019-03-04 12:59:18 -06:00 |
|
|
Analyst
|
0b07fc33ec
|
fix the imports in driverscan and modscan
|
2019-03-04 11:58:36 -06:00 |
|
|
Analyst
|
31d17fa19e
|
Revert "fix psscan and mutantscan imports now that core plugins are under framework"
This reverts commit 99f9a989cb.
|
2019-03-04 11:57:23 -06:00 |
|
|
Analyst
|
6e66b3e702
|
update ssdt with a build_module_collection classmethod, so it can be shared with other plugins
|
2019-03-04 11:57:07 -06:00 |
|
|
Analyst
|
fb36db098e
|
add the modscan plugin
|
2019-03-04 11:02:53 -06:00 |
|
|
Analyst
|
901a38d40b
|
pool scanner update: we only ask for specific object types, so no need to filter the results anymore
|
2019-03-04 11:00:42 -06:00 |
|
|
Analyst
|
e1701947f8
|
add the windows driverscan plugin
|
2019-03-04 10:37:33 -06:00 |
|
|
Analyst
|
99f9a989cb
|
fix psscan and mutantscan imports now that core plugins are under framework
|
2019-03-04 10:30:26 -06:00 |
|
|
Mike Auty
|
cdbe0306f0
|
Fix the nullfilter for mac process lists.
|
2019-03-03 14:57:34 +00:00 |
|
|
Mike Auty
|
7cc54ba23a
|
Add in LayerWriter plugin.
|
2019-03-02 23:09:12 +00:00 |
|
|
Mike Auty
|
7c9696def9
|
Minor fixes for typing and imports.
|
2019-03-02 22:45:39 +00:00 |
|
|
Mike Auty
|
2aa07596c2
|
Fix up filtering in mac and remove the last of the filter shadowing.
|
2019-02-28 09:48:15 +00:00 |
|
|
Mike Auty
|
c5e2490f40
|
Make complementary fixes in linux/mac pslist.
Filters should take a whole process, so they could be extended to filter
more in the future.
|
2019-02-27 19:22:37 +00:00 |
|
|
Analyst
|
b1c3ecfa17
|
add mutantscan
|
2019-02-27 12:49:50 -06:00 |
|
|
Mike Auty
|
8c85d133f0
|
Update plugins that used create_filter to filter on pids.
|
2019-02-27 17:39:17 +00:00 |
|
|
Mike Auty
|
a3dfb9661f
|
Update create_filter method to actually filter appropriately.
|
2019-02-27 17:39:17 +00:00 |
|
|
Analyst
|
8baafaac7b
|
add handle offset to the handles plugin output
|
2019-02-27 10:14:52 -06:00 |
|
|
Analyst
|
224ea8ee2a
|
add the filescan plugin
|
2019-02-27 08:46:39 -06:00 |
|
|
Mike Auty
|
b1537f0789
|
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
|
2019-02-26 22:25:46 +00:00 |
|
|
Andrew Caseandikelos
|
75a6113369
|
remove another int cast from netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
7d15a1667e
|
remove int cast from netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
932246e11e
|
remove header on netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
c5cc88b245
|
actually add mac_netstat plugin
|
2019-02-26 22:20:33 +00:00 |
|
|
Mike Auty
|
e0d2edbca1
|
Remove ord for unsigned int and don't cast int objects to ints.
|
2019-02-24 23:56:34 +00:00 |
|
|
Mike Auty
|
b335b2320d
|
Minor performance fix for PE extension and yapf of poolscanner.
|
2019-02-18 00:07:19 +00:00 |
|
|
Mike Auty
|
4e8c8a7232
|
Fix issues with SymbolRequirement refactoring.
|
2019-02-11 22:30:22 +00:00 |
|
|
Michael Lighandikelos
|
12fe297c80
|
builtin_constraints() returns all constraints by default
|
2019-02-07 09:08:32 +00:00 |
|
|
Michael Lighandikelos
|
f34cd01b09
|
small style change for readability
|
2019-02-07 09:08:32 +00:00 |
|
|
Michael Lighandikelos
|
33f3f4372c
|
parameterize generate_pool_scan() - let plugins choose which contraints to use
plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
|
2019-02-07 09:08:32 +00:00 |
|