Mike Auty
73ad2bcd4e
Plugins: Since procs have been instantiated, checks aren't needed
2020-07-18 16:38:49 +01:00
Mike Auty
d15b23aa19
Plugins: Fix pslist_method inconsistencies
2020-07-18 16:38:49 +01:00
Mike Auty
7673dd8d2d
Mac: Consolidate methods of listing processes
...
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing. At the moment, the default (first in the method list)
is chosen. An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).
If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
0ccb1f82e6
Change copyright year and plugin doc strings
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
4799e8551e
Add process listing through examination of the process group hash table
2020-07-18 16:38:49 +01:00
Mike Auty
fb467332c6
Plugins: Yapf reformat linux check_creds plugin
2020-07-18 15:36:30 +01:00
mtressler and ikelos
8f1b338996
Update check_creds.py
...
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
2020-07-18 15:29:30 +01:00
mtressler and ikelos
8071ebbebb
End of file cut off
2020-07-18 15:29:30 +01:00
Matt Tressler and ikelos
55d1d48fac
Created linux_check_creds plugin
2020-07-18 15:29:30 +01:00
Jan and ikelos
e5d51eb9b7
adds dynamic length of pool header alignments
2020-07-17 18:07:23 +01:00
Mike Auty
af1b8c03e7
Renderer: Rename StrLike to MultiTypeData
2020-07-16 19:44:18 +01:00
Dave Lassalle and ikelos
42a97dd10c
Registry: handle ints, multi strings, and binary data with StrLike
2020-07-16 19:44:18 +01:00
Mike Auty
3111591e06
Registry: Move control of the StrLike output to the UIs
2020-07-16 19:44:18 +01:00
Mike Auty
9a4669881d
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
eb90d4e830
Registry: Retain data recovered from registry strings
2020-07-16 19:44:18 +01:00
Mike Auty
ecddc40781
Printkey: Bump the required framework version due to the API changes.
2020-07-16 19:44:18 +01:00
Mike Auty
a5fc7323ec
Registry: Don't make assumptions about the default
2020-07-16 19:44:18 +01:00
Mike Auty
b31f9eb6e2
Registry: Move control of the StrLike output to the UIs
2020-07-16 19:44:18 +01:00
Mike Auty
5571f19b09
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
ee41e7968f
Registry: Retain data recovered from registry strings
2020-07-16 19:44:18 +01:00
Mike Auty
e97549498c
Configuration: Allow unspecified optional list requirements
2020-07-16 15:28:38 +01:00
Mike Auty
e4c7921072
Configuration: Improve PluginRequirement error reporting
2020-07-16 15:21:50 +01:00
Mike Auty
626712324a
FrameworkInfo: List LayerStackers
2020-07-16 11:17:51 +01:00
Mike Auty
79d44edd37
Automagic: Don't hide errors from manual stacker setting
2020-07-16 11:17:29 +01:00
Mike Auty
9e02a1b3c6
CLI: Improve ListRequirement support
2020-07-16 11:16:58 +01:00
Mike Auty
c21bc62589
Pdbconv: Fix issue when remote file does not exist
2020-07-15 21:42:46 +01:00
Mike Auty
1b774bc69d
Yarascan: Bump plugin to include rule name (issue/PR #253 )
...
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
2020-07-13 10:52:04 +01:00
Mike Auty
10f6231c87
Documentation: Fix typo (thanks NiklasBeierl!)
2020-07-11 19:34:42 +01:00
Mike Auty
878e4c0420
Documentation: Improve the man page regarding issue #250 .
2020-07-11 12:16:24 +01:00
Mike Auty
432e74ecd1
CLI: Reword the help message and yapf format
2020-07-11 11:59:38 +01:00
Niklas Neierl and ikelos
077cdfb36e
Added instructions for help on a plugin
2020-07-11 11:52:31 +01:00
Mike Auty
07ddbb60f7
Linux: Don't forget the pslist pid parameter
2020-07-11 10:32:15 +01:00
Andrew Case
2427a7c988
Linux - add an explicit version to lsmod
2020-07-10 15:41:25 -05:00
Mike Auty
ce6fb561cb
Documentation: Add an important note about layer.metadata
2020-07-05 22:20:26 +01:00
Mike Auty
2b05c7ffcb
README: Don't forget the line breaks
2020-07-03 14:48:34 +01:00
Mike Auty
a669ba8191
README: Update to include hashes for large symbol packs
2020-07-03 14:47:00 +01:00
Mike Auty
4cccbc2f69
Automagic: Fix os_chooser method
...
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
2020-07-02 19:33:32 +01:00
Mike Auty
55dd1c6c2c
Automagic: Fix bad default parameter
2020-07-02 19:33:32 +01:00
Mike Auty
16c2ddb837
Automagic: Change stackers to including an exclusion list
2020-07-02 19:33:32 +01:00
Mike Auty
33d1c696e5
Automagic: Allow stackers to be configurable
2020-07-02 19:33:32 +01:00
Michael Ligh and ikelos
87ff6dd87c
refs #200 raise ValueError if an object doesn't have a name
2020-07-01 20:51:22 +01:00
Mike Auty
944bf2174f
Automagic: Split out the stacker code
2020-07-01 20:30:31 +01:00
Mike Auty
232fcbe499
Objects: Go back to the *much* quicker exception handling
2020-07-01 20:24:30 +01:00
Mike Auty
51c0b873cc
Objects: Reduce duplicated code (thanks @atcuno)
2020-07-01 20:24:30 +01:00
Mike Auty
f1613a78b3
Objects: Use contextlib instead of finally
2020-07-01 20:24:30 +01:00
Mike Auty
1cdcd8d811
Core: The has-valid-members interface bumps the version
2020-07-01 20:24:30 +01:00
Mike Auty
6f1001f290
Objects: Add in the ability to test for member validity
2020-07-01 20:24:30 +01:00
Mike Auty
826102c0b5
Logging: Fixes issue #241
2020-06-30 08:58:40 +01:00
Mike Auty
4b29cf1986
Objects: Fix incorrect pointer readability check
2020-06-28 19:32:37 +01:00
Mike Auty
888b432667
Mac: Fix an error decoding bad UTF-8 values
...
Closes #228 .
2020-06-28 01:07:16 +01:00
Mike Auty