Mike Auty
73ad2bcd4e
Plugins: Since procs have been instantiated, checks aren't needed
2020-07-18 16:38:49 +01:00
Mike Auty
d15b23aa19
Plugins: Fix pslist_method inconsistencies
2020-07-18 16:38:49 +01:00
Mike Auty
7673dd8d2d
Mac: Consolidate methods of listing processes
...
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing. At the moment, the default (first in the method list)
is chosen. An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).
If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
0ccb1f82e6
Change copyright year and plugin doc strings
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
4799e8551e
Add process listing through examination of the process group hash table
2020-07-18 16:38:49 +01:00
Mike Auty
fb467332c6
Plugins: Yapf reformat linux check_creds plugin
2020-07-18 15:36:30 +01:00
mtressler and ikelos
8f1b338996
Update check_creds.py
...
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
2020-07-18 15:29:30 +01:00
mtressler and ikelos
8071ebbebb
End of file cut off
2020-07-18 15:29:30 +01:00
Matt Tressler and ikelos
55d1d48fac
Created linux_check_creds plugin
2020-07-18 15:29:30 +01:00
Jan and ikelos
e5d51eb9b7
adds dynamic length of pool header alignments
2020-07-17 18:07:23 +01:00
Mike Auty
af1b8c03e7
Renderer: Rename StrLike to MultiTypeData
2020-07-16 19:44:18 +01:00
Dave Lassalle and ikelos
42a97dd10c
Registry: handle ints, multi strings, and binary data with StrLike
2020-07-16 19:44:18 +01:00
Mike Auty
3111591e06
Registry: Move control of the StrLike output to the UIs
2020-07-16 19:44:18 +01:00
Mike Auty
9a4669881d
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
eb90d4e830
Registry: Retain data recovered from registry strings
2020-07-16 19:44:18 +01:00
Mike Auty
ecddc40781
Printkey: Bump the required framework version due to the API changes.
2020-07-16 19:44:18 +01:00
Mike Auty
a5fc7323ec
Registry: Don't make assumptions about the default
2020-07-16 19:44:18 +01:00
Mike Auty
b31f9eb6e2
Registry: Move control of the StrLike output to the UIs
2020-07-16 19:44:18 +01:00
Mike Auty
5571f19b09
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
ee41e7968f
Registry: Retain data recovered from registry strings
2020-07-16 19:44:18 +01:00
Mike Auty
e97549498c
Configuration: Allow unspecified optional list requirements
2020-07-16 15:28:38 +01:00
Mike Auty
e4c7921072
Configuration: Improve PluginRequirement error reporting
2020-07-16 15:21:50 +01:00
Mike Auty
626712324a
FrameworkInfo: List LayerStackers
2020-07-16 11:17:51 +01:00
Mike Auty
79d44edd37
Automagic: Don't hide errors from manual stacker setting
2020-07-16 11:17:29 +01:00
Mike Auty
c21bc62589
Pdbconv: Fix issue when remote file does not exist
2020-07-15 21:42:46 +01:00
Mike Auty
1b774bc69d
Yarascan: Bump plugin to include rule name (issue/PR #253 )
...
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
2020-07-13 10:52:04 +01:00
Mike Auty
07ddbb60f7
Linux: Don't forget the pslist pid parameter
2020-07-11 10:32:15 +01:00
Andrew Case
2427a7c988
Linux - add an explicit version to lsmod
2020-07-10 15:41:25 -05:00
Mike Auty
4cccbc2f69
Automagic: Fix os_chooser method
...
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
2020-07-02 19:33:32 +01:00
Mike Auty
55dd1c6c2c
Automagic: Fix bad default parameter
2020-07-02 19:33:32 +01:00
Mike Auty
16c2ddb837
Automagic: Change stackers to including an exclusion list
2020-07-02 19:33:32 +01:00
Mike Auty
33d1c696e5
Automagic: Allow stackers to be configurable
2020-07-02 19:33:32 +01:00
Michael Ligh and ikelos
87ff6dd87c
refs #200 raise ValueError if an object doesn't have a name
2020-07-01 20:51:22 +01:00
Mike Auty
944bf2174f
Automagic: Split out the stacker code
2020-07-01 20:30:31 +01:00
Mike Auty
232fcbe499
Objects: Go back to the *much* quicker exception handling
2020-07-01 20:24:30 +01:00
Mike Auty
51c0b873cc
Objects: Reduce duplicated code (thanks @atcuno)
2020-07-01 20:24:30 +01:00
Mike Auty
f1613a78b3
Objects: Use contextlib instead of finally
2020-07-01 20:24:30 +01:00
Mike Auty
1cdcd8d811
Core: The has-valid-members interface bumps the version
2020-07-01 20:24:30 +01:00
Mike Auty
6f1001f290
Objects: Add in the ability to test for member validity
2020-07-01 20:24:30 +01:00
Mike Auty
4b29cf1986
Objects: Fix incorrect pointer readability check
2020-06-28 19:32:37 +01:00
Mike Auty
888b432667
Mac: Fix an error decoding bad UTF-8 values
...
Closes #228 .
2020-06-28 01:07:16 +01:00
Mike Auty
d28e573c18
Renderers: Fix python deprecation warnings
2020-06-27 18:34:43 +01:00
Mike Auty
ac1d99677d
ISF: Support deprecating versions
2020-06-27 18:33:30 +01:00
Mike Auty
cd9a46ebd1
Resources: Ensure we close all file pointers
2020-06-27 18:29:51 +01:00
Mike Auty
cf988944b9
Linux: Correct the ASLR for pre-masking (KASLR is still incorrect)
2020-06-23 16:56:40 +01:00
Hanno Heinrichs and ikelos
deb2b78312
Clear symbol cache after ASLR computation on Linux.
2020-06-23 16:45:22 +01:00
Hanno Heinrichs and ikelos
30226d2bdd
Fix find_aslr() function invocation for Linux.
2020-06-23 16:10:05 +01:00
Mike Auty
abb1f3d71c
Renderers: Fix inaccurate old code
2020-06-22 19:26:37 +01:00
Mike Auty
99a8c69e75
Renderers: Support partial results during population
2020-06-22 19:26:37 +01:00
Mike Auty
16a8e3771b
Objects: Make bool an int
...
We can't inherit from bool, so __new__ can't return a bool, so
everything has be done with int. However __bool__ is already
defined for int, so it should have no significant impact
(other than type() calls).
Fixes issue 232.
2020-06-18 16:53:14 +01:00
Mike Auty