 Mike Auty
|
7904be3fd2
|
Yapf reformat all files.
|
2019-03-04 22:11:44 +00:00 |
|
|
Mike Auty
|
6613c7db19
|
Improve the documentation around the volatility.framework.plugins error.
|
2019-03-04 22:07:36 +00:00 |
|
|
Mike Auty
|
01a9e63f09
|
Fix up an additional import in driverirp.
|
2019-03-04 21:51:31 +00:00 |
|
|
Mike Auty
|
be0d010f1a
|
Add in warning if anyone tries to import from volatility.framework.plugins rather than voltility.plugins.
|
2019-03-04 21:47:26 +00:00 |
|
|
Analyst
|
801ba5840f
|
add the driverirp plugin
|
2019-03-04 12:59:18 -06:00 |
|
|
Analyst
|
0b07fc33ec
|
fix the imports in driverscan and modscan
|
2019-03-04 11:58:36 -06:00 |
|
|
Analyst
|
31d17fa19e
|
Revert "fix psscan and mutantscan imports now that core plugins are under framework"
This reverts commit 99f9a989cb.
|
2019-03-04 11:57:23 -06:00 |
|
|
Analyst
|
6e66b3e702
|
update ssdt with a build_module_collection classmethod, so it can be shared with other plugins
|
2019-03-04 11:57:07 -06:00 |
|
|
Analyst
|
fb36db098e
|
add the modscan plugin
|
2019-03-04 11:02:53 -06:00 |
|
|
Analyst
|
901a38d40b
|
pool scanner update: we only ask for specific object types, so no need to filter the results anymore
|
2019-03-04 11:00:42 -06:00 |
|
|
Analyst
|
e1701947f8
|
add the windows driverscan plugin
|
2019-03-04 10:37:33 -06:00 |
|
|
Analyst
|
99f9a989cb
|
fix psscan and mutantscan imports now that core plugins are under framework
|
2019-03-04 10:30:26 -06:00 |
|
|
Mike Auty
|
cdbe0306f0
|
Fix the nullfilter for mac process lists.
|
2019-03-03 14:57:34 +00:00 |
|
|
Mike Auty
|
ebadd4fbd6
|
Remove redundant load of segments by the lime layer.
|
2019-03-03 13:09:49 +00:00 |
|
|
Mike Auty
|
784336bb6e
|
Add in mac KDK generate_json script.
|
2019-03-03 01:12:07 +00:00 |
|
|
Mike Auty
|
7cc54ba23a
|
Add in LayerWriter plugin.
|
2019-03-02 23:09:12 +00:00 |
|
|
Mike Auty
|
7c9696def9
|
Minor fixes for typing and imports.
|
2019-03-02 22:45:39 +00:00 |
|
|
Mike Auty
|
d4045c9c13
|
Significant fix for reading from the start of SegmentedLayers (including Lime) when ignoring errors.
|
2019-03-02 22:44:51 +00:00 |
|
|
Mike Auty
|
14a9788802
|
Fix a typo in the parallelism code.
|
2019-03-02 19:34:31 +00:00 |
|
|
Mike Auty
|
0e1f491335
|
Turn off parallelism by default (seems to be faster?).
|
2019-03-02 19:02:34 +00:00 |
|
|
Mike Auty
|
33a9db6b9f
|
Make parallelism options more well defined.
|
2019-03-02 18:52:02 +00:00 |
|
|
Mike Auty
|
9fadee1a17
|
Add locking for threaded operation.
|
2019-03-02 18:07:48 +00:00 |
|
|
Mike Auty
|
1e9205a75f
|
Add in mac KDK dmg kernel extraction script.
|
2019-03-01 01:40:19 +00:00 |
|
|
Mike Auty
|
2aa07596c2
|
Fix up filtering in mac and remove the last of the filter shadowing.
|
2019-02-28 09:48:15 +00:00 |
|
|
Mike Auty
|
c5e2490f40
|
Make complementary fixes in linux/mac pslist.
Filters should take a whole process, so they could be extended to filter
more in the future.
|
2019-02-27 19:22:37 +00:00 |
|
|
Analyst
|
b1c3ecfa17
|
add mutantscan
|
2019-02-27 12:49:50 -06:00 |
|
|
Mike Auty
|
8c85d133f0
|
Update plugins that used create_filter to filter on pids.
|
2019-02-27 17:39:17 +00:00 |
|
|
Mike Auty
|
a3dfb9661f
|
Update create_filter method to actually filter appropriately.
|
2019-02-27 17:39:17 +00:00 |
|
|
Analyst
|
d4e12c982d
|
fix a critical issue determining the names of windows kernel objects from the object header
|
2019-02-27 10:45:36 -06:00 |
|
|
Analyst
|
8baafaac7b
|
add handle offset to the handles plugin output
|
2019-02-27 10:14:52 -06:00 |
|
|
Analyst
|
224ea8ee2a
|
add the filescan plugin
|
2019-02-27 08:46:39 -06:00 |
|
|
Mike Auty
|
26ae324050
|
Add in attempt at name demangling for symbols.
|
2019-02-27 11:26:24 +00:00 |
|
|
Mike Auty
|
2b001fad4d
|
Make sure we get 4 ints, not 8 shorts.
|
2019-02-26 23:02:34 +00:00 |
|
|
Mike Auty
|
72c4deaf66
|
Revamp the ip address conversion code and reformat mac files.
|
2019-02-26 22:59:21 +00:00 |
|
|
Mike Auty
|
b1537f0789
|
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
|
2019-02-26 22:25:46 +00:00 |
|
|
Mike Auty
|
03eddbfb74
|
Fix missing imports removed by the rebase.
|
2019-02-26 22:25:15 +00:00 |
|
|
Andrew Caseandikelos
|
451f73bfe2
|
change generic.GenericIntelProcess -> objects.Struct
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
75a6113369
|
remove another int cast from netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
7d15a1667e
|
remove int cast from netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
932246e11e
|
remove header on netstat
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
c9adc6a0fa
|
remove usage of old string methods
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
c5cc88b245
|
actually add mac_netstat plugin
|
2019-02-26 22:20:33 +00:00 |
|
|
Andrew Caseandikelos
|
6d2a5fbfaa
|
add mac_netstat and supporting networking code
|
2019-02-26 22:20:33 +00:00 |
|
|
Mike Auty
|
d8413efc1d
|
Add in further ignoring of the 0xf7 unicode character.
|
2019-02-25 22:51:41 +00:00 |
|
|
Mike Auty
|
e0d2edbca1
|
Remove ord for unsigned int and don't cast int objects to ints.
|
2019-02-24 23:56:34 +00:00 |
|
|
Michael Ligh
|
d68b94965c
|
catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue()
|
2019-02-24 17:14:28 -06:00 |
|
|
Analyst
|
63787acb50
|
fix the handling of TypeInfo after 9b488f8
|
2019-02-24 15:24:37 -06:00 |
|
|
Mike Auty
|
b335b2320d
|
Minor performance fix for PE extension and yapf of poolscanner.
|
2019-02-18 00:07:19 +00:00 |
|
|
Mike Auty
|
6b3eef4083
|
Additional optimization by extracting the struct calls from the intel translation methods.
|
2019-02-14 23:42:06 +00:00 |
|
|
Mike Auty
|
7b06480d7e
|
Major speed-up for bulk scanning of images.
|
2019-02-14 22:14:32 +00:00 |
|