 Mike Auty
|
95d3de9317
|
Windows: Convert psscan to the new file interface
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
29cb430a72
|
Codebase: Apply yapf clean-up across the codebase
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
f58c115727
|
Windows: Fix up rebase issues
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
375fc64773
|
Windows: Ensure the appropriate versions are correct
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
d554ae0218
|
Windows: Resolve file_handler type confusion
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
c44074c685
|
Windows: Fix pslist copypasta typo
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
616f7e5d96
|
Windows: Fix up modules dumping
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
b703210024
|
Windows: Refactor names of FileInterfaces
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
3bd462720b
|
Windows: Minor typos with the last patch
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
56266f97de
|
Windows: Fix up rebased malfind and vadinfo
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
032c6b0ac7
|
Windows: Make more use of plugin.open
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
7cadbf32d4
|
Windows: Update dumping code from commit to close
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
e8fb8c929c
|
Plugins: Introduce FileHandlerInterface
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
bbc2ac0018
|
Plugins: Bump required_framework_version and yapf
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
4400c43903
|
Codebase: Yapf across the whole codebase
|
2020-10-27 01:06:24 +00:00 |
|
|
iMHLv2andikelos
|
0d4075355a
|
refs #332 catch invalid address exceptions when reading DllBase
|
2020-10-07 23:16:14 +01:00 |
|
|
Mike Auty
|
dc8bec199f
|
Windows: Minor formatting and typing improvements
|
2020-09-24 01:01:51 +01:00 |
|
|
iMHLv2andikelos
|
8baf13d3e3
|
refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps
|
2020-09-23 19:27:37 +01:00 |
|
|
memoryforensics1andikelos
|
9048c04aa4
|
envars plugin
parse environment variables
|
2020-09-22 20:03:19 +01:00 |
|
|
Mike Auty
|
c436882f4d
|
Windows: Fix up the sids JSON slightly
|
2020-09-22 19:49:34 +01:00 |
|
|
memoryforensics1andikelos
|
0f34c82b6c
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
004fc1480b
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
15bce1ce72
|
privileges plugin
added privileges plugin
|
2020-09-22 19:49:01 +01:00 |
|
|
Mike Auty
|
f3e77ad645
|
Windows: Minor typos and JSON name change in sids plugins
|
2020-09-22 19:38:36 +01:00 |
|
|
memoryforensics1andikelos
|
31080ad416
|
fix
|
2020-09-22 18:21:58 +01:00 |
|
|
memoryforensics1andikelos
|
a5d5ff2bda
|
getsids getservicesids
|
2020-09-22 18:21:58 +01:00 |
|
|
Mike Auty
|
c82ad2fbd0
|
Windows: Fix callbacks is_vista_or_later
|
2020-09-15 01:28:48 +01:00 |
|
|
Mike Auty
|
8bf7ab9218
|
Bugfix: Vadinfo invalid exception
|
2020-09-10 01:39:10 +01:00 |
|
|
cecioandikelos
|
6972ae1cc8
|
in vadinfo.py, modified an exception handling and maxsize comparison
|
2020-09-08 23:32:54 +01:00 |
|
|
cesareandikelos
|
d74032fd53
|
Added maxsize option to vadinfo as optional parameter, as in Vol2.
Right now the default is set to 0 (no limit) as opposed to Vol2 where it is
set to 1GB.
|
2020-09-08 23:32:54 +01:00 |
|
|
cecioandikelos
|
61d4ee3c0e
|
some mods in comments
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
9c5dcda6e9
|
"pe" imported directly and little modification to comment
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
d060a5cbdb
|
dump of processes extracted by psscan (Issue #318)
|
2020-09-08 22:36:09 +01:00 |
|
|
Mike Auty
|
752a62a216
|
Windows: Convert pstree to non-inheritted plugin
|
2020-09-02 11:13:39 +01:00 |
|
|
AsafEitaniandikelos
|
7ab72a1066
|
yapf and some corrections
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
81d346438a
|
Revert "changed config['dump'] to config.get('dump')"
This reverts commit 0d3017f16c.
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
5a20f7e5bf
|
Update dlllist.py
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
c29f384f55
|
changed config['dump'] to config.get('dump')
The config['dump'] caused some trouble in dlllist.
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
29e2f4485f
|
Added dlllist and netscan to timline
|
2020-08-31 17:05:20 +01:00 |
|
|
Mike Auty
|
9c74f0bc88
|
Windows: Clear-up some extra whitespace in certain plugins
|
2020-08-31 13:55:48 +01:00 |
|
|
cesareandikelos
|
ffbe4e0d1a
|
added pid filter to psscan.
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
0c90fbaae6
|
added to psscan the pid/dump option
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
c5464dce03
|
- version added
- "proc_id" moved into try/except and default value added
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
4cea3372b6
|
- moved the exception handling back to generator (followed the same approach used in procdump.py)
- changed "self" to "cls"
|
2020-08-31 13:52:04 +01:00 |
|
|
AsafEitaniandikelos
|
fe2b2ccaeb
|
moved vad_dump to vadinfo
|
2020-08-29 10:59:22 +01:00 |
|
|
AsafEitaniandikelos
|
86a7b55229
|
Update malfind.py
|
2020-08-29 10:59:22 +01:00 |
|
|
AsafEitaniandikelos
|
1c7f818c72
|
Update malfind.py
|
2020-08-29 10:59:22 +01:00 |
|
|
Mike Auty
|
ebad953a74
|
Windows: Refactor winver to versions.
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
13a3054238
|
Windows: Add in recently added plugins
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
6e816c2f20
|
Windows: Convert os_distinguisher to callable class
|
2020-08-29 10:58:16 +01:00 |
|