Mike Auty
0f93caeebf
Forgot the TODO tag.
2018-02-08 00:06:59 +00:00
Mike Auty
b27705d1e7
Add in pid filtering based on the pid config option.
2018-02-08 00:05:33 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
60e1aebaf8
Improve the plugin help descriptions.
2017-11-25 16:19:47 +00:00
Mike Auty
2322a1b071
Pass the keypath through the recursion rather than expensively regenerating it.
2017-11-23 01:02:06 +00:00
Dave Lassalle
fdcab2760e
change name of ntsymbols and call to get_key
2017-11-22 16:03:55 -06:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
330832e546
Just to make it easier in case of renames, etc.
2017-11-13 01:20:08 +00:00
Mike Auty
327c8cb073
Make use of the hivelist plugin when no offset is provided to printkey.
2017-11-13 01:19:54 +00:00
Mike Auty
a60fcba32f
Make sure we don't assume that the primary layer's config lives under our own.
2017-11-13 01:18:54 +00:00
Mike Auty
769e1226c4
Make creating subconfigs simpler from configurables.
2017-11-13 00:59:01 +00:00
Mike Auty
18f1e5ae90
Re-order the output of the printkey plugin.
2017-11-10 18:08:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
7c6970212f
Fix recursion (it wasn't being passed the argument).
2017-11-08 01:00:15 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
28036c9405
Add in the ability to recurse keys (off by default).
2017-10-23 17:11:15 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
957fa23af2
Move the registry plugin to an appropriate location.
2017-10-09 00:19:05 +01:00
Mike Auty
930c8a2e08
Make the registry test plugin work with keys and offset parameters.
2017-10-09 00:19:05 +01:00
Mike Auty
a12246a423
Shift the order of the columns.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
38b6e12ec5
Minor changes to the testrig.
2017-10-09 00:19:05 +01:00
Mike Auty
0f1e84139f
Remove the extra regtest plugin.
2017-10-09 00:18:15 +01:00
Mike Auty
27e5dbfcc6
Add in testing plugin temporarily.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
6c6d0473a1
Fixed table names will no longer work since tables are prefix-named.
2017-09-03 23:17:40 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
9b835b1baf
Remove excess windows volshell local variables.
2017-08-29 23:55:34 +01:00
Mike Auty
f40665f1b7
Split volshell into windows and base/os-agnostic versions.
2017-08-29 23:54:11 +01:00
Mike Auty
cdf64ae08e
Add in initial implementation, currently with windows specific bits.
2017-08-29 01:06:46 +01:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
570a2d35be
Make the DllList import a little more sensible/consistent.
2017-08-10 10:07:57 +01:00
Mike Auty
c19ad1cb22
Placeholder change to ensure even if we don't change it to a from statement, it isn't bizarre.
2017-08-10 10:03:39 +01:00
Mike Auty
8be6869a84
Tidy up imports and adhere to the coding style of never directly importing objects.
2017-08-09 22:22:43 +01:00
Mike Auty
775ece3cb2
Convert the 'ntkrnlmp' requirement into an 'nt' requirement.
2017-07-24 15:43:34 +01:00
Mike Auty
8ad9fbfd24
Ensure imported plugins have their correct requirements fulfilled (even if they change).
2017-07-24 15:41:47 +01:00
ikelos and GitHub
fe66301cf3
Merge pull request #8 from volatilityfoundation/mhl-cmhive
...
move the hive name decision to _CMHIVE extension for hivelist (and ot…
2017-07-19 20:43:05 +01:00
iMHLv2
770dba1f0a
use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr
2017-07-19 18:12:50 +00:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
iMHLv2
cc8114e872
add the modules plugin for windows
2017-07-18 23:51:35 +00:00
iMHLv2
60e67a80d8
fix a misleading pydoc string in the hivelist plugin
2017-07-18 23:50:38 +00:00
iMHLv2
8493f4c4d6
add hivelist plugin for windows
2017-07-18 23:21:44 +00:00
Mike Auty
4838a17f24
Ensure that the framework plugins are always loaded.
2017-07-02 15:51:41 +01:00
Mike Auty
dd7ea07228
Rejig plugins and partially parse the command-line options to set a plugin path early.
2017-06-01 00:54:07 +01:00
Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
b6b984503f
Fix up help messages for plugins.
2017-04-21 00:52:06 +01:00
Mike Auty