 superponibleandikelos
|
69be2157fb
|
fix typo
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
48e33c2b98
|
create property for HiveGenerator invalid member
|
2020-05-27 23:16:18 +01:00 |
|
|
Mike Auty
|
a0da5fef83
|
Issue #186: Rebase and apply yapf
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
36c19735ee
|
issue #186 - hivelist with new hivescan/bigpools
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
002758c7f2
|
issue #186 - hivescan and hivelist with bigpools
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
a21ab89019
|
issue #186 - add bigpools plugin
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
054d144f9b
|
issue #186 - walk forward, backward, scan if needed
|
2020-05-27 23:16:18 +01:00 |
|
|
superponibleandikelos
|
a4301afe22
|
issue #186 - skip type check on CMHIVE
|
2020-05-27 23:16:18 +01:00 |
|
|
Mike Auty
|
0c43beb42d
|
Core: Apply yapf across all files again.
|
2020-05-05 22:14:33 +01:00 |
|
|
Mike Auty
|
edecd64703
|
Yarascan: Fixes #209 by returning matched strings
|
2020-04-14 23:45:08 +01:00 |
|
|
Mike Auty
|
15d26ce415
|
Linux: Remove parameters that are unnecessary/removed.
|
2020-04-10 22:38:21 +01:00 |
|
|
Mike Auty
|
01ef78db11
|
Fix a typo in the last commit
|
2020-04-10 22:19:24 +01:00 |
|
|
Mike Auty
|
8935e4dd19
|
Fix up linuxutils to use symbol_tables rather than hard coded values
|
2020-04-10 22:12:03 +01:00 |
|
|
Andrew Caseandikelos
|
719cd0d476
|
Move module gathering into generator
|
2020-04-08 18:17:34 +01:00 |
|
|
Andrew Caseandikelos
|
b42dfd614a
|
Add API for mapping kernel addresses to kernel symbols or a specific kext
|
2020-04-08 18:17:34 +01:00 |
|
|
Michael Ligh
|
d5bdf9633d
|
refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type
|
2020-04-07 09:22:52 -05:00 |
|
|
Mike Auty
|
bd2a382d88
|
CLI & windows.handles: Improve exception handling
|
2020-03-16 22:34:03 +00:00 |
|
|
Mike Auty
|
b8bc0f0ed6
|
mac.netstat: Fix up typing and interface imports
|
2020-03-12 19:53:51 +00:00 |
|
|
Andrew Caseandikelos
|
7d6d74bc91
|
Update order of arguments
|
2020-03-12 19:47:15 +00:00 |
|
|
Andrew Caseandikelos
|
722700d2dc
|
Add docstrings
|
2020-03-12 19:47:15 +00:00 |
|
|
Andrew Caseandikelos
|
7b21e83b07
|
Mac - convert socket gathering to class method and clean up associated code
|
2020-03-12 19:47:15 +00:00 |
|
|
Mike Auty
|
77be83edc4
|
Layers: Change mapping signature to return domain length
|
2020-03-04 20:29:42 +00:00 |
|
|
Andrew Caseandikelos
|
5a99d35a9e
|
update timer code
|
2020-02-12 19:56:37 +00:00 |
|
|
Andrew Caseandikelos
|
29cc435b5e
|
update sysctl v2
|
2020-02-12 19:17:19 +00:00 |
|
|
cometandikelos
|
beed68b8bf
|
update
|
2020-01-27 23:31:05 +00:00 |
|
|
Mike Auty
|
f00453e366
|
Procdump: Remove redundant line as caught by @iMHLv2
|
2020-01-22 19:49:11 +00:00 |
|
|
Michael Lighandikelos
|
1d7da6402b
|
svcscan cleanup: win10 before 15063 uses win8 types
|
2020-01-22 19:23:30 +00:00 |
|
|
Mike Auty
|
9fe6e6ba37
|
registry: Add the hivedump plugin
|
2020-01-17 17:22:04 +00:00 |
|
|
Mike Auty
|
8f71c61440
|
layerwriter: Fix mistaken hardcoded layer name.
|
2020-01-16 23:07:27 +00:00 |
|
|
Mike Auty
|
99af98f639
|
layerwiter: Refactor to classmethod.
|
2020-01-16 22:57:47 +00:00 |
|
|
Mike Auty
|
2d408491bd
|
Printkey: Slightly improve subkey name determination.
|
2020-01-15 02:19:12 +00:00 |
|
|
Mike Auty
|
3f5b96f3c7
|
Yapf: Clean-up the whole codebase.
|
2020-01-14 15:44:07 +00:00 |
|
|
Mike Auty
|
b7ba877727
|
procdump: Enure proc_id is defined.
|
2020-01-14 15:36:54 +00:00 |
|
|
doomedravenandikelos
|
07b94abc1e
|
Update procdump.py
|
2020-01-14 10:52:05 +00:00 |
|
|
doomedravenandikelos
|
cdc0835863
|
Update procdump.py
|
2020-01-14 10:52:05 +00:00 |
|
|
doomedravenandikelos
|
e4d7b7975f
|
expose process_dump to other plugins
|
2020-01-14 10:52:05 +00:00 |
|
|
Mike Auty
|
fda64dde95
|
Mac tasks: Swap the shortcircuiting order
|
2020-01-13 14:13:37 +00:00 |
|
|
iMHLv2andGitHub
|
f7cc94a244
|
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
Use a kernel layer to read vad protection constants
|
2020-01-04 10:02:59 -06:00 |
|
|
Michael Ligh
|
b7b6c44eab
|
remove unused variable in vaddump.py
|
2020-01-04 09:35:51 -06:00 |
|
|
iMHLv2andGitHub
|
af468e7657
|
Merge pull request #162 from Lyx09/fix_vad_dump_var
VadDump: Fix incorrect variable out_of_range in vad_dump
|
2020-01-04 09:34:25 -06:00 |
|
|
Mike Auty
|
d2daa12564
|
Malfind: Rename the layer_name parameter to be more descripttive
|
2020-01-03 22:12:04 +00:00 |
|
|
Andrew Caseandikelos
|
d7f5a13c46
|
Mac - properly check for broken proc pointers
|
2020-01-03 19:42:18 +00:00 |
|
|
Andrew Caseandikelos
|
3bf3e0601a
|
Remove earliler trigger of SymbolError
|
2020-01-03 17:50:06 +00:00 |
|
|
Andrew Caseandikelos
|
a66e1bb6c2
|
Move symbol catching to generator
|
2020-01-03 17:50:06 +00:00 |
|
|
Andrew Caseandikelos
|
65556a2c92
|
Linux - update handling of kernels that do not have loadable module support
|
2020-01-03 17:50:06 +00:00 |
|
|
William LIN
|
e6656c96af
|
VadDump: Fix incorrect variable out_of_range in vad_dump
|
2019-12-26 19:51:13 +01:00 |
|
|
Michael Ligh
|
cd841616af
|
refs #144 use a kernel layer to read vad protection constants
|
2019-12-08 07:46:02 -06:00 |
|
|
Mike Auty
|
fa26dbf659
|
Yarascan: Make generic yarascan just scan kernel memory.
|
2019-12-04 23:17:10 +00:00 |
|
|
Mike Auty
|
f34958a16d
|
Poolscanner: Add necessary exception handling.
|
2019-12-04 22:11:42 +00:00 |
|
|
Mike Auty
|
386f94d9ee
|
Pool: Make object_header type checking the plugin's responsibility.
|
2019-12-04 22:11:42 +00:00 |
|