Mike Auty
8ddfe8ce16
Update plugins using the old PESymbolTable method
2019-08-09 00:49:05 +01:00
Mike Auty
fbeab3608c
Make we raise if the _POOL_HEADER type doesn't exist.
2019-08-08 01:09:56 +01:00
Mike Auty
253ce69fc9
Refactor poolscanner layer to move more into the parallel scanner.
2019-08-07 18:37:56 +01:00
Mike Auty
9ed1a5a5b6
The header is not dependent on the constraint, so only construct it once.
2019-08-07 16:33:13 +01:00
Mike Auty
164079c203
Casting will use the original object's symbol_table if none is provided.
2019-07-23 00:46:09 +01:00
Mike Auty
e78839b5e9
DON'T import from framework.plugins. It won't work.
2019-07-16 00:37:23 +01:00
Analyst and ikelos
6e4fa57421
move type_classes to dictionaries stored in their modules rather than separate classes (see 81d3293)
2019-07-15 21:16:32 +01:00
Analyst and ikelos
79c7c6df95
change context.memory to context.layers per 272224a
2019-07-15 21:16:32 +01:00
Analyst and ikelos
a26b9bb57d
don't require pslist.PsList.list_processes_filter_requirements - it introduces --pid to the plugin's arguments
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e1d160baee
fix typing for get_vad_maps()
2019-07-15 21:16:32 +01:00
Analyst and ikelos
20d7152050
remove unnecessary debugging
2019-07-15 21:16:32 +01:00
Analyst and ikelos
3ea0432ee4
fix the typing for get_record_tuple()
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e6ae049d18
add svcscan and associated types
2019-07-15 21:16:32 +01:00
Mike Auty
f5615e28f6
Fix up more typing discrepancies.
2019-07-15 17:43:43 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
ef28a9b733
Apparently, it wasn't in 3.5, but it throws type-checking errors
...
Python3.6 introduced it, but annoying the type-checker realizes that
we're using it like any int (ie, A | B) and throws a wobbly. Really
want to see the back of python3.5...
Revert "IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen."
This reverts commit 17a0e1eac8
2019-06-28 15:31:59 +01:00
Mike Auty
17a0e1eac8
IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen.
2019-06-28 15:29:40 +01:00
Mike Auty
81d3293414
Move type_classes to dictionaries stored in their modules rather than separate tables.
2019-05-29 22:14:38 +01:00
Mike Auty
6a12361977
Fix up minor typo in info plugin.
2019-05-29 22:14:25 +01:00
Andrew Case
2a8a1523e5
Mac - add lsof plugin
2019-05-29 14:49:55 -05:00
Andrew Case
66690bcbfe
Merge branch 'master' of https://github.com/volatilityfoundation/volatility3
2019-05-29 14:07:06 -05:00
Andrew Case
600af7299b
Mac - add check_sysctl plugin
2019-05-29 14:06:51 -05:00
Analyst and ikelos
a90f3ed1a7
fixup an instance of is_windows_7 in poolscanner
2019-05-29 14:46:22 +01:00
Mike Auty
4ff137bc18
Fix up a is_windows_8_or_later call.
2019-05-29 14:46:22 +01:00
Mike Auty
38f249aef2
Change the os-distguisher to make it more flexible.
2019-05-29 14:46:22 +01:00
Mike Auty
867edc9501
Add in the os-distinguisher code.
2019-05-29 14:46:22 +01:00
Andrew Case
15e546c23c
Mac - add check_trap_table
2019-05-28 22:01:28 -05:00
Mike Auty
2b6007857e
Fix up type signature of filter_func for windows pslist.
2019-05-26 20:45:24 +01:00
Dave Lassalle and ikelos
61f9173bb6
initial hivescan plugin
2019-04-27 14:02:07 +01:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
90ef8f363f
Have hivelist traverse in both directions in case of invalid addresses.
2019-04-11 00:38:46 +01:00
Mike Auty
5b8645bd1f
Revert IntFlag change until we drop python 3.5 support.
2019-04-05 22:56:36 +01:00
Mike Auty
af7d969ace
Fix up variable type assignment.
2019-04-05 14:51:23 +01:00
Mike Auty
87bf1da424
Don't use mutable defaults.
2019-04-05 14:50:39 +01:00
Mike Auty
fa94ef3271
Use the flag type for flags.
2019-04-05 14:49:44 +01:00
Analyst
d44049121f
pefile APIs for accessing VS_FIXEDFILEINFO changed. this patch attempts to handle both older and newer versions
2019-03-30 16:06:09 -05:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Mike Auty
7904be3fd2
Yapf reformat all files.
2019-03-04 22:11:44 +00:00
Mike Auty
01a9e63f09
Fix up an additional import in driverirp.
2019-03-04 21:51:31 +00:00
Analyst
801ba5840f
add the driverirp plugin
2019-03-04 12:59:18 -06:00
Analyst
0b07fc33ec
fix the imports in driverscan and modscan
2019-03-04 11:58:36 -06:00
Analyst
31d17fa19e
Revert "fix psscan and mutantscan imports now that core plugins are under framework"
...
This reverts commit 99f9a989cb
2019-03-04 11:57:23 -06:00
Analyst
6e66b3e702
update ssdt with a build_module_collection classmethod, so it can be shared with other plugins
2019-03-04 11:57:07 -06:00
Analyst
fb36db098e
add the modscan plugin
2019-03-04 11:02:53 -06:00
Analyst
901a38d40b
pool scanner update: we only ask for specific object types, so no need to filter the results anymore
2019-03-04 11:00:42 -06:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
99f9a989cb
fix psscan and mutantscan imports now that core plugins are under framework
2019-03-04 10:30:26 -06:00
Mike Auty
cdbe0306f0
Fix the nullfilter for mac process lists.
2019-03-03 14:57:34 +00:00
Mike Auty
7cc54ba23a
Add in LayerWriter plugin.
2019-03-02 23:09:12 +00:00
Mike Auty
7c9696def9
Minor fixes for typing and imports.
2019-03-02 22:45:39 +00:00
Mike Auty