doomedraven and ikelos
e4d7b7975f
expose process_dump to other plugins
2020-01-14 10:52:05 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
iMHLv2 and GitHub
f7cc94a244
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
...
Use a kernel layer to read vad protection constants
2020-01-04 10:02:59 -06:00
Michael Ligh
b7b6c44eab
remove unused variable in vaddump.py
2020-01-04 09:35:51 -06:00
iMHLv2 and GitHub
af468e7657
Merge pull request #162 from Lyx09/fix_vad_dump_var
...
VadDump: Fix incorrect variable out_of_range in vad_dump
2020-01-04 09:34:25 -06:00
Mike Auty
d2daa12564
Malfind: Rename the layer_name parameter to be more descripttive
2020-01-03 22:12:04 +00:00
Andrew Case and ikelos
d7f5a13c46
Mac - properly check for broken proc pointers
2020-01-03 19:42:18 +00:00
Andrew Case and ikelos
3bf3e0601a
Remove earliler trigger of SymbolError
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
a66e1bb6c2
Move symbol catching to generator
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
65556a2c92
Linux - update handling of kernels that do not have loadable module support
2020-01-03 17:50:06 +00:00
William LIN
e6656c96af
VadDump: Fix incorrect variable out_of_range in vad_dump
2019-12-26 19:51:13 +01:00
Michael Ligh
cd841616af
refs #144 use a kernel layer to read vad protection constants
2019-12-08 07:46:02 -06:00
Mike Auty
fa26dbf659
Yarascan: Make generic yarascan just scan kernel memory.
2019-12-04 23:17:10 +00:00
Mike Auty
f34958a16d
Poolscanner: Add necessary exception handling.
2019-12-04 22:11:42 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Michael Ligh and ikelos
d0f9cf9a2f
refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299
2019-12-04 21:19:19 +00:00
Mike Auty
af3b3e305f
Timeliner: Report progress on which plugin is being run.
2019-12-04 17:25:33 +00:00
Mike Auty
b6d807ff51
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
2019-11-27 11:30:14 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
249c3ec223
Svcscan: Ensure or later checks are done in order.
...
Relates to issue 139.
2019-11-18 20:57:34 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
40fcdf9469
exceptions: SymbolErrors now contain specific information
2019-11-13 19:27:00 +00:00
doomedraven and ikelos
4543b0af33
Update vaddump.py
2019-11-13 18:54:19 +00:00
doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
ee31ece006
Fix a logging on add_process_layer exceptions.
...
There were a number of issues with commit 3df5e995
2019-11-03 23:15:38 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
dd3e09f1e2
frameworkinfo: Make this a core plugin, not an optional extra.
2019-10-31 22:14:43 +00:00
Mike Auty
4457bcaee0
vadyarascan: Ensure we scan the right layer
...
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
2019-10-31 19:15:02 +00:00
Mike Auty
27a291cf61
Remove the erronious print statement, which should be a vollog message if needed.
2019-10-18 08:39:56 -04:00
Mike Auty
0be9061989
Tidy up commit e0097ac.
2019-10-18 08:38:17 -04:00
atcuno
545376d725
Mac - update trustedbsd
2019-10-17 15:30:13 -04:00
atcuno
3df5e9957e
Windows - add missing add_process_layer exception handling in a few plugins
2019-10-17 11:47:19 -04:00
atcuno
e0097ac9c1
Windows - protect handles from smear
2019-10-17 11:03:48 -04:00
atcuno
2e329d1106
Windows - add exception handling around is_valid in callbacks
2019-10-17 10:22:06 -04:00
Mike Auty
3784c9aff6
Fix up missing/inaccurate plugin description strings.
2019-10-03 01:05:57 +01:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty
9a17beb77f
Ensure consistency of importing interfaces.
2019-10-02 01:18:46 +01:00
Mike Auty
8e10f4e3d1
Clarify handles error message.
2019-10-02 00:06:25 +01:00
Mike Auty
9ac622afa0
Fix up import style to be consistent.
2019-10-01 23:46:02 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Andrew Case and ikelos
bf29e23e1c
add updated mac ifconfig support
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
2a98227306
Mac - have pstree inherit from tasks
2019-09-26 23:11:26 -05:00
Andrew Case
b1d07396a0
Mac - have psaux inherit from tasks
2019-09-26 23:08:33 -05:00
