 Mike Auty
|
f3e77ad645
|
Windows: Minor typos and JSON name change in sids plugins
|
2020-09-22 19:38:36 +01:00 |
|
|
memoryforensics1andikelos
|
31080ad416
|
fix
|
2020-09-22 18:21:58 +01:00 |
|
|
memoryforensics1andikelos
|
a5d5ff2bda
|
getsids getservicesids
|
2020-09-22 18:21:58 +01:00 |
|
|
Mike Auty
|
77312e193a
|
Plugins: Update the banner plugin filename.
|
2020-09-22 00:25:20 +01:00 |
|
|
Mike Auty
|
0ac26d40a1
|
Plugins: Support mac banners as well
|
2020-09-22 00:21:13 +01:00 |
|
|
Mike Auty
|
0a57a49572
|
Plugins: Add LinuxBanners plugin
|
2020-09-22 00:21:13 +01:00 |
|
|
Andrew Caseandikelos
|
e58e55b433
|
Update code for better variable names and minor version bump
|
2020-09-16 17:35:49 +01:00 |
|
|
Andrew Caseandikelos
|
afe39eee1b
|
Add new method for safe walking of generic list heads. Convert pslist to use it.
|
2020-09-16 17:35:49 +01:00 |
|
|
Mike Auty
|
c82ad2fbd0
|
Windows: Fix callbacks is_vista_or_later
|
2020-09-15 01:28:48 +01:00 |
|
|
Andrew Caseandikelos
|
5e53440b43
|
Add the socket filters plugin for OSX
|
2020-09-13 22:06:09 +01:00 |
|
|
Andrew Caseandikelos
|
40eafa03e6
|
Change bad copy/descriptions for Mac that say Linux
|
2020-09-11 01:37:56 +01:00 |
|
|
Andrew Caseandikelos
|
98d6844ac0
|
Address ikelos's review comments
|
2020-09-11 01:28:14 +01:00 |
|
|
Andrew Caseandikelos
|
6673d4774c
|
Add cached file listing plugin for Mac
|
2020-09-11 01:28:14 +01:00 |
|
|
Mike Auty
|
8bf7ab9218
|
Bugfix: Vadinfo invalid exception
|
2020-09-10 01:39:10 +01:00 |
|
|
cecioandikelos
|
6972ae1cc8
|
in vadinfo.py, modified an exception handling and maxsize comparison
|
2020-09-08 23:32:54 +01:00 |
|
|
cesareandikelos
|
d74032fd53
|
Added maxsize option to vadinfo as optional parameter, as in Vol2.
Right now the default is set to 0 (no limit) as opposed to Vol2 where it is
set to 1GB.
|
2020-09-08 23:32:54 +01:00 |
|
|
cecioandikelos
|
61d4ee3c0e
|
some mods in comments
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
9c5dcda6e9
|
"pe" imported directly and little modification to comment
|
2020-09-08 22:36:09 +01:00 |
|
|
cecioandikelos
|
d060a5cbdb
|
dump of processes extracted by psscan (Issue #318)
|
2020-09-08 22:36:09 +01:00 |
|
|
Mike Auty
|
752a62a216
|
Windows: Convert pstree to non-inheritted plugin
|
2020-09-02 11:13:39 +01:00 |
|
|
AsafEitaniandikelos
|
7ab72a1066
|
yapf and some corrections
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
81d346438a
|
Revert "changed config['dump'] to config.get('dump')"
This reverts commit 0d3017f16c.
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
5a20f7e5bf
|
Update dlllist.py
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
c29f384f55
|
changed config['dump'] to config.get('dump')
The config['dump'] caused some trouble in dlllist.
|
2020-08-31 17:05:20 +01:00 |
|
|
AsafEitaniandikelos
|
29e2f4485f
|
Added dlllist and netscan to timline
|
2020-08-31 17:05:20 +01:00 |
|
|
Mike Auty
|
9c74f0bc88
|
Windows: Clear-up some extra whitespace in certain plugins
|
2020-08-31 13:55:48 +01:00 |
|
|
cesareandikelos
|
ffbe4e0d1a
|
added pid filter to psscan.
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
0c90fbaae6
|
added to psscan the pid/dump option
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
c5464dce03
|
- version added
- "proc_id" moved into try/except and default value added
|
2020-08-31 13:52:04 +01:00 |
|
|
cesareandikelos
|
4cea3372b6
|
- moved the exception handling back to generator (followed the same approach used in procdump.py)
- changed "self" to "cls"
|
2020-08-31 13:52:04 +01:00 |
|
|
AsafEitaniandikelos
|
fe2b2ccaeb
|
moved vad_dump to vadinfo
|
2020-08-29 10:59:22 +01:00 |
|
|
AsafEitaniandikelos
|
86a7b55229
|
Update malfind.py
|
2020-08-29 10:59:22 +01:00 |
|
|
AsafEitaniandikelos
|
1c7f818c72
|
Update malfind.py
|
2020-08-29 10:59:22 +01:00 |
|
|
Mike Auty
|
ebad953a74
|
Windows: Refactor winver to versions.
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
13a3054238
|
Windows: Add in recently added plugins
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
6e816c2f20
|
Windows: Convert os_distinguisher to callable class
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
71366cde33
|
Windows: Refactor the location of os_distinguisher
|
2020-08-29 10:58:16 +01:00 |
|
|
Mike Auty
|
8143f75054
|
Plugin: Clarify the isfinfo filter parameter
|
2020-08-29 10:57:39 +01:00 |
|
|
Mike Auty
|
94c0307373
|
Plugin: Change the file parameter to isf
|
2020-08-29 10:57:39 +01:00 |
|
|
Mike Auty
|
c2762dc6fa
|
Plugin: Add initial version of ISFinfo plugin
|
2020-08-29 10:57:39 +01:00 |
|
|
Mike Auty
|
5bd0cf0e2e
|
Windows: Fix wrote attribute in cmdline plugin
Fixes #316.
|
2020-08-28 01:43:41 +01:00 |
|
|
Mike Auty
|
b41658e71f
|
Windows: Fix issue with extensions.pe
|
2020-08-27 00:23:16 +01:00 |
|
|
Mike Auty
|
7b9375832f
|
Windows: Don't forget to clear out moddump
|
2020-08-26 22:15:24 +01:00 |
|
|
Mike Auty
|
8ed5767c92
|
Windows: Clean up memmap based on @imhlv2's suggestion
|
2020-08-26 20:36:52 +01:00 |
|
|
Mike Auty
|
89b466c8ac
|
Plugins: Fixes for good spots by IMHLv2
|
2020-08-26 20:36:52 +01:00 |
|
|
Mike Auty
|
5bc6c4a33b
|
Plugins: Bump versions for plugin with new features
|
2020-08-26 20:36:52 +01:00 |
|
|
Mike Auty
|
1459bdda39
|
Plugins: Change most *dump plugins to --dump
|
2020-08-26 20:36:52 +01:00 |
|
|
cesareandikelos
|
f78820faf7
|
- version added
- "proc_id" moved into try/except and default value added
|
2020-08-25 12:16:38 +01:00 |
|
|
cesareandikelos
|
e16953c7f9
|
- moved the exception handling back to generator (followed the same approach used in procdump.py)
- changed "self" to "cls"
|
2020-08-25 12:16:38 +01:00 |
|
|
cesareandikelos
|
64c0d1f43b
|
Added method "get_cmdline" to be able to call the plugin on a single process.
The general plugin behaviour is exactly the same, just moved the "query" part in a
single method, callable from outside
|
2020-08-25 12:16:38 +01:00 |
|