Commit Graph

  • 4bf0a97703 Revert "Refactor the ordering of things in CrashDump initializer." Mike Auty 2019-04-27 22:06:58 +01:00
  • 9ce139d4e2 Allow configs to potentially be accessed before initialization has happened. Mike Auty 2019-04-27 22:06:39 +01:00
  • ca46f090c2 Fix up pdbparse GUID parsing to use Bytes. Mike Auty 2019-04-27 22:02:02 +01:00
  • ac57255b23 Refactor the ordering of things in CrashDump initializer. Mike Auty 2019-04-27 21:38:01 +01:00
  • a7160dd6b6 Move the PDB downloading code and test for file writability. Mike Auty 2019-04-27 21:06:25 +01:00
  • 470d3906dc Improve PDB parsing to include symbol undecoration. Mike Auty 2019-04-27 21:05:55 +01:00
  • 61f9173bb6 initial hivescan plugin Dave Lassalleandikelos 2019-03-20 15:46:38 -05:00
  • 7c16c403d5 Ensure we delete the temorary file even if things go wrong. Mike Auty 2019-04-23 22:43:16 +01:00
  • 60144c44d3 Add in base-type generation for pdbconv.py. Mike Auty 2019-04-23 22:28:29 +01:00
  • 93ddb9596b Add in base-type generator. Mike Auty 2019-04-23 21:37:51 +01:00
  • 9350f7b88a Don't forget to cleanup. Mike Auty 2019-04-23 00:32:29 +01:00
  • ac282d01fb Add in initial support at automatic downloading. Mike Auty 2019-04-23 00:16:19 +01:00
  • c229cf4db2 Fix schema issues with pdbconv and a couple small issues. Mike Auty 2019-04-23 00:15:49 +01:00
  • a1f7d1a1de Add in missing import. Mike Auty 2019-04-22 23:29:25 +01:00
  • 717f67fd1a Clean up after downloading a PDB and support additional determining of size. Mike Auty 2019-04-22 21:09:17 +01:00
  • d9d3a29b08 Remove llvm2json since pdbconv now exists. Mike Auty 2019-04-22 20:50:36 +01:00
  • c07c4f5625 Add in pdb retreival and argparse support. Mike Auty 2019-04-22 20:49:30 +01:00
  • 75fb8aa301 Add in GUID production to pdbconv. Mike Auty 2019-04-22 14:41:08 +01:00
  • 81d5fdd58d Add in some missing types. Mike Auty 2019-04-22 13:51:23 +01:00
  • 1f0947d7e1 Add in pdbconv script to completely generate the JSON from a PDB file using pdbparse. Mike Auty 2019-04-22 01:45:00 +01:00
  • e468ab7f74 Setting loglevel to 0 doesn't work properly. Mike Auty 2019-04-21 13:22:22 +01:00
  • 5b0f99229c Remove the VolTemplateProxy method proxying to fix the slowdown. Mike Auty 2019-04-18 01:48:56 +01:00
  • 754b3f0bc6 Refactor create_filter to create_pid_filter. Mike Auty 2019-04-18 01:10:07 +01:00
  • 603512122d Allow class_types to be specified as part of SymbolTable construction. Mike Auty 2019-04-18 01:03:59 +01:00
  • 8c76a25b2d Allow VolTemplateProxies to include additional useful methods. Mike Auty 2019-04-17 23:50:31 +01:00
  • e5d6cd3d16 Add in Enum ObjectTemplate lookup method. Mike Auty 2019-04-17 22:39:52 +01:00
  • 90ef8f363f Have hivelist traverse in both directions in case of invalid addresses. Mike Auty 2019-04-11 00:38:46 +01:00
  • 45268245ca Add in base __getattr__ to appease ObjectInterface vs Struct issues. Mike Auty 2019-04-07 19:08:48 +01:00
  • 772a30403f Add in renderer selection and a CSV renderer. Mike Auty 2019-04-07 19:07:32 +01:00
  • 5b8645bd1f Revert IntFlag change until we drop python 3.5 support. Mike Auty 2019-04-05 22:56:36 +01:00
  • db3c120aa7 Fix up typing for the import warning spec. Mike Auty 2019-04-05 14:53:41 +01:00
  • af7d969ace Fix up variable type assignment. Mike Auty 2019-04-05 14:51:23 +01:00
  • 87bf1da424 Don't use mutable defaults. Mike Auty 2019-04-05 14:50:39 +01:00
  • cc3a9ea4d8 Fix locking type issue. Mike Auty 2019-04-05 14:50:22 +01:00
  • fa94ef3271 Use the flag type for flags. Mike Auty 2019-04-05 14:49:44 +01:00
  • c85430c28e More typing fixes. Mike Auty 2019-04-05 14:24:08 +01:00
  • f24fbe6f0f Fix up alignment issue. Mike Auty 2019-04-05 12:43:13 +01:00
  • 223ad230cf Fix up typing issues. Mike Auty 2019-04-05 12:37:57 +01:00
  • 301fac91ac Add in initial renderer code for CLI table formatting. Mike Auty 2019-04-01 00:07:50 +01:00
  • d44049121f pefile APIs for accessing VS_FIXEDFILEINFO changed. this patch attempts to handle both older and newer versions Analyst 2019-03-30 16:06:09 -05:00
  • 9e727f6716 Attempt to fix windows OSError on certain datetimes. Mike Auty 2019-03-29 13:39:32 +00:00
  • 29aee0baff Update TreeGrid documentation. Mike Auty 2019-03-29 11:49:10 +00:00
  • 5120860a60 fix two bugs that prevented poolscanners from working on 2012 samples Analyst 2019-03-25 09:51:55 -05:00
  • 93e66381ad use an alignmemt based on the cpu arch, not the pool header size Analyst 2019-03-20 11:53:26 -05:00
  • 2138152b10 fix a bug in psscan on xp images Michael Ligh 2019-03-19 11:14:10 -05:00
  • f1bbba1048 Make the comparison output quiet and ignore the volatility script name. Mike Auty 2019-03-15 14:43:15 +00:00
  • 372533b234 Improve registry subkey support (now recurses properly). Mike Auty 2019-03-13 00:03:02 +00:00
  • d15dd469b5 Add in a volatility3 vs volatility2 test-rig. Mike Auty 2019-03-10 12:35:33 +00:00
  • 0cb0150943 Add in optional dependency on schema validation. Mike Auty 2019-03-09 13:39:26 +00:00
  • 9c4bd556f6 add the symlinkscan plugin Analyst 2019-03-07 09:00:19 -06:00
  • 7904be3fd2 Yapf reformat all files. Mike Auty 2019-03-04 22:11:44 +00:00
  • 6613c7db19 Improve the documentation around the volatility.framework.plugins error. Mike Auty 2019-03-04 22:07:36 +00:00
  • 01a9e63f09 Fix up an additional import in driverirp. Mike Auty 2019-03-04 21:51:31 +00:00
  • be0d010f1a Add in warning if anyone tries to import from volatility.framework.plugins rather than voltility.plugins. Mike Auty 2019-03-04 21:46:45 +00:00
  • 801ba5840f add the driverirp plugin Analyst 2019-03-04 12:59:18 -06:00
  • 0b07fc33ec fix the imports in driverscan and modscan Analyst 2019-03-04 11:58:36 -06:00
  • 31d17fa19e Revert "fix psscan and mutantscan imports now that core plugins are under framework" Analyst 2019-03-04 11:57:23 -06:00
  • 6e66b3e702 update ssdt with a build_module_collection classmethod, so it can be shared with other plugins Analyst 2019-03-04 11:57:07 -06:00
  • fb36db098e add the modscan plugin Analyst 2019-03-04 11:02:53 -06:00
  • 901a38d40b pool scanner update: we only ask for specific object types, so no need to filter the results anymore Analyst 2019-03-04 11:00:42 -06:00
  • e1701947f8 add the windows driverscan plugin Analyst 2019-03-04 10:37:33 -06:00
  • 99f9a989cb fix psscan and mutantscan imports now that core plugins are under framework Analyst 2019-03-04 10:30:26 -06:00
  • cdbe0306f0 Fix the nullfilter for mac process lists. Mike Auty 2019-03-03 14:57:34 +00:00
  • ebadd4fbd6 Remove redundant load of segments by the lime layer. Mike Auty 2019-03-03 13:09:49 +00:00
  • 784336bb6e Add in mac KDK generate_json script. Mike Auty 2019-03-03 01:12:07 +00:00
  • 7cc54ba23a Add in LayerWriter plugin. Mike Auty 2019-03-02 23:09:12 +00:00
  • 7c9696def9 Minor fixes for typing and imports. Mike Auty 2019-03-02 22:45:39 +00:00
  • d4045c9c13 Significant fix for reading from the start of SegmentedLayers (including Lime) when ignoring errors. Mike Auty 2019-03-02 22:44:51 +00:00
  • 14a9788802 Fix a typo in the parallelism code. Mike Auty 2019-03-02 19:34:31 +00:00
  • 0e1f491335 Turn off parallelism by default (seems to be faster?). Mike Auty 2019-03-02 19:02:34 +00:00
  • 33a9db6b9f Make parallelism options more well defined. Mike Auty 2019-03-02 18:52:02 +00:00
  • 9fadee1a17 Add locking for threaded operation. Mike Auty 2019-03-02 18:07:48 +00:00
  • 1e9205a75f Add in mac KDK dmg kernel extraction script. Mike Auty 2019-03-01 01:40:19 +00:00
  • 2aa07596c2 Fix up filtering in mac and remove the last of the filter shadowing. Mike Auty 2019-02-28 09:48:15 +00:00
  • c5e2490f40 Make complementary fixes in linux/mac pslist. Mike Auty 2019-02-27 19:22:37 +00:00
  • b1c3ecfa17 add mutantscan Analyst 2019-02-27 12:49:50 -06:00
  • 8c85d133f0 Update plugins that used create_filter to filter on pids. Mike Auty 2019-02-27 17:35:30 +00:00
  • a3dfb9661f Update create_filter method to actually filter appropriately. Mike Auty 2019-02-27 17:33:08 +00:00
  • d4e12c982d fix a critical issue determining the names of windows kernel objects from the object header Analyst 2019-02-27 10:45:36 -06:00
  • 8baafaac7b add handle offset to the handles plugin output Analyst 2019-02-27 10:14:52 -06:00
  • 224ea8ee2a add the filescan plugin Analyst 2019-02-27 08:46:39 -06:00
  • 26ae324050 Add in attempt at name demangling for symbols. Mike Auty 2019-02-27 11:26:24 +00:00
  • 2b001fad4d Make sure we get 4 ints, not 8 shorts. Mike Auty 2019-02-26 23:02:34 +00:00
  • 72c4deaf66 Revamp the ip address conversion code and reformat mac files. Mike Auty 2019-02-26 22:59:21 +00:00
  • b1537f0789 Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename. Mike Auty 2019-02-26 22:25:46 +00:00
  • 03eddbfb74 Fix missing imports removed by the rebase. Mike Auty 2019-02-26 22:25:15 +00:00
  • 451f73bfe2 change generic.GenericIntelProcess -> objects.Struct Andrew Caseandikelos 2019-02-26 13:22:45 -06:00
  • 75a6113369 remove another int cast from netstat Andrew Caseandikelos 2019-02-26 13:12:26 -06:00
  • 7d15a1667e remove int cast from netstat Andrew Caseandikelos 2019-02-26 13:11:13 -06:00
  • 932246e11e remove header on netstat Andrew Caseandikelos 2019-02-26 13:08:52 -06:00
  • c9adc6a0fa remove usage of old string methods Andrew Caseandikelos 2019-02-26 13:05:28 -06:00
  • c5cc88b245 actually add mac_netstat plugin Andrew Caseandikelos 2018-12-28 15:15:10 -06:00
  • 6d2a5fbfaa add mac_netstat and supporting networking code Andrew Caseandikelos 2018-12-28 15:14:28 -06:00
  • d8413efc1d Add in further ignoring of the 0xf7 unicode character. Mike Auty 2019-02-25 22:51:41 +00:00
  • e0d2edbca1 Remove ord for unsigned int and don't cast int objects to ints. Mike Auty 2019-02-24 23:56:34 +00:00
  • d68b94965c catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue() Michael Ligh 2019-02-24 17:14:28 -06:00
  • 63787acb50 fix the handling of TypeInfo after 9b488f8 Analyst 2019-02-24 15:24:37 -06:00
  • b335b2320d Minor performance fix for PE extension and yapf of poolscanner. Mike Auty 2019-02-18 00:07:19 +00:00
  • 6b3eef4083 Additional optimization by extracting the struct calls from the intel translation methods. Mike Auty 2019-02-14 23:42:06 +00:00
  • 7b06480d7e Major speed-up for bulk scanning of images. Mike Auty 2019-02-14 22:14:32 +00:00