├── rekall_framework ├── config │ └── dpkg │ │ ├── compat │ │ ├── python-rekall.docs │ │ └── changelog ├── debian │ ├── source │ │ └── format │ ├── .gitignore │ ├── changelog.in │ └── changelog ├── tools │ ├── osx │ │ └── MacPmem │ │ │ ├── STYLE.md │ │ │ └── MacPmem.xcodeproj │ │ │ └── project.xcworkspace │ │ │ └── contents.xcworkspacedata │ ├── testing │ │ ├── .gitignore │ │ └── images │ │ │ ├── failed.png │ │ │ ├── success.png │ │ │ └── stopwatch-silhouette-hi.png │ ├── layout_expert │ │ ├── layout_expert │ │ │ ├── lib │ │ │ │ └── __init__.py │ │ │ ├── parsers │ │ │ │ └── __init__.py │ │ │ ├── c_ast │ │ │ │ └── __init__.py │ │ │ ├── visitors │ │ │ │ └── __init__.py │ │ │ ├── layout │ │ │ │ └── __init__.py │ │ │ ├── preprocessing_visitors │ │ │ │ └── __init__.py │ │ │ ├── common │ │ │ │ └── __init__.py │ │ │ ├── preprocessing_parser │ │ │ │ └── __init__.py │ │ │ ├── serialization │ │ │ │ └── __init__.py │ │ │ ├── builtins │ │ │ │ └── __init__.py │ │ │ ├── config_parser │ │ │ │ └── __init__.py │ │ │ └── preprocessing_loader │ │ │ │ └── __init__.py │ │ ├── MANIFEST.in │ │ └── .gitattributes │ ├── linux │ │ ├── lmap │ │ │ ├── .gitignore │ │ │ ├── log │ │ │ │ └── CMakeLists.txt │ │ │ ├── test │ │ │ │ └── test_data │ │ │ │ │ ├── host │ │ │ │ │ ├── parasite │ │ │ │ │ └── parasite.shstrtab │ │ │ ├── kohook │ │ │ │ └── CMakeLists.txt │ │ │ ├── minpmem │ │ │ │ └── Kbuild.in │ │ │ ├── lmap │ │ │ │ └── CMakeLists.txt │ │ │ └── elfrelink │ │ │ │ └── CMakeLists.txt │ │ └── .gitignore │ ├── installers │ │ ├── .gitignore │ │ └── README │ ├── windows │ │ └── winpmem │ │ │ ├── VS14 │ │ │ └── ReadMe.txt │ │ │ ├── executable │ │ │ └── winpmem.rc │ │ │ └── pte_mmap_windows.h │ ├── pmem │ │ ├── bootstrap │ │ └── resources │ │ │ ├── pmem.aff4 │ │ │ ├── winpmem │ │ │ ├── winpmem_x64.sys │ │ │ └── winpmem_x86.sys │ │ │ └── MacPmem.kext │ │ │ └── Contents │ │ │ └── MacOS │ │ │ └── MacPmem │ └── devel │ │ └── autopep8.sh ├── rekall-agent │ ├── __init__.py │ ├── .gitignore │ ├── rekall_agent │ │ ├── client_actions │ │ │ └── darwin.py │ │ ├── config │ │ │ └── __init__.py │ │ ├── servers │ │ │ └── __init__.py │ │ ├── locations │ │ │ ├── gae.py │ │ │ └── __init__.py │ │ └── flows │ │ │ └── __init__.py │ ├── installers │ │ └── debian │ │ │ ├── source │ │ │ └── format │ │ │ ├── conffiles │ │ │ ├── preinst │ │ │ ├── .gitignore │ │ │ ├── install │ │ │ └── changelog │ ├── nose2.cfg │ ├── test_data │ │ ├── ntfs_img.dd │ │ └── winexec_img.dd │ └── MANIFEST.in ├── rekall-gui │ ├── __init__.py │ ├── debian │ │ ├── source │ │ │ └── format │ │ ├── .gitignore │ │ ├── rules │ │ └── changelog │ ├── manuskript │ │ ├── __init__.py │ │ ├── static │ │ │ ├── bower_components │ │ │ │ ├── jquery │ │ │ │ │ └── src │ │ │ │ │ │ ├── outro.js │ │ │ │ │ │ ├── selector.js │ │ │ │ │ │ ├── var │ │ │ │ │ │ ├── arr.js │ │ │ │ │ │ ├── rnotwhite.js │ │ │ │ │ │ ├── strundefined.js │ │ │ │ │ │ ├── push.js │ │ │ │ │ │ ├── slice.js │ │ │ │ │ │ ├── class2type.js │ │ │ │ │ │ ├── concat.js │ │ │ │ │ │ ├── indexOf.js │ │ │ │ │ │ ├── pnum.js │ │ │ │ │ │ ├── toString.js │ │ │ │ │ │ ├── hasOwn.js │ │ │ │ │ │ └── support.js │ │ │ │ │ │ ├── ajax │ │ │ │ │ │ └── var │ │ │ │ │ │ │ ├── rquery.js │ │ │ │ │ │ │ └── nonce.js │ │ │ │ │ │ ├── css │ │ │ │ │ │ └── var │ │ │ │ │ │ │ ├── rmargin.js │ │ │ │ │ │ │ ├── cssExpand.js │ │ │ │ │ │ │ ├── rnumnonpx.js │ │ │ │ │ │ │ └── getStyles.js │ │ │ │ │ │ ├── data │ │ │ │ │ │ └── var │ │ │ │ │ │ │ ├── data_priv.js │ │ │ │ │ │ │ └── data_user.js │ │ │ │ │ │ ├── manipulation │ │ │ │ │ │ └── var │ │ │ │ │ │ │ └── rcheckableType.js │ │ │ │ │ │ ├── core │ │ │ │ │ │ └── var │ │ │ │ │ │ │ └── rsingleTag.js │ │ │ │ │ │ ├── traversing │ │ │ │ │ │ └── var │ │ │ │ │ │ │ └── rneedsContext.js │ │ │ │ │ │ ├── event │ │ │ │ │ │ └── support.js │ │ │ │ │ │ └── attributes.js │ │ │ │ ├── markdown │ │ │ │ │ ├── test │ │ │ │ │ │ ├── features │ │ │ │ │ │ │ ├── meta │ │ │ │ │ │ │ │ ├── list.todo │ │ │ │ │ │ │ │ ├── id.text │ │ │ │ │ │ │ │ ├── class.text │ │ │ │ │ │ │ │ ├── code.text │ │ │ │ │ │ │ │ ├── attribute.text │ │ │ │ │ │ │ │ ├── quoted.text │ │ │ │ │ │ │ │ ├── document.text │ │ │ │ │ │ │ │ ├── inline.text │ │ │ │ │ │ │ │ ├── id.json │ │ │ │ │ │ │ │ ├── multiple_classes.text │ │ │ │ │ │ │ │ ├── class.json │ │ │ │ │ │ │ │ ├── list.text │ │ │ │ │ │ │ │ ├── attribute.json │ │ │ │ │ │ │ │ ├── quoted.json │ │ │ │ │ │ │ │ ├── code.json │ │ │ │ │ │ │ │ ├── inner_whitespace.text │ │ │ │ │ │ │ │ ├── document.json │ │ │ │ │ │ │ │ ├── leading_whitespace.text │ │ │ │ │ │ │ │ ├── list.json │ │ │ │ │ │ │ │ └── multiple_classes.json │ │ │ │ │ │ │ ├── images │ │ │ │ │ │ │ │ ├── empty.text │ │ │ │ │ │ │ │ ├── basic.text │ │ │ │ │ │ │ │ ├── crotcheted_url.text │ │ │ │ │ │ │ │ ├── spaces_in_href.text │ │ │ │ │ │ │ │ ├── inside_link.text │ │ │ │ │ │ │ │ ├── ref.text │ │ │ │ │ │ │ │ ├── title.text │ │ │ │ │ │ │ │ ├── crotcheted_url_with_title.text │ │ │ │ │ │ │ │ ├── spaces_round_title.text │ │ │ │ │ │ │ │ ├── empty.json │ │ │ │ │ │ │ │ ├── basic.json │ │ │ │ │ │ │ │ ├── crotcheted_url.json │ │ │ │ │ │ │ │ ├── ref.json │ │ │ │ │ │ │ │ ├── spaces_in_href.json │ │ │ │ │ │ │ │ ├── title.json │ │ │ │ │ │ │ │ ├── crotcheted_url_with_title.json │ │ │ │ │ │ │ │ ├── spaces_round_title.json │ │ │ │ │ │ │ │ └── inside_link.json │ │ │ │ │ │ │ ├── horizontal_rules │ │ │ │ │ │ │ │ ├── dashes.text │ │ │ │ │ │ │ │ ├── stars.text │ │ │ │ │ │ │ │ ├── underscores.text │ │ │ │ │ │ │ │ ├── loose_dashes.text │ │ │ │ │ │ │ │ ├── loose_stars.text │ │ │ │ │ │ │ │ ├── leading_spaces.text │ │ │ │ │ │ │ │ ├── long.text │ │ │ │ │ │ │ │ ├── loose_underscores.text │ │ │ │ │ │ │ │ ├── dashes.json │ │ │ │ │ │ │ │ ├── long.json │ │ │ │ │ │ │ │ ├── long_loose.text │ │ │ │ │ │ │ │ ├── stars.json │ │ │ │ │ │ │ │ ├── long_loose.json │ │ │ │ │ │ │ │ ├── loose_dashes.json │ │ │ │ │ │ │ │ ├── loose_stars.json │ │ │ │ │ │ │ │ ├── underscores.json │ │ │ │ │ │ │ │ ├── leading_spaces.json │ │ │ │ │ │ │ │ ├── loose_underscores.json │ │ │ │ │ │ │ │ ├── abutting_blocks.text │ │ │ │ │ │ │ │ └── abutting_blocks.json │ │ │ │ │ │ │ ├── blockquotes │ │ │ │ │ │ │ │ ├── simple.text │ │ │ │ │ │ │ │ ├── spaceless.text │ │ │ │ │ │ │ │ ├── nested.text │ │ │ │ │ │ │ │ ├── threequotes.text │ │ │ │ │ │ │ │ ├── leading_paras.text │ │ │ │ │ │ │ │ ├── lazy_wrapping.text │ │ │ │ │ │ │ │ ├── simple.json │ │ │ │ │ │ │ │ ├── spaceless.json │ │ │ │ │ │ │ │ ├── contains_code.text │ │ │ │ │ │ │ │ ├── threequotes.json │ │ │ │ │ │ │ │ ├── lazy_wrapping.json │ │ │ │ │ │ │ │ └── nested.json │ │ │ │ │ │ │ ├── code │ │ │ │ │ │ │ │ ├── inline.text │ │ │ │ │ │ │ │ ├── inline_multiline.text │ │ │ │ │ │ │ │ ├── embedded_backtick.text │ │ │ │ │ │ │ │ ├── trailing_para.text │ │ │ │ │ │ │ │ ├── in_lists.text │ │ │ │ │ │ │ │ ├── inline.json │ │ │ │ │ │ │ │ ├── block.text │ │ │ │ │ │ │ │ ├── inline_multiline.json │ │ │ │ │ │ │ │ ├── embedded_backtick.json │ │ │ │ │ │ │ │ ├── horizontal_rules.text │ │ │ │ │ │ │ │ ├── horizontal_rules.json │ │ │ │ │ │ │ │ ├── trailing_para.json │ │ │ │ │ │ │ │ ├── block.json │ │ │ │ │ │ │ │ ├── in_lists.json │ │ │ │ │ │ │ │ └── blank_lines.text │ │ │ │ │ │ │ ├── lists │ │ │ │ │ │ │ │ ├── tight.text │ │ │ │ │ │ │ │ ├── leading_whitespace.text │ │ │ │ │ │ │ │ ├── numeric.text │ │ │ │ │ │ │ │ ├── hr_abutting.text │ │ │ │ │ │ │ │ ├── hr_inside.text │ │ │ │ │ │ │ │ ├── lazy_wrapping.text │ │ │ │ │ │ │ │ ├── multiline_inline.text │ │ │ │ │ │ │ │ ├── bullet_types.text │ │ │ │ │ │ │ │ ├── hr_abutting.json │ │ │ │ │ │ │ │ ├── leading_whitespace.json │ │ │ │ │ │ │ │ ├── hr_inside.json │ │ │ │ │ │ │ │ ├── nested.text │ │ │ │ │ │ │ │ ├── loose_with_inline.text │ │ │ │ │ │ │ │ ├── numeric.json │ │ │ │ │ │ │ │ ├── tight.json │ │ │ │ │ │ │ │ ├── lazy_wrapping.json │ │ │ │ │ │ │ │ ├── multiline_inline.json │ │ │ │ │ │ │ │ └── loose.text │ │ │ │ │ │ │ ├── headers │ │ │ │ │ │ │ │ ├── setext.text │ │ │ │ │ │ │ │ ├── atx_closing_hashes.text │ │ │ │ │ │ │ │ ├── setext.json │ │ │ │ │ │ │ │ ├── atx.text │ │ │ │ │ │ │ │ ├── trailing_paras.text │ │ │ │ │ │ │ │ ├── atx_closing_hashes.json │ │ │ │ │ │ │ │ └── atx.json │ │ │ │ │ │ │ ├── links │ │ │ │ │ │ │ │ ├── inline.text │ │ │ │ │ │ │ │ ├── autolink_url.text │ │ │ │ │ │ │ │ ├── spaces_in_url.text │ │ │ │ │ │ │ │ ├── parens_inline.text │ │ │ │ │ │ │ │ ├── autolink_in_code.text │ │ │ │ │ │ │ │ ├── inline_with_newline.text │ │ │ │ │ │ │ │ ├── ref_reuse.text │ │ │ │ │ │ │ │ ├── reference.text │ │ │ │ │ │ │ │ ├── inline_with_title.text │ │ │ │ │ │ │ │ ├── parens_escaped_inline.text │ │ │ │ │ │ │ │ ├── autolink_email.text │ │ │ │ │ │ │ │ ├── parens_reference.text │ │ │ │ │ │ │ │ ├── ref_with_image_ref.text │ │ │ │ │ │ │ │ ├── reference_with_space.text │ │ │ │ │ │ │ │ ├── case_insensitive.text │ │ │ │ │ │ │ │ ├── implicit.text │ │ │ │ │ │ │ │ ├── in_brackets.text │ │ │ │ │ │ │ │ ├── in_blockquotes.text │ │ │ │ │ │ │ │ ├── missing_references.text │ │ │ │ │ │ │ │ ├── autolink_in_code.json │ │ │ │ │ │ │ │ ├── spaces_in_url.json │ │ │ │ │ │ │ │ ├── inline.json │ │ │ │ │ │ │ │ ├── in_blockquotes.json │ │ │ │ │ │ │ │ ├── reference.json │ │ │ │ │ │ │ │ ├── inline_with_newline.json │ │ │ │ │ │ │ │ ├── ref_with_image_ref.json │ │ │ │ │ │ │ │ ├── autolink_url.json │ │ │ │ │ │ │ │ ├── parens_inline.json │ │ │ │ │ │ │ │ ├── parens_escaped_inline.json │ │ │ │ │ │ │ │ ├── parens_reference.json │ │ │ │ │ │ │ │ ├── reference_with_space.json │ │ │ │ │ │ │ │ ├── inline_with_title.json │ │ │ │ │ │ │ │ ├── missing_references.json │ │ │ │ │ │ │ │ ├── autolink_email.json │ │ │ │ │ │ │ │ └── ref_reuse.json │ │ │ │ │ │ │ ├── linebreaks │ │ │ │ │ │ │ │ ├── simple.text │ │ │ │ │ │ │ │ └── simple.json │ │ │ │ │ │ │ ├── definition_lists │ │ │ │ │ │ │ │ ├── tight.text │ │ │ │ │ │ │ │ ├── multiple_terms.text │ │ │ │ │ │ │ │ ├── inline.text │ │ │ │ │ │ │ │ ├── multiple_definitions.text │ │ │ │ │ │ │ │ └── long.text │ │ │ │ │ │ │ ├── emphasis │ │ │ │ │ │ │ │ ├── multiple_lines.text │ │ │ │ │ │ │ │ ├── nested.text │ │ │ │ │ │ │ │ ├── simple.text │ │ │ │ │ │ │ │ └── multiple_lines.json │ │ │ │ │ │ │ └── tables │ │ │ │ │ │ │ │ ├── compact.text │ │ │ │ │ │ │ │ ├── pipe_escape.text │ │ │ │ │ │ │ │ ├── simple_no_leading.text │ │ │ │ │ │ │ │ ├── align.text │ │ │ │ │ │ │ │ ├── simple_leading.text │ │ │ │ │ │ │ │ ├── spaces_tolerance.text │ │ │ │ │ │ │ │ └── inline_formatting.text │ │ │ │ │ │ └── fixtures │ │ │ │ │ │ │ ├── docs-maruku-unittest │ │ │ │ │ │ │ ├── lists6.html │ │ │ │ │ │ │ ├── lists6.text │ │ │ │ │ │ │ ├── loss.html │ │ │ │ │ │ │ ├── one.text │ │ │ │ │ │ │ ├── hrule.text │ │ │ │ │ │ │ ├── lists6.json │ │ │ │ │ │ │ ├── bug_def.text │ │ │ │ │ │ │ ├── lists11.html │ │ │ │ │ │ │ ├── lists11.text │ │ │ │ │ │ │ ├── loss.text │ │ │ │ │ │ │ ├── one.html │ │ │ │ │ │ │ ├── paragraph.html │ │ │ │ │ │ │ ├── paragraph.text │ │ │ │ │ │ │ ├── xml2.html │ │ │ │ │ │ │ ├── xml2.json │ │ │ │ │ │ │ ├── xml2.text │ │ │ │ │ │ │ ├── alt.text │ │ │ │ │ │ │ ├── easy.text │ │ │ │ │ │ │ ├── lists11.json │ │ │ │ │ │ │ ├── loss.json │ │ │ │ │ │ │ ├── one.json │ │ │ │ │ │ │ ├── blank.text │ │ │ │ │ │ │ ├── bug_def.html │ │ │ │ │ │ │ ├── code2.text │ │ │ │ │ │ │ ├── hrule.html │ │ │ │ │ │ │ ├── data_loss.text │ │ │ │ │ │ │ ├── html2.html │ │ │ │ │ │ │ ├── paragraph.json │ │ │ │ │ │ │ ├── alt.html │ │ │ │ │ │ │ ├── blank.html │ │ │ │ │ │ │ ├── bug_def.json │ │ │ │ │ │ │ ├── data_loss.html │ │ │ │ │ │ │ ├── data_loss.json │ │ │ │ │ │ │ ├── html2.text │ │ │ │ │ │ │ ├── lists7b.text │ │ │ │ │ │ │ ├── test.html │ │ │ │ │ │ │ ├── test.text │ │ │ │ │ │ │ ├── easy.html │ │ │ │ │ │ │ ├── lists7.text │ │ │ │ │ │ │ ├── blank.json │ │ │ │ │ │ │ ├── lists9.text │ │ │ │ │ │ │ ├── olist.text │ │ │ │ │ │ │ ├── test.json │ │ │ │ │ │ │ ├── email.text │ │ │ │ │ │ │ ├── easy.json │ │ │ │ │ │ │ ├── html2.json │ │ │ │ │ │ │ ├── xml3.html │ │ │ │ │ │ │ ├── xml3.json │ │ │ │ │ │ │ ├── code2.json │ │ │ │ │ │ │ ├── alt.json │ │ │ │ │ │ │ ├── code2.html │ │ │ │ │ │ │ ├── inline_html2.text │ │ │ │ │ │ │ ├── lists8.text │ │ │ │ │ │ │ ├── hrule.json │ │ │ │ │ │ │ ├── images2.text │ │ │ │ │ │ │ ├── inline_html2.html │ │ │ │ │ │ │ ├── xml3.text │ │ │ │ │ │ │ ├── xml_instruction.json │ │ │ │ │ │ │ ├── inline_html2.json │ │ │ │ │ │ │ ├── list1.text │ │ │ │ │ │ │ ├── code.text │ │ │ │ │ │ │ ├── images2.html │ │ │ │ │ │ │ ├── olist.html │ │ │ │ │ │ │ ├── olist.json │ │ │ │ │ │ │ ├── paragraphs.html │ │ │ │ │ │ │ ├── email.json │ │ │ │ │ │ │ ├── lists7.json │ │ │ │ │ │ │ ├── code.html │ │ │ │ │ │ │ ├── list1.json │ │ │ │ │ │ │ ├── paragraphs.text │ │ │ │ │ │ │ ├── lists7.html │ │ │ │ │ │ │ ├── paragraphs.json │ │ │ │ │ │ │ ├── code.json │ │ │ │ │ │ │ ├── lists9.json │ │ │ │ │ │ │ ├── extra_table1.text │ │ │ │ │ │ │ ├── xml_instruction.html │ │ │ │ │ │ │ ├── email.html │ │ │ │ │ │ │ ├── list1.html │ │ │ │ │ │ │ ├── list3.text │ │ │ │ │ │ │ ├── headers.text │ │ │ │ │ │ │ ├── hex_entities.json │ │ │ │ │ │ │ ├── lists9.html │ │ │ │ │ │ │ ├── code3.text │ │ │ │ │ │ │ ├── html4.html │ │ │ │ │ │ │ ├── list4.text │ │ │ │ │ │ │ ├── xml_instruction.text │ │ │ │ │ │ │ ├── hex_entities.html │ │ │ │ │ │ │ ├── extra_dl.text │ │ │ │ │ │ │ ├── hex_entities.text │ │ │ │ │ │ │ ├── headers.html │ │ │ │ │ │ │ ├── abbreviations.html │ │ │ │ │ │ │ ├── images2.json │ │ │ │ │ │ │ ├── table_attributes.text │ │ │ │ │ │ │ ├── extra_dl.html │ │ │ │ │ │ │ ├── extra_dl.json │ │ │ │ │ │ │ ├── html4.text │ │ │ │ │ │ │ ├── html5.html │ │ │ │ │ │ │ ├── list2.text │ │ │ │ │ │ │ ├── lists8.html │ │ │ │ │ │ │ ├── syntax_hl.text │ │ │ │ │ │ │ ├── abbreviations.text │ │ │ │ │ │ │ └── bug_table.text │ │ │ │ │ │ │ ├── Text-Markdown.mdtest │ │ │ │ │ │ │ ├── Unicode.text │ │ │ │ │ │ │ ├── CoreDumps5.8.text │ │ │ │ │ │ │ ├── Unicode.json │ │ │ │ │ │ │ ├── Links_multiline_bugs_1.text │ │ │ │ │ │ │ ├── Links_brackets.text │ │ │ │ │ │ │ ├── Unicode.xhtml │ │ │ │ │ │ │ ├── Links_brackets.xhtml │ │ │ │ │ │ │ ├── Links_multiline_bugs_1.html │ │ │ │ │ │ │ ├── HTML5-attributes.text │ │ │ │ │ │ │ ├── CoreDumps5.8.json │ │ │ │ │ │ │ ├── HTML5-attributes.html │ │ │ │ │ │ │ ├── Links_multiline_bugs_2.text │ │ │ │ │ │ │ ├── Emphasis.text │ │ │ │ │ │ │ ├── Links_brackets.json │ │ │ │ │ │ │ ├── CoreDumps5.8.xhtml │ │ │ │ │ │ │ ├── Emphasis.xhtml │ │ │ │ │ │ │ ├── Emphasis.json │ │ │ │ │ │ │ ├── Links_multiline_bugs_1.json │ │ │ │ │ │ │ ├── Links_multiline_bugs_2.html │ │ │ │ │ │ │ └── PHP-ASP_tags.text │ │ │ │ │ │ │ ├── docs-pythonmarkdown2-tm-cases-pass │ │ │ │ │ │ │ ├── footnotes.opts │ │ │ │ │ │ │ ├── auto_link_safe_mode.opts │ │ │ │ │ │ │ ├── codespans_safe_mode.opts │ │ │ │ │ │ │ ├── footnotes_letters.opts │ │ │ │ │ │ │ ├── footnotes_markup.opts │ │ │ │ │ │ │ ├── nested_list_safe_mode.opts │ │ │ │ │ │ │ ├── syntax_color.opts │ │ │ │ │ │ │ ├── basic_safe_mode_escape.opts │ │ │ │ │ │ │ ├── code_safe_emphasis.opts │ │ │ │ │ │ │ ├── mismatched_footnotes.opts │ │ │ │ │ │ │ ├── escapes.text │ │ │ │ │ │ │ ├── issue2_safe_mode_borks_markup.opts │ │ │ │ │ │ │ ├── link_patterns.text │ │ │ │ │ │ │ ├── escapes.html │ │ │ │ │ │ │ ├── blockquote.text │ │ │ │ │ │ │ ├── link_patterns_edge_cases.text │ │ │ │ │ │ │ ├── escapes.json │ │ │ │ │ │ │ ├── footnotes_safe_mode_escape.opts │ │ │ │ │ │ │ ├── parens_in_url_4.text │ │ │ │ │ │ │ ├── link_patterns_double_hit.text │ │ │ │ │ │ │ ├── codespans.text │ │ │ │ │ │ │ ├── basic_safe_mode.text │ │ │ │ │ │ │ ├── basic_safe_mode_escape.text │ │ │ │ │ │ │ ├── codeblock.text │ │ │ │ │ │ │ ├── codespans_safe_mode.text │ │ │ │ │ │ │ ├── emphasis.text │ │ │ │ │ │ │ ├── code_block_with_tabs.text │ │ │ │ │ │ │ ├── header.html │ │ │ │ │ │ │ ├── hr.text │ │ │ │ │ │ │ ├── parens_in_url_4.html │ │ │ │ │ │ │ ├── auto_link.text │ │ │ │ │ │ │ ├── missing_link_defn.html │ │ │ │ │ │ │ ├── ref_links.html │ │ │ │ │ │ │ ├── basic_safe_mode.opts │ │ │ │ │ │ │ ├── codespans.html │ │ │ │ │ │ │ ├── header.text │ │ │ │ │ │ │ ├── auto_link_safe_mode.text │ │ │ │ │ │ │ ├── raw_html.text │ │ │ │ │ │ │ ├── ref_links.text │ │ │ │ │ │ │ ├── basic_safe_mode.html │ │ │ │ │ │ │ ├── codespans_safe_mode.html │ │ │ │ │ │ │ ├── raw_html.html │ │ │ │ │ │ │ ├── link_patterns_edge_cases.html │ │ │ │ │ │ │ ├── lists.text │ │ │ │ │ │ │ ├── codespans.json │ │ │ │ │ │ │ ├── basic_safe_mode.json │ │ │ │ │ │ │ ├── basic_safe_mode_escape.html │ │ │ │ │ │ │ ├── basic_safe_mode_escape.json │ │ │ │ │ │ │ ├── code_safe_emphasis.text │ │ │ │ │ │ │ ├── hr.html │ │ │ │ │ │ │ ├── codespans_safe_mode.json │ │ │ │ │ │ │ ├── emphasis.html │ │ │ │ │ │ │ ├── codeblock.html │ │ │ │ │ │ │ ├── missing_link_defn.json │ │ │ │ │ │ │ ├── blockquote.json │ │ │ │ │ │ │ ├── codeblock.json │ │ │ │ │ │ │ ├── header.json │ │ │ │ │ │ │ ├── missing_link_defn.text │ │ │ │ │ │ │ ├── parens_in_url_4.json │ │ │ │ │ │ │ ├── code_block_with_tabs.html │ │ │ │ │ │ │ ├── nested_list.text │ │ │ │ │ │ │ ├── code_safe_emphasis.html │ │ │ │ │ │ │ ├── emacs_head_vars.json │ │ │ │ │ │ │ ├── link_patterns_edge_cases.json │ │ │ │ │ │ │ ├── hr.json │ │ │ │ │ │ │ ├── inline_links.text │ │ │ │ │ │ │ ├── issue2_safe_mode_borks_markup.text │ │ │ │ │ │ │ ├── nested_list_safe_mode.text │ │ │ │ │ │ │ ├── raw_html.json │ │ │ │ │ │ │ ├── underline_in_autolink.text │ │ │ │ │ │ │ ├── code_block_with_tabs.json │ │ │ │ │ │ │ ├── emacs_tail_vars.json │ │ │ │ │ │ │ ├── emphasis.json │ │ │ │ │ │ │ ├── link_patterns_edge_cases.opts │ │ │ │ │ │ │ ├── link_patterns.html │ │ │ │ │ │ │ ├── code_safe_emphasis.json │ │ │ │ │ │ │ ├── emacs_head_vars.text │ │ │ │ │ │ │ ├── ref_links.json │ │ │ │ │ │ │ ├── blockquote.html │ │ │ │ │ │ │ ├── blockquote_with_pre.text │ │ │ │ │ │ │ ├── emacs_head_vars.html │ │ │ │ │ │ │ ├── link_patterns_double_hit.html │ │ │ │ │ │ │ ├── issue2_safe_mode_borks_markup.html │ │ │ │ │ │ │ ├── lists.html │ │ │ │ │ │ │ ├── emacs_tail_vars.text │ │ │ │ │ │ │ ├── emacs_tail_vars.html │ │ │ │ │ │ │ └── footnotes_safe_mode_escape.text │ │ │ │ │ │ │ ├── docs-php-markdown-todo │ │ │ │ │ │ │ ├── Links_inline_style.text │ │ │ │ │ │ │ ├── Links_inline_style.html │ │ │ │ │ │ │ ├── Email_auto_links.text │ │ │ │ │ │ │ ├── Links_inline_style.json │ │ │ │ │ │ │ ├── Nesting.text │ │ │ │ │ │ │ ├── Inline_HTML_(Span).text │ │ │ │ │ │ │ └── Inline_HTML_(Span).html │ │ │ │ │ │ │ ├── Markdown-from-MDTest1.1.mdtest │ │ │ │ │ │ │ ├── Nested_blockquotes.text │ │ │ │ │ │ │ ├── Tidyness.text │ │ │ │ │ │ │ ├── Nested_blockquotes.json │ │ │ │ │ │ │ ├── Literal_quotes_in_titles.text │ │ │ │ │ │ │ ├── Strong_and_em_together.text │ │ │ │ │ │ │ ├── Nested_blockquotes.xhtml │ │ │ │ │ │ │ ├── Tidyness.xhtml │ │ │ │ │ │ │ ├── Tidyness.json │ │ │ │ │ │ │ ├── Inline_HTML_comments.json │ │ │ │ │ │ │ ├── Code_Spans.text │ │ │ │ │ │ │ ├── Literal_quotes_in_titles.xhtml │ │ │ │ │ │ │ ├── Blockquotes_with_code_blocks.text │ │ │ │ │ │ │ └── Inline_HTML_comments.text │ │ │ │ │ │ │ ├── PHP_Markdown-from-MDTest1.1.mdtest │ │ │ │ │ │ │ ├── Links_inline_style.text │ │ │ │ │ │ │ ├── Links_inline_style.xhtml │ │ │ │ │ │ │ ├── Email_auto_links.text │ │ │ │ │ │ │ ├── Code_Spans.text │ │ │ │ │ │ │ ├── Links_inline_style.json │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.text │ │ │ │ │ │ │ ├── Backslash_escapes.text │ │ │ │ │ │ │ ├── Inline_HTML_comments.json │ │ │ │ │ │ │ ├── Nesting.text │ │ │ │ │ │ │ ├── Backslash_escapes.xhtml │ │ │ │ │ │ │ ├── Code_Spans.xhtml │ │ │ │ │ │ │ ├── Inline_HTML_comments.text │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.json │ │ │ │ │ │ │ ├── Inline_HTML_(Span).text │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.xhtml │ │ │ │ │ │ │ ├── Code_Spans.json │ │ │ │ │ │ │ ├── Inline_HTML_(Span).xhtml │ │ │ │ │ │ │ ├── Inline_HTML_comments.html │ │ │ │ │ │ │ ├── Tight_blocks.text │ │ │ │ │ │ │ ├── Backslash_escapes.json │ │ │ │ │ │ │ ├── Inline_HTML_(Simple).text │ │ │ │ │ │ │ ├── MD5_Hashes.text │ │ │ │ │ │ │ └── Inline_HTML_(Simple).html │ │ │ │ │ │ │ └── docs-php-markdown │ │ │ │ │ │ │ ├── Code_Spans.text │ │ │ │ │ │ │ ├── Images_(Untitled).text │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.text │ │ │ │ │ │ │ ├── Backslash_escapes.text │ │ │ │ │ │ │ ├── Images_(Untitled).html │ │ │ │ │ │ │ ├── Inline_HTML_comments.json │ │ │ │ │ │ │ ├── Code_Spans.html │ │ │ │ │ │ │ ├── Inline_HTML_comments.text │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.html │ │ │ │ │ │ │ ├── Code_block_in_a_list_item.json │ │ │ │ │ │ │ ├── Code_Spans.json │ │ │ │ │ │ │ ├── Inline_HTML_comments.html │ │ │ │ │ │ │ ├── Backslash_escapes.html │ │ │ │ │ │ │ ├── Tight_blocks.text │ │ │ │ │ │ │ ├── Backslash_escapes.json │ │ │ │ │ │ │ ├── Inline_HTML_(Simple).text │ │ │ │ │ │ │ └── Inline_HTML_(Simple).html │ │ │ │ │ ├── .npmignore │ │ │ │ │ ├── .gitignore │ │ │ │ │ ├── .travis.yml │ │ │ │ │ ├── seed.yml │ │ │ │ │ └── lib │ │ │ │ │ │ └── index.js │ │ │ │ ├── bootstrap │ │ │ │ │ ├── test-infra │ │ │ │ │ │ ├── requirements.txt │ │ │ │ │ │ └── uncached-npm-install.sh │ │ │ │ │ ├── fonts │ │ │ │ │ │ ├── glyphicons-halflings-regular.eot │ │ │ │ │ │ ├── glyphicons-halflings-regular.ttf │ │ │ │ │ │ └── glyphicons-halflings-regular.woff │ │ │ │ │ └── dist │ │ │ │ │ │ └── fonts │ │ │ │ │ │ ├── glyphicons-halflings-regular.eot │ │ │ │ │ │ ├── glyphicons-halflings-regular.ttf │ │ │ │ │ │ └── glyphicons-halflings-regular.woff │ │ │ │ ├── angular │ │ │ │ │ ├── bower.json │ │ │ │ │ └── angular.min.js.gzip │ │ │ │ ├── codemirror │ │ │ │ │ ├── theme │ │ │ │ │ │ └── ambiance-mobile.css │ │ │ │ │ └── addon │ │ │ │ │ │ └── display │ │ │ │ │ │ └── fullscreen.css │ │ │ │ ├── angular-mocks │ │ │ │ │ └── bower.json │ │ │ │ ├── angular-animate │ │ │ │ │ └── bower.json │ │ │ │ ├── angular-resource │ │ │ │ │ └── bower.json │ │ │ │ ├── ng-file-upload │ │ │ │ │ └── FileAPI.flash.swf │ │ │ │ └── ng-file-upload-shim │ │ │ │ │ └── FileAPI.flash.swf │ │ │ ├── app.js │ │ │ ├── load-controller.js │ │ │ ├── package.json │ │ │ └── components │ │ │ │ └── plaintext │ │ │ │ └── plaintext.css │ │ └── plugins │ │ │ └── markdown.py │ ├── rekall_gui │ │ ├── __init__.py │ │ └── plugins │ │ │ ├── __init__.py │ │ │ └── webconsole │ │ │ └── static │ │ │ ├── components │ │ │ ├── runplugin │ │ │ │ └── file-selector.html │ │ │ └── sessions │ │ │ │ └── manage-sessions.css │ │ │ ├── tests │ │ │ └── data │ │ │ │ ├── Nothing.json │ │ │ │ ├── UnnamedSection.json │ │ │ │ ├── NamedSection.json │ │ │ │ └── Format.json │ │ │ └── images │ │ │ ├── Rekall.png │ │ │ └── Rekall-32.png │ ├── .gitattributes │ ├── README.md │ └── MANIFEST.in ├── src │ └── profiles │ │ ├── .gitignore │ │ ├── mspdb │ │ └── Makefile │ │ └── macho │ │ └── macho.xcodeproj │ │ └── project.xcworkspace │ │ └── contents.xcworkspacedata ├── rekall-core │ ├── resources │ │ ├── .gitignore │ │ ├── nssm.exe │ │ ├── MacPmem.kext.tgz │ │ └── WinPmem │ │ │ ├── winpmem_x64.sys │ │ │ └── winpmem_x86.sys │ ├── rekall │ │ ├── plugins │ │ │ ├── windows │ │ │ │ ├── gui │ │ │ │ │ ├── tests.py │ │ │ │ │ └── vtypes │ │ │ │ │ │ └── __init__.py │ │ │ │ ├── registry │ │ │ │ │ └── tests.py │ │ │ │ └── interactive │ │ │ │ │ └── __init__.py │ │ │ ├── common │ │ │ │ └── tests.py │ │ │ ├── contrib │ │ │ │ └── __init__.py │ │ │ ├── renderers │ │ │ │ └── tests.py │ │ │ ├── filesystems │ │ │ │ └── __init__.py │ │ │ └── overlays │ │ │ │ ├── linux │ │ │ │ └── __init__.py │ │ │ │ └── darwin │ │ │ │ └── __init__.py │ │ ├── __init__.py │ │ └── tests.py │ └── .gitattributes ├── rekall-lib │ └── rekall_lib │ │ ├── rekall_types │ │ └── __init__.py │ │ └── __init__.py ├── requirements.txt ├── osx │ └── Rekall │ │ ├── Rekall │ │ ├── en.lproj │ │ │ └── InfoPlist.strings │ │ ├── error.js │ │ ├── Images.xcassets │ │ │ └── AppIcon.appiconset │ │ │ │ ├── Rekall-128.png │ │ │ │ ├── Rekall-32.png │ │ │ │ └── Rekall-64.png │ │ ├── Rekall-Prefix.pch │ │ └── main.m │ │ ├── RekallTests │ │ └── en.lproj │ │ │ └── InfoPlist.strings │ │ └── Rekall.xcodeproj │ │ └── project.xcworkspace │ │ └── contents.xcworkspacedata └── resources │ ├── Rekall.png │ ├── rekall.ico │ ├── Rekall.icns │ ├── Rekall-128.png │ ├── Rekall-32.png │ ├── Rekall-512.ico │ └── Rekall-64.png └── subversion_techniques ├── mas_remapping_and_pte_subversions ├── linux │ ├── user_space_tool │ │ ├── benign-proc.c │ │ ├── start_pythonserver.sh │ │ ├── norm-proc.h │ │ └── mal-proc.c │ └── kernel_module │ │ └── install.sh └── windows │ ├── kernel_module │ └── x64 │ │ └── Release │ │ ├── DriverKit.cer │ │ ├── DriverKit.pdb │ │ └── DriverKit.sys │ └── user_space_tool │ └── x64 │ └── Release │ ├── user_space_tool.exe │ └── user_space_tool.pdb ├── shared_memory ├── windows │ ├── Release │ │ ├── shared_memory_subversion.exe │ │ └── shared_memory_subversion.pdb │ └── x64 │ │ └── Release │ │ ├── shared_memory_subversion.exe │ │ └── shared_memory_subversion.pdb └── linux │ └── Makefile └── verification.yar /rekall_framework/config/dpkg/compat: -------------------------------------------------------------------------------- 1 | 7 2 | -------------------------------------------------------------------------------- /rekall_framework/debian/source/format: -------------------------------------------------------------------------------- 1 | 1.0 -------------------------------------------------------------------------------- /rekall_framework/tools/osx/MacPmem/STYLE.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/__init__.py: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/__init__.py: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/debian/source/format: -------------------------------------------------------------------------------- 1 | 1.0 -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/src/profiles/.gitignore: -------------------------------------------------------------------------------- 1 | /osx 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/resources/.gitignore: -------------------------------------------------------------------------------- 1 | osqueryi -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/__init__.py: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/.gitignore: -------------------------------------------------------------------------------- 1 | rekall-agent-debian* -------------------------------------------------------------------------------- /rekall_framework/rekall-lib/rekall_lib/rekall_types/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/tools/testing/.gitignore: -------------------------------------------------------------------------------- 1 | swapper* 2 | *.dSYM -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/client_actions/darwin.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/lib/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/source/format: -------------------------------------------------------------------------------- 1 | 1.0 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/windows/gui/tests.py: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/.gitattributes: -------------------------------------------------------------------------------- 1 | _version.py export-subst 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/MANIFEST.in: -------------------------------------------------------------------------------- 1 | include README.md 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/parsers/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/.gitignore: -------------------------------------------------------------------------------- 1 | build 2 | release 3 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/windows/gui/vtypes/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/conffiles: -------------------------------------------------------------------------------- 1 | etc/rekall-agent.yaml 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/.gitattributes: -------------------------------------------------------------------------------- 1 | _version.py export-subst 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/preinst: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | exit 0 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/nose2.cfg: -------------------------------------------------------------------------------- 1 | [unittest] 2 | 3 | test-file-pattern = *test.py -------------------------------------------------------------------------------- /rekall_framework/rekall-lib/rekall_lib/__init__.py: -------------------------------------------------------------------------------- 1 | from rekall_lib import crypto 2 | -------------------------------------------------------------------------------- /rekall_framework/requirements.txt: -------------------------------------------------------------------------------- 1 | ./rekall-lib 2 | ./rekall-core 3 | ./rekall-agent 4 | -------------------------------------------------------------------------------- /rekall_framework/debian/.gitignore: -------------------------------------------------------------------------------- 1 | rekall-forensic* 2 | rekall-forensic 3 | files 4 | compat -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/outro.js: -------------------------------------------------------------------------------- 1 | })); 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/installers/.gitignore: -------------------------------------------------------------------------------- 1 | build 2 | dist 3 | Output 4 | rekal.spec 5 | *~ -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/linux/user_space_tool/benign-proc.c: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/common/tests.py: -------------------------------------------------------------------------------- 1 | # pylint: disable=unused-import 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/config/__init__.py: -------------------------------------------------------------------------------- 1 | from rekall_agent.config import agent 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/servers/__init__.py: -------------------------------------------------------------------------------- 1 | from rekall_agent.servers import gae 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/debian/.gitignore: -------------------------------------------------------------------------------- 1 | rekall-forensic* 2 | rekall-forensic 3 | files 4 | compat -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/list.todo: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /rekall_framework/config/dpkg/python-rekall.docs: -------------------------------------------------------------------------------- 1 | AUTHORS.txt 2 | CREDITS.txt 3 | LEGAL.txt 4 | README.txt 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/.gitattributes: -------------------------------------------------------------------------------- 1 | _version.py export-subst 2 | rekall/_version.py export-subst 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/debian/rules: -------------------------------------------------------------------------------- 1 | #!/usr/bin/make -f 2 | 3 | %: 4 | dh $@ --with python-virtualenv -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/.npmignore: -------------------------------------------------------------------------------- 1 | .seed.yml 2 | test 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/contrib/__init__.py: -------------------------------------------------------------------------------- 1 | from rekall.plugins.contrib import miranda 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/.gitignore: -------------------------------------------------------------------------------- 1 | .*.swp 2 | /node_modules/ 3 | -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/en.lproj/InfoPlist.strings: -------------------------------------------------------------------------------- 1 | /* Localized versions of Info.plist keys */ 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/.gitignore: -------------------------------------------------------------------------------- 1 | rekall-forensic* 2 | rekall-forensic 3 | files 4 | compat -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/test-infra/requirements.txt: -------------------------------------------------------------------------------- 1 | boto==2.20.0 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/empty.text: -------------------------------------------------------------------------------- 1 | ![Empty]() 2 | -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/RekallTests/en.lproj/InfoPlist.strings: -------------------------------------------------------------------------------- 1 | /* Localized versions of Info.plist keys */ 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/selector.js: -------------------------------------------------------------------------------- 1 | define([ "./selector-sizzle" ]); 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/dashes.text: -------------------------------------------------------------------------------- 1 | --- 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/stars.text: -------------------------------------------------------------------------------- 1 | *** 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists6.html: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists6.text: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/simple.text: -------------------------------------------------------------------------------- 1 | > Blockquote 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/underscores.text: -------------------------------------------------------------------------------- 1 | ___ 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/loss.html: -------------------------------------------------------------------------------- 1 |
2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/one.text: -------------------------------------------------------------------------------- 1 | One line 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/windows/registry/tests.py: -------------------------------------------------------------------------------- 1 | from rekall.plugins.windows.registry import printkey_test 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/README.md: -------------------------------------------------------------------------------- 1 | # Rekall Memory Forensic Framework 2 | 3 | This is the GUI component of the Rekall framework. -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/arr.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return []; 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/inline.text: -------------------------------------------------------------------------------- 1 | `This` is a code span. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_dashes.text: -------------------------------------------------------------------------------- 1 | - - - 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_stars.text: -------------------------------------------------------------------------------- 1 | * * * 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hrule.text: -------------------------------------------------------------------------------- 1 | * * * 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists6.json: -------------------------------------------------------------------------------- 1 | ["html"] 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/log/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | add_definitions(-std=c99 -Wall -Wextra -ggdb) 2 | add_library(log log.c) 3 | -------------------------------------------------------------------------------- /rekall_framework/tools/windows/winpmem/VS14/ReadMe.txt: -------------------------------------------------------------------------------- 1 | This directory contains the MSVC 14 project files for building the driver. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/leading_spaces.text: -------------------------------------------------------------------------------- 1 | * * * 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/long.text: -------------------------------------------------------------------------------- 1 | ********************* 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_underscores.text: -------------------------------------------------------------------------------- 1 | _ _ _ 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/basic.text: -------------------------------------------------------------------------------- 1 | ![Alt text](/path/to/img.jpg) 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/crotcheted_url.text: -------------------------------------------------------------------------------- 1 | ![alt text]() 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/tight.text: -------------------------------------------------------------------------------- 1 | * alpha 2 | * beta 3 | * gamma 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/bug_def.text: -------------------------------------------------------------------------------- 1 | [test][]: 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists11.html: -------------------------------------------------------------------------------- 1 |

- ένα

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists11.text: -------------------------------------------------------------------------------- 1 | - ένα 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/loss.text: -------------------------------------------------------------------------------- 1 |
123 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/one.html: -------------------------------------------------------------------------------- 1 |

One line

2 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/.gitignore: -------------------------------------------------------------------------------- 1 | *.cmd 2 | Module.symvers 3 | *.zip 4 | *.ko 5 | *.mod.* 6 | modules.order 7 | *.o 8 | .tmp_versions -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/inline_multiline.text: -------------------------------------------------------------------------------- 1 | foo `code 2 | code` bar 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/setext.text: -------------------------------------------------------------------------------- 1 | One 2 | === 3 | 4 | Two 5 | --- 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/leading_whitespace.text: -------------------------------------------------------------------------------- 1 | * white 2 | * space 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/numeric.text: -------------------------------------------------------------------------------- 1 | 1. one 2 | 2. two 3 | 3. three 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraph.html: -------------------------------------------------------------------------------- 1 |

Paragraph

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraph.text: -------------------------------------------------------------------------------- 1 | Paragraph 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml2.html: -------------------------------------------------------------------------------- 1 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml2.json: -------------------------------------------------------------------------------- 1 | ["html", "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml2.text: -------------------------------------------------------------------------------- 1 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/ajax/var/rquery.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return (/\?/); 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/rnotwhite.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return (/\S+/g); 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/spaceless.text: -------------------------------------------------------------------------------- 1 | >blockquote 2 | >without spaces 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/dashes.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/long.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/long_loose.text: -------------------------------------------------------------------------------- 1 | * * * * * * * * * * * 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/stars.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/spaces_in_href.text: -------------------------------------------------------------------------------- 1 | ![Alt text](path to img.jpg) 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline.text: -------------------------------------------------------------------------------- 1 | An [inline](http://inline.com) link. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/alt.text: -------------------------------------------------------------------------------- 1 | ![bar](/foo.jpg) 2 | 3 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/easy.text: -------------------------------------------------------------------------------- 1 | *Hello!* how are **you**? 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists11.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "- ένα"]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/loss.json: -------------------------------------------------------------------------------- 1 | ["html", ["br"], "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/one.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "One line"]] 2 | -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall.png -------------------------------------------------------------------------------- /rekall_framework/resources/rekall.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/rekall.ico -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/css/var/rmargin.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return (/^margin/); 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/long_loose.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_dashes.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_stars.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/underscores.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/id.text: -------------------------------------------------------------------------------- 1 | This is a paragraph 2 | with an ID. 3 | {: #para} 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/blank.text: -------------------------------------------------------------------------------- 1 | 2 | Linea 1 3 | 4 | Linea 2 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/bug_def.html: -------------------------------------------------------------------------------- 1 |

test:

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code2.text: -------------------------------------------------------------------------------- 1 | > Code 2 | > 3 | > Ciao 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hrule.html: -------------------------------------------------------------------------------- 1 |




2 | -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall.icns: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall.icns -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/renderers/tests.py: -------------------------------------------------------------------------------- 1 | # pylint: disable=unused-import 2 | from rekall.plugins.renderers import visual_aides_test 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/strundefined.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return typeof undefined; 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/nested.text: -------------------------------------------------------------------------------- 1 | > One 2 | > 3 | > > Two 4 | > 5 | > Three 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/leading_spaces.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/loose_underscores.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["hr"] 3 | ] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/inside_link.text: -------------------------------------------------------------------------------- 1 | [![alt](https://img-url)](https://link-url) 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/ref.text: -------------------------------------------------------------------------------- 1 | ![Alt text] [img] 2 | 3 | [img]: /path/to/img.jpg 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/title.text: -------------------------------------------------------------------------------- 1 | ![Alt text](/path/to/img.jpg "Optional title") 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/class.text: -------------------------------------------------------------------------------- 1 | This is a paragraph 2 | with an ID. 3 | {: .para} 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/data_loss.text: -------------------------------------------------------------------------------- 1 | 1. abcd 2 | efgh 3 | ijkl 4 | 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html2.html: -------------------------------------------------------------------------------- 1 |

One

123

2 |
3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraph.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Paragraph"]] 2 | -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall-128.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall-128.png -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall-32.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall-32.png -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall-512.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall-512.ico -------------------------------------------------------------------------------- /rekall_framework/resources/Rekall-64.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/resources/Rekall-64.png -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/c_ast/__init__.py: -------------------------------------------------------------------------------- 1 | from layout_expert.c_ast import c_ast 2 | from layout_expert.c_ast import pre_ast 3 | -------------------------------------------------------------------------------- /rekall_framework/tools/pmem/bootstrap: -------------------------------------------------------------------------------- 1 | #! /bin/sh 2 | 3 | # This file is run after checkout from source control. 4 | 5 | autoreconf --force --install 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/threequotes.text: -------------------------------------------------------------------------------- 1 | > this is 2 | 3 | > three 4 | 5 | > quotes 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/crotcheted_url_with_title.text: -------------------------------------------------------------------------------- 1 | ![alt text]( "with a title") 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/linebreaks/simple.text: -------------------------------------------------------------------------------- 1 | The quick brown fox 2 | jumps over the lazy dog. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_url.text: -------------------------------------------------------------------------------- 1 | URLs like get autolinkified. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/spaces_in_url.text: -------------------------------------------------------------------------------- 1 | [link text](Link to file/Lorem Ipsum.txt "Alt2") 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/hr_abutting.text: -------------------------------------------------------------------------------- 1 | * foo 2 | * bar 3 | 4 | * * * 5 | after 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/hr_inside.text: -------------------------------------------------------------------------------- 1 | * before 2 | 3 | - - - - 4 | after 5 | 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Unicode.text: -------------------------------------------------------------------------------- 1 | > Fo—o 2 | 3 | μορεοϋερ 4 | 5 | > ßåř 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/alt.html: -------------------------------------------------------------------------------- 1 |

bar

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/blank.html: -------------------------------------------------------------------------------- 1 |

Linea 1

2 | 3 |

Linea 2

4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/bug_def.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["span", "test"], ":"]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/resources/nssm.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-core/resources/nssm.exe -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/push.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./arr" 3 | ], function( arr ) { 4 | return arr.push; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/slice.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./arr" 3 | ], function( arr ) { 4 | return arr.slice; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/code.text: -------------------------------------------------------------------------------- 1 | A pre with an 2 | arbitrary attribute. 3 | {: foo=bar} 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/data_loss.html: -------------------------------------------------------------------------------- 1 |
    2 |
  1. abcd efgh ijkl
  2. 3 |
4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/data_loss.json: -------------------------------------------------------------------------------- 1 | ["html", ["ol", ["li", "abcd efgh ijkl"]]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html2.text: -------------------------------------------------------------------------------- 1 | One 2 |
123 3 | 4 |
123 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists7b.text: -------------------------------------------------------------------------------- 1 | * a 2 | * a1 3 | * a2 4 | * b 5 | 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/test.html: -------------------------------------------------------------------------------- 1 |
       $ python       
2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/test.text: -------------------------------------------------------------------------------- 1 | 2 | $ python 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/footnotes.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["footnotes"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/pmem/resources/pmem.aff4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/pmem/resources/pmem.aff4 -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/error.js: -------------------------------------------------------------------------------- 1 | function showError(title, description) { 2 | $('#title').html(title); 3 | $('#description').html(description); 4 | } 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/class2type.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | // [[Class]] -> type pairs 3 | return {}; 4 | }); 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/concat.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./arr" 3 | ], function( arr ) { 4 | return arr.concat; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/indexOf.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./arr" 3 | ], function( arr ) { 4 | return arr.indexOf; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/embedded_backtick.text: -------------------------------------------------------------------------------- 1 | This is a ``code span with an `embedded` backtick``. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/trailing_para.text: -------------------------------------------------------------------------------- 1 | Paragraph above 2 | 3 | Code block 4 | Paragraph below 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/atx_closing_hashes.text: -------------------------------------------------------------------------------- 1 | # One # 2 | 3 | ## Two ##### 4 | 5 | ### Three ## 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/spaces_round_title.text: -------------------------------------------------------------------------------- 1 | ![alt text](/url/ "title has spaces afterward" ) 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_inline.text: -------------------------------------------------------------------------------- 1 | [Inline link](/url(test) "title") with non-escaped parens. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/attribute.text: -------------------------------------------------------------------------------- 1 | A paragraph with an 2 | arbitrary attribute. 3 | {: foo=bar} 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/quoted.text: -------------------------------------------------------------------------------- 1 | A paragraph with a 2 | quoted attribute. 3 | {: foo="bar baz"} 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/easy.html: -------------------------------------------------------------------------------- 1 |

Hello! how are you?

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists7.text: -------------------------------------------------------------------------------- 1 | Ciao 2 | 3 | * Tab 4 | * Tab 5 | * Tab 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/auto_link_safe_mode.opts: -------------------------------------------------------------------------------- 1 | {'safe_mode': True} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans_safe_mode.opts: -------------------------------------------------------------------------------- 1 | {'safe_mode': True} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/footnotes_letters.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["footnotes"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/footnotes_markup.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["footnotes"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/nested_list_safe_mode.opts: -------------------------------------------------------------------------------- 1 | {'safe_mode': True} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/syntax_color.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["code-color"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/devel/autopep8.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Only run autopep8 on the current directory 4 | autopep8 --ignore E309,E711 -i -r --max-line-length 80 $@ 5 | -------------------------------------------------------------------------------- /rekall_framework/tools/testing/images/failed.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/testing/images/failed.png -------------------------------------------------------------------------------- /rekall_framework/tools/testing/images/success.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/testing/images/success.png -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/linux/user_space_tool/start_pythonserver.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | python3 -m http.server 4443 --bind 192.168.15.5 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/locations/gae.py: -------------------------------------------------------------------------------- 1 | """Location to interact with the Google App Engine server.""" 2 | 3 | from rekall_agent.locations import cloud 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/test_data/ntfs_img.dd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-agent/test_data/ntfs_img.dd -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/css/var/cssExpand.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return [ "Top", "Right", "Bottom", "Left" ]; 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/pnum.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return (/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/).source; 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/in_lists.text: -------------------------------------------------------------------------------- 1 | * Loose list 2 | 3 | some code 4 | 5 | more code 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_in_code.text: -------------------------------------------------------------------------------- 1 | Autolinks don't happen inside code: `` 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline_with_newline.text: -------------------------------------------------------------------------------- 1 | An [inline 2 | link](http://inline.com) with a newline. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/ref_reuse.text: -------------------------------------------------------------------------------- 1 | Two [links][id], one [ref][id] 2 | 3 | [id]: http://google.com 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/reference.text: -------------------------------------------------------------------------------- 1 | A [link using a reference][1]. 2 | 3 | [1]: http://reference.com 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/document.text: -------------------------------------------------------------------------------- 1 | Key: value 2 | AnotherKey: another value 3 | 4 | A regular paragraph 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/inline.text: -------------------------------------------------------------------------------- 1 | An *em*{: .foo} and **strong**{: .bar} 2 | with attached attributes. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/blank.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Linea 1"], 2 | ["p", "Linea 2"]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists9.text: -------------------------------------------------------------------------------- 1 | - Due 2 | 1. tre 3 | 1. tre 4 | 1. tre 5 | - Due 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/olist.text: -------------------------------------------------------------------------------- 1 | This is a list: 2 | 3 | 2. one 4 | 2. two 5 | 3. three 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/test.json: -------------------------------------------------------------------------------- 1 | ["html", ["pre", ["code", " $ python "]]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode_escape.opts: -------------------------------------------------------------------------------- 1 | {"safe_mode": "escape"} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_safe_emphasis.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["code-friendly"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/mismatched_footnotes.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["footnotes"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/components/runplugin/file-selector.html: -------------------------------------------------------------------------------- 1 | 2 | {{filename}} 3 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/tests/data/Nothing.json: -------------------------------------------------------------------------------- 1 | [["m",{"tool_name":"rekall","plugin_name":"render_sample","tool_version":"1.0.3"}],["x"]] -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/test_data/winexec_img.dd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-agent/test_data/winexec_img.dd -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/data/var/data_priv.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../Data" 3 | ], function( Data ) { 4 | return new Data(); 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/data/var/data_user.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../Data" 3 | ], function( Data ) { 4 | return new Data(); 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/manipulation/var/rcheckableType.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return (/^(?:checkbox|radio)$/i); 3 | }); 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/leading_paras.text: -------------------------------------------------------------------------------- 1 | Amy wrote: 2 | > No wai? 3 | 4 | Bob wrote: 5 | > Ya rly! 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/abutting_blocks.text: -------------------------------------------------------------------------------- 1 | para 2 | *** 3 | * list 4 | - - - 5 | > blockquote 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline_with_title.text: -------------------------------------------------------------------------------- 1 | An [inline link](http://inline.com "le title") with a title. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_escaped_inline.text: -------------------------------------------------------------------------------- 1 | [Inline link](/url\(test\) "title") with escaped parens. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/email.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | This is an email address: 4 | 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Links_inline_style.text: -------------------------------------------------------------------------------- 1 | [silly URL w/ angle brackets](). 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/test/test_data/host: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/linux/lmap/test/test_data/host -------------------------------------------------------------------------------- /rekall_framework/rekall-core/resources/MacPmem.kext.tgz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-core/resources/MacPmem.kext.tgz -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/app.js: -------------------------------------------------------------------------------- 1 | (function() { 2 | 3 | var module = angular.module('manuskript.app', [ 4 | 'manuskript.app.controller', 5 | ]); 6 | 7 | })(); -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/ajax/var/nonce.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../../core" 3 | ], function( jQuery ) { 4 | return jQuery.now(); 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/definition_lists/tight.text: -------------------------------------------------------------------------------- 1 | one 2 | : alpha 3 | 4 | two 5 | : beta 6 | 7 | three 8 | : gamma 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/emphasis/multiple_lines.text: -------------------------------------------------------------------------------- 1 | You can *start emphasis on one line, 2 | and finish it* on another. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_email.text: -------------------------------------------------------------------------------- 1 | Email addresses written like get autolinkified. 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/compact.text: -------------------------------------------------------------------------------- 1 | #|Item|Value 2 | :-|:-:|-: 3 | 1|Computer|$1600 4 | 2|Phone|$12 5 | 3|Pipe|$1 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Nested_blockquotes.text: -------------------------------------------------------------------------------- 1 | > foo 2 | > 3 | > > bar 4 | > 5 | > foo 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/escapes.text: -------------------------------------------------------------------------------- 1 | \*\*don't shout\*\* 2 | 3 | \*don't emphasize\* 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/issue2_safe_mode_borks_markup.opts: -------------------------------------------------------------------------------- 1 | {"safe_mode": "replace"} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns.text: -------------------------------------------------------------------------------- 1 | Recipe 123 and Komodo bug 234 are related. 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/kohook/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 2.8) 2 | 3 | add_executable(kohook kohook.c) 4 | target_link_libraries(kohook log elfrelink) 5 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/test/test_data/parasite: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/linux/lmap/test/test_data/parasite -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/.travis.yml: -------------------------------------------------------------------------------- 1 | language: node_js 2 | node_js: 3 | - "0.6" 4 | - "0.8" 5 | - "0.9" 6 | - "0.10" 7 | - "0.11" 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/emphasis/nested.text: -------------------------------------------------------------------------------- 1 | You can **nest *em* inside strong**. 2 | 3 | You can *nest **strong** inside em*. 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/emphasis/simple.text: -------------------------------------------------------------------------------- 1 | Emphasis can be *weak* or **strong**. 2 | 3 | It can _even_ use __underscores__. 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/pipe_escape.text: -------------------------------------------------------------------------------- 1 | | a\|b | c | 2 | | -----|------| 3 | | 1 | 2\|3 | 4 | | 4\|5 | 6 | 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Links_inline_style.text: -------------------------------------------------------------------------------- 1 | [silly URL w/ angle brackets](). 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/easy.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["em", "Hello!"], " how are ", ["strong", "you"], "?"]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html2.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "One ", ["div"], "123"], "\u000a", ["div"], "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml3.html: -------------------------------------------------------------------------------- 1 | Blah 2 | 3 | 4 |
em
5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml3.json: -------------------------------------------------------------------------------- 1 | ["html", ["table", "Blah", ["thead", ["td", ["em", "em"]]]], "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/minpmem/Kbuild.in: -------------------------------------------------------------------------------- 1 | obj-m += ${MODULE_NAME}.o 2 | 3 | ${MODULE_NAME}-objs := pmem.o pte_mmap.o pte_mmap_linux.o 4 | 5 | ccflags-y := -std=gnu99 -O2 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/resources/WinPmem/winpmem_x64.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-core/resources/WinPmem/winpmem_x64.sys -------------------------------------------------------------------------------- /rekall_framework/rekall-core/resources/WinPmem/winpmem_x86.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-core/resources/WinPmem/winpmem_x86.sys -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/toString.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./class2type" 3 | ], function( class2type ) { 4 | return class2type.toString; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/setext.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["h1", 3 | "One" 4 | ], 5 | ["h2", 6 | "Two" 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_reference.text: -------------------------------------------------------------------------------- 1 | [Reference link][1] with non-escaped parens. 2 | 3 | [1]: /url(test) "title" 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/lazy_wrapping.text: -------------------------------------------------------------------------------- 1 | * If you're too 2 | lazy to wrap your 3 | * Lists nicely, this 4 | will still work 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/multiline_inline.text: -------------------------------------------------------------------------------- 1 | * List items can have *inline content 2 | that spans multiple lines*. Pain 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code2.json: -------------------------------------------------------------------------------- 1 | ["html", ["blockquote", ["p", "Code"], 2 | ["pre", ["code", "Ciao"]]]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/escapes.html: -------------------------------------------------------------------------------- 1 |

**don't shout**

2 | 3 |

*don't emphasize*

4 | -------------------------------------------------------------------------------- /rekall_framework/tools/pmem/resources/winpmem/winpmem_x64.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/pmem/resources/winpmem/winpmem_x64.sys -------------------------------------------------------------------------------- /rekall_framework/tools/pmem/resources/winpmem/winpmem_x86.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/pmem/resources/winpmem/winpmem_x86.sys -------------------------------------------------------------------------------- /rekall_framework/tools/windows/winpmem/executable/winpmem.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/windows/winpmem/executable/winpmem.rc -------------------------------------------------------------------------------- /rekall_framework/config/dpkg/changelog: -------------------------------------------------------------------------------- 1 | python-rekall (1.0rc3-1) unstable; urgency=low 2 | 3 | * Initial release 4 | 5 | -- Rekall Fri, 03 Jan 2014 10:43:25 +0100 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/__init__.py: -------------------------------------------------------------------------------- 1 | import rekall.compatibility # pylint: disable=unused-import 2 | 3 | from ._version import get_versions 4 | __version__ = get_versions()['pep440'] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/filesystems/__init__.py: -------------------------------------------------------------------------------- 1 | # pylint: disable=unused-import 2 | 3 | from rekall.plugins.filesystems import ntfs 4 | from rekall.plugins.filesystems import tsk 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/core/var/rsingleTag.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | // Match a standalone tag 3 | return (/^<(\w+)\s*\/?>(?:<\/\1>|)$/); 4 | }); 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/hasOwn.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./class2type" 3 | ], function( class2type ) { 4 | return class2type.hasOwnProperty; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/var/support.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | // All support tests are defined in their respective modules. 3 | return {}; 4 | }); 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/lazy_wrapping.text: -------------------------------------------------------------------------------- 1 | > If you're too lazy 2 | to wrap your code nicely 3 | 4 | > This will still work 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/definition_lists/multiple_terms.text: -------------------------------------------------------------------------------- 1 | fruit 2 | vegetable 3 | : tomato 4 | 5 | animal 6 | mineral 7 | : pet rock 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/ref_with_image_ref.text: -------------------------------------------------------------------------------- 1 | [![alt text][id_2]][id_1] 2 | 3 | [id_1]: http://link_url 4 | [id_2]: http://image_url -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/alt.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["img", { 2 | "src": "/foo.jpg", 3 | "alt": "bar" 4 | }]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Links_inline_style.html: -------------------------------------------------------------------------------- 1 |

silly URL w/ angle brackets.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/blockquote.text: -------------------------------------------------------------------------------- 1 | [Trent wrote] 2 | > no way 3 | 4 | [Jeff wrote] 5 | > way 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_edge_cases.text: -------------------------------------------------------------------------------- 1 | Blah 123 becomes a line with two underscores. 2 | -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/linux/kernel_module/install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | sudo insmod {,mod_elf_path=$(pwd)/}rootkit_evil.ko mod_elf_size=$(wc -c < rootkit_evil.ko) 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/install: -------------------------------------------------------------------------------- 1 | etc/rekall-agent.yaml etc/ 2 | etc/init.d/rekall-agent etc/init.d/ 3 | usr/bin/rekall-agent-nanny usr/bin/ 4 | upstart/rekall-agent.conf /etc/init/ 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/angular/bower.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "angular", 3 | "version": "1.3.0", 4 | "main": "./angular.js", 5 | "dependencies": { 6 | } 7 | } 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/simple.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["blockquote", 3 | ["p", 4 | "Blockquote" 5 | ] 6 | ] 7 | ] 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/definition_lists/inline.text: -------------------------------------------------------------------------------- 1 | a term 2 | : *emphasised* definition. 3 | 4 | another term 5 | : **strong** definition. 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/id.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | { "id" : "para" }, 4 | "This is a paragraph\nwith an ID." 5 | ] 6 | ] 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/multiple_classes.text: -------------------------------------------------------------------------------- 1 | Here's a paragraph and 2 | an *em*{: .foo .bar} 3 | with multiple classes 4 | {: .foo .bar} 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/CoreDumps5.8.text: -------------------------------------------------------------------------------- 1 | * Unordered 2 | 1. Ordered 3 | 4 | Text 5 | 6 | * Unordered 7 | 1. Ordered 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code2.html: -------------------------------------------------------------------------------- 1 |
2 |

Code

3 | 4 |
Ciao
5 |
6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/inline_html2.text: -------------------------------------------------------------------------------- 1 |
Test **bold**
2 |

Test **bold**

3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists8.text: -------------------------------------------------------------------------------- 1 | Here is a paragraph. 2 | 3 | 4 | * Item 1 5 | * Item 2 6 | * Item 3 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/escapes.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "**don't shout**"], 2 | ["p", "*don't emphasize*"]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/footnotes_safe_mode_escape.opts: -------------------------------------------------------------------------------- 1 | {"safe_mode": "escape", "extras": ["footnotes"]} 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/parens_in_url_4.text: -------------------------------------------------------------------------------- 1 | [Inline link 4 with non-escaped parens]( "title"). 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/tests/data/UnnamedSection.json: -------------------------------------------------------------------------------- 1 | [["m",{"tool_name":"rekall","plugin_name":"render_sample","tool_version":"1.0.3"}],["s",{"name":null}],["x"]] -------------------------------------------------------------------------------- /rekall_framework/tools/testing/images/stopwatch-silhouette-hi.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/testing/images/stopwatch-silhouette-hi.png -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/inline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["code", 4 | "This" 5 | ], 6 | " is a code span." 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/reference_with_space.text: -------------------------------------------------------------------------------- 1 | A [link using a reference] [1] separated by a space. 2 | 3 | [1]: http://reference.com 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/bullet_types.text: -------------------------------------------------------------------------------- 1 | Stars 2 | 3 | * star 4 | 5 | Dashes 6 | 7 | - dash 8 | 9 | Pluses 10 | 11 | + plus 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/class.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | { "class" : "para" }, 4 | "This is a paragraph\nwith an ID." 5 | ] 6 | ] 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/list.text: -------------------------------------------------------------------------------- 1 | * here's a 2 | loose list 3 | 4 | * it might confuse the 5 | block_meta routine 6 | {: #list} 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Links_inline_style.xhtml: -------------------------------------------------------------------------------- 1 |

silly URL w/ angle brackets.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hrule.json: -------------------------------------------------------------------------------- 1 | ["html", ["hr"], 2 | ["hr"], 3 | ["hr"], 4 | ["hr"], 5 | ["hr"], "\u000a"] 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Email_auto_links.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | International domain names: -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_double_hit.text: -------------------------------------------------------------------------------- 1 | There once was a Mozilla bug 123 and a Komodo bug 123. 2 | -------------------------------------------------------------------------------- /rekall_framework/src/profiles/mspdb/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | gcc -g -Wall test.c -fms-extensions -o test.o 3 | rekal dwarfparser test.o --profile_class PDBProfile --output mspdb 4 | 5 | clean: 6 | rm test.o mspdb 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/seed.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: markdown-js 3 | description: JavaScript implementation of Markdown 4 | tags: markdown parser 5 | version: 0.1.2 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/atx.text: -------------------------------------------------------------------------------- 1 | # One 2 | 3 | ## Two 4 | 5 | ### Three 6 | 7 | #### Four 8 | 9 | ##### Five 10 | 11 | ###### Six 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/empty.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "", 5 | "alt": "Empty" 6 | } ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/images2.text: -------------------------------------------------------------------------------- 1 | 2 | This is an ![image][]. 3 | 4 | This is an ![image]. 5 | 6 | [image]: image.jpg 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/inline_html2.html: -------------------------------------------------------------------------------- 1 |
2 |

Test bold

3 |

Test bold

4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml3.text: -------------------------------------------------------------------------------- 1 | 2 | Blah 3 | 4 | 5 | 6 |
*em*
7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml_instruction.json: -------------------------------------------------------------------------------- 1 | ["html", "\u000a", ["p", "Targets ", " ", " "], 2 | ["p", "Inside: ", " last"]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_Spans.text: -------------------------------------------------------------------------------- 1 | From `` 2 | on two lines. 3 | 4 | From `` 6 | on three lines. 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans.text: -------------------------------------------------------------------------------- 1 | `This` is a code span. 2 | And ``This is one with an `embedded backtick` ``. 3 | -------------------------------------------------------------------------------- /rekall_framework/tools/windows/winpmem/pte_mmap_windows.h: -------------------------------------------------------------------------------- 1 | #include "winpmem.h" 2 | #include "pte_mmap.h" 3 | 4 | void pte_mmap_windows_delete(PTE_MMAP_OBJ *self); 5 | PTE_MMAP_OBJ *pte_mmap_windows_new(void); 6 | -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/linux/user_space_tool/norm-proc.h: -------------------------------------------------------------------------------- 1 | // When activating this, make sure also DELETE_PAGE_CACHE in rootkit_module.h is defined. 2 | //#define DELETE_PAGE_CACHE 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/overlays/linux/__init__.py: -------------------------------------------------------------------------------- 1 | """Linux support for DWARF profiles.""" 2 | 3 | from rekall.plugins.overlays.linux import elf 4 | from rekall.plugins.overlays.linux import linux 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/codemirror/theme/ambiance-mobile.css: -------------------------------------------------------------------------------- 1 | .cm-s-ambiance.CodeMirror { 2 | -webkit-box-shadow: none; 3 | -moz-box-shadow: none; 4 | box-shadow: none; 5 | } 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/spaceless.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["blockquote", 3 | ["p", 4 | "blockquote\nwithout spaces" 5 | ] 6 | ] 7 | ] 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/case_insensitive.text: -------------------------------------------------------------------------------- 1 | This is [google]. [Google] and [this][GoOgLe] are the same thing too 2 | 3 | [GOOGLE]: http://google.com 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/implicit.text: -------------------------------------------------------------------------------- 1 | These [links][] use [implicit] references. 2 | 3 | [links]: http://links.com 4 | [implicit]: http://implicit.com 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/in_brackets.text: -------------------------------------------------------------------------------- 1 | Lorem ipsum ([lorem ipsum](http://www.lipsum.com/)) dolar sit amut 2 | 3 | ([Inline link](/url()((test)))) 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/attribute.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | { "foo" : "bar" }, 4 | "A paragraph with an\narbitrary attribute." 5 | ] 6 | ] 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/quoted.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | { "foo" : "bar baz" }, 4 | "A paragraph with a\nquoted attribute." 5 | ] 6 | ] 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode.text: -------------------------------------------------------------------------------- 1 | blah blah 2 | 3 |
yowzer!
4 | 5 | blah 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/tests/data/NamedSection.json: -------------------------------------------------------------------------------- 1 | [["m",{"tool_name":"rekall","plugin_name":"render_sample","tool_version":"1.0.3"}],["s",{"name":["*","Named Section"]}],["x"]] -------------------------------------------------------------------------------- /rekall_framework/tools/pmem/resources/MacPmem.kext/Contents/MacOS/MacPmem: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/tools/pmem/resources/MacPmem.kext/Contents/MacOS/MacPmem -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/css/var/rnumnonpx.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../../var/pnum" 3 | ], function( pnum ) { 4 | return new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" ); 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/block.text: -------------------------------------------------------------------------------- 1 | Here is an example of AppleScript: 2 | 3 | tell application "Foo" 4 | beep 5 | end tell 6 | tab 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Tidyness.text: -------------------------------------------------------------------------------- 1 | > A list within a blockquote: 2 | > 3 | > * asterisk 1 4 | > * asterisk 2 5 | > * asterisk 3 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Email_auto_links.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | International domain names: -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Unicode.json: -------------------------------------------------------------------------------- 1 | ["html", ["blockquote", ["p", "Fo—o"]], 2 | ["p", "μορεοϋερ"], 3 | ["blockquote", ["p", "ßåř"]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/inline_html2.json: -------------------------------------------------------------------------------- 1 | ["html", ["div", ["p", "Test ", ["strong", "bold"]]], 2 | ["p", "Test ", ["strong", "bold"]]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list1.text: -------------------------------------------------------------------------------- 1 | * A list item with a blockquote: 2 | 3 | > This is a blockquote 4 | > inside a list item. 5 | 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Images_(Untitled).text: -------------------------------------------------------------------------------- 1 | ![alt text](/url/) 2 | 3 | ![alt text]() 4 | 5 | ![alt text][foo] 6 | 7 | [foo]: /url/ -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode_escape.text: -------------------------------------------------------------------------------- 1 | blah blah 2 | 3 |
yowzer!
4 | 5 | blah 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codeblock.text: -------------------------------------------------------------------------------- 1 | some code 2 | 3 | some 'splaining 4 | 5 | some more code 6 | 2 > 1 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans_safe_mode.text: -------------------------------------------------------------------------------- 1 | `This` is a code span. 2 | And ``This is one with an `embedded backtick` ``. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emphasis.text: -------------------------------------------------------------------------------- 1 | This is *italic* and this is **bold**. 2 | This is also _italic_ and this is __bold__. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/components/sessions/manage-sessions.css: -------------------------------------------------------------------------------- 1 | .session-form { 2 | height: 90%; 3 | } 4 | 5 | .session-list { 6 | height: 90%; 7 | overflow-y: auto; 8 | } -------------------------------------------------------------------------------- /rekall_framework/debian/changelog.in: -------------------------------------------------------------------------------- 1 | rekall-forensic (%(version)s) RELEASED; urgency=low 2 | 3 | [ Rekall Team ] 4 | * Release %(version)s %(codename)s 5 | 6 | -- Rekall Team %(debian_ts)s 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/installers/debian/changelog: -------------------------------------------------------------------------------- 1 | rekall-agent-debian (1.7.0) unstable; urgency=low 2 | 3 | * Initial release 4 | 5 | -- Rekall Team Tue, 1 August 2017 17:38:40 +0000 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/flows/__init__.py: -------------------------------------------------------------------------------- 1 | from rekall_agent.flows import artifact_flow 2 | from rekall_agent.flows import collect 3 | from rekall_agent.flows import find 4 | from rekall_agent.flows import yara 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/definition_lists/multiple_definitions.text: -------------------------------------------------------------------------------- 1 | fruit 2 | : apple 3 | : banana 4 | : pear 5 | 6 | animal 7 | : cow 8 | : duck 9 | : horse 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/linebreaks/simple.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "The quick brown fox", 4 | ["br"], 5 | "jumps over the lazy dog." 6 | ] 7 | ] 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/in_blockquotes.text: -------------------------------------------------------------------------------- 1 | > Let's fork this repo! 2 | > 3 | > [markdown][] 4 | > 5 | > [markdown]: https://github.com/evilstreak/markdown-js 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/missing_references.text: -------------------------------------------------------------------------------- 1 | Link with [missing][id] reference 2 | 3 | Link with [empty][] reference 4 | 5 | Link with [inferred] reference 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_Spans.text: -------------------------------------------------------------------------------- 1 | From `` 2 | on two lines. 3 | 4 | From `` 6 | on three lines. 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_block_in_a_list_item.text: -------------------------------------------------------------------------------- 1 | 2 | * List Item: 3 | 4 | code block 5 | 6 | with a blank line 7 | 8 | within a list item. -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_block_with_tabs.text: -------------------------------------------------------------------------------- 1 | Test with tabs for `_Detab`: 2 | 3 | Code 'block' with some "tabs" and "quotes" 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/header.html: -------------------------------------------------------------------------------- 1 |

an h1

2 | 3 |

an h2

4 | 5 |

another h1

6 | 7 |

another h2

8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/hr.text: -------------------------------------------------------------------------------- 1 | Dashes: 2 | 3 | --- 4 | 5 | --- 6 | 7 | --- 8 | 9 | --- 10 | 11 | --- 12 | 13 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/parens_in_url_4.html: -------------------------------------------------------------------------------- 1 |

Inline link 4 with non-escaped parens.

2 | -------------------------------------------------------------------------------- /rekall_framework/debian/changelog: -------------------------------------------------------------------------------- 1 | rekall-forensic (1.7.2) RELEASED; urgency=low 2 | 3 | [ Rekall Team ] 4 | * Release 1.7.2 Hurricane Ridge 5 | 6 | -- Rekall Team Wed, 6 Dec 2017 6:51:02 +0000 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/windows/interactive/__init__.py: -------------------------------------------------------------------------------- 1 | # pylint: disable=unused-import 2 | 3 | from rekall.plugins.windows.interactive import profiles 4 | from rekall.plugins.windows.interactive import structs 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/test-infra/uncached-npm-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | cp test-infra/npm-shrinkwrap.canonical.json npm-shrinkwrap.json 3 | npm install 4 | rm npm-shrinkwrap.json 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/trailing_paras.text: -------------------------------------------------------------------------------- 1 | Header 2 | ====== 3 | Paragraph 4 | 5 | Header 6 | ------ 7 | Paragraph 8 | 9 | ### Header 10 | Paragraph 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/basic.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/path/to/img.jpg", 5 | "alt": "Alt text" 6 | } ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/crotcheted_url.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/url/", 5 | "alt": "alt text" 6 | } ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/ref.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/path/to/img.jpg", 5 | "alt": "Alt text" 6 | } ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Links_inline_style.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "?}]*+|&)" 3 | }, 4 | "silly URL w/ angle brackets"], "."]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/auto_link.text: -------------------------------------------------------------------------------- 1 | I can has autolink? 2 | 3 | Ask garfield: 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/missing_link_defn.html: -------------------------------------------------------------------------------- 1 |

This is a [missing link][missing] and a used link.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/ref_links.html: -------------------------------------------------------------------------------- 1 |

Google is fast star.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/images/Rekall.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/images/Rekall.png -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/lmap/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 2.8) 2 | 3 | add_executable(lmap lmap.c memory_map.c lkm_control.c elf_dump.c kcore.c) 4 | 5 | target_link_libraries(lmap log elfrelink minpmem) 6 | -------------------------------------------------------------------------------- /subversion_techniques/shared_memory/windows/Release/shared_memory_subversion.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/shared_memory/windows/Release/shared_memory_subversion.exe -------------------------------------------------------------------------------- /subversion_techniques/shared_memory/windows/Release/shared_memory_subversion.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/shared_memory/windows/Release/shared_memory_subversion.pdb -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-128.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-128.png -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-32.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-32.png -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-64.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/osx/Rekall/Rekall/Images.xcassets/AppIcon.appiconset/Rekall-64.png -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/plugins/overlays/darwin/__init__.py: -------------------------------------------------------------------------------- 1 | """Profiles to support OSX specific data structures.""" 2 | 3 | from rekall.plugins.overlays.darwin import darwin 4 | from rekall.plugins.overlays.darwin import macho 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/debian/changelog: -------------------------------------------------------------------------------- 1 | rekall-forensic (1.4.0) RELEASED; urgency=low 2 | 3 | [ Rekall Team ] 4 | * Release 1.4.0 Etzel 5 | 6 | -- Rekall Team Wed, 10 August 2015 8:46:37 +0000 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/codemirror/addon/display/fullscreen.css: -------------------------------------------------------------------------------- 1 | .CodeMirror-fullscreen { 2 | position: fixed; 3 | top: 0; left: 0; right: 0; bottom: 0; 4 | height: auto; 5 | z-index: 9; 6 | } 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/css/var/getStyles.js: -------------------------------------------------------------------------------- 1 | define(function() { 2 | return function( elem ) { 3 | return elem.ownerDocument.defaultView.getComputedStyle( elem, null ); 4 | }; 5 | }); 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/traversing/var/rneedsContext.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../../core", 3 | "../../selector" 4 | ], function( jQuery ) { 5 | return jQuery.expr.match.needsContext; 6 | }); 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/lib/index.js: -------------------------------------------------------------------------------- 1 | // super simple module for the most common nodejs use case. 2 | exports.markdown = require("./markdown"); 3 | exports.parse = exports.markdown.toHTML; 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/inline_multiline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "foo ", 4 | ["code", 5 | "code\ncode" 6 | ], 7 | " bar" 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/code.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["pre", 3 | { "foo" : "bar" }, 4 | ["code", 5 | "A pre with an\narbitrary attribute." 6 | ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/simple_no_leading.text: -------------------------------------------------------------------------------- 1 | First Header | Second Header 2 | ------------- | ------------- 3 | Content 1 | Content 2 4 | Content 3 | Content 4 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Nested_blockquotes.json: -------------------------------------------------------------------------------- 1 | ["html", ["blockquote", ["p", "foo"], 2 | ["blockquote", ["p", "bar"]], 3 | ["p", "foo"]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_multiline_bugs_1.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | [link 4 | text] [link 5 | id] 6 | 7 | [link id]: /someurl/ 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code.text: -------------------------------------------------------------------------------- 1 | Here is an example of AppleScript: 2 | 3 | tell application "Foo" 4 | beep 5 | end tell 6 | tab 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/images2.html: -------------------------------------------------------------------------------- 1 |

This is an image.

2 | 3 |

This is an image.

4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/olist.html: -------------------------------------------------------------------------------- 1 |

This is a list:

2 | 3 |
    4 |
  1. one
  2. 5 | 6 |
  3. two
  4. 7 | 8 |
  5. three
  6. 9 |
10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/olist.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is a list:"], 2 | ["ol", ["li", "one"], 3 | ["li", "two"], 4 | ["li", "three"]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode.opts: -------------------------------------------------------------------------------- 1 | # Use the old (for-compat-only) way of specifying "replace" safe mode. 2 | {"safe_mode": True} 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans.html: -------------------------------------------------------------------------------- 1 |

This is a code span. 2 | And This is one with an `embedded backtick`.

3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/header.text: -------------------------------------------------------------------------------- 1 | # an h1 2 | 3 | ## an h2 4 | 5 | another h1 6 | ========== 7 | 8 | another h2 9 | ---------- 10 | -------------------------------------------------------------------------------- /subversion_techniques/shared_memory/windows/x64/Release/shared_memory_subversion.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/shared_memory/windows/x64/Release/shared_memory_subversion.exe -------------------------------------------------------------------------------- /subversion_techniques/shared_memory/windows/x64/Release/shared_memory_subversion.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/shared_memory/windows/x64/Release/shared_memory_subversion.pdb -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/contains_code.text: -------------------------------------------------------------------------------- 1 | > There's a code block in here: 2 | > 3 | > SET foo = TRUE 4 | > 5 | > IF foo GOTO 10 6 | > 7 | > Wasn't that nice? 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/threequotes.json: -------------------------------------------------------------------------------- 1 | [ "html", 2 | [ "blockquote", 3 | [ "p", "this is" ], 4 | [ "p", "three" ], 5 | [ "p", "quotes" ] 6 | ] 7 | ] 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/spaces_in_href.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "path to img.jpg", 5 | "alt": "Alt text" 6 | } ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/hr_abutting.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | [ "li", "foo" ], 4 | [ "li", "bar" ] 5 | ], 6 | ["hr"], 7 | ["p", "after"] 8 | ] 9 | 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Links_inline_style.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "?}]*+|&)" 3 | }, 4 | "silly URL w/ angle brackets"], "."]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraphs.html: -------------------------------------------------------------------------------- 1 |

Paragraph 1

2 | 3 |

Paragraph 2

4 | 5 |

Paragraph 3 Paragraph 4 Paragraph Br->
Paragraph 5

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/auto_link_safe_mode.text: -------------------------------------------------------------------------------- 1 | I can has autolink? 2 | 3 | Ask garfield: 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/raw_html.text: -------------------------------------------------------------------------------- 1 | 2 | Hi, *there*. blah 3 | 4 |
5 | **ack** 6 |
7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/ref_links.text: -------------------------------------------------------------------------------- 1 | [Google][] is fast ![star][]. 2 | 3 | [google]: http://www.google.com/ 4 | [star]: /img/star.png 5 | 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/load-controller.js: -------------------------------------------------------------------------------- 1 | (function() { 2 | 3 | var module = angular.module('manuskript.load.controller', []); 4 | 5 | module.controller('ManuskriptLoadController', function($scope) { 6 | }); 7 | })(); -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/images/Rekall-32.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/images/Rekall-32.png -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/angular-mocks/bower.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "angular-mocks", 3 | "version": "1.2.26", 4 | "main": "./angular-mocks.js", 5 | "dependencies": { 6 | "angular": "1.2.26" 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/leading_whitespace.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | ["li", 4 | "white" 5 | ], 6 | ["li", 7 | "space" 8 | ] 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_block_in_a_list_item.text: -------------------------------------------------------------------------------- 1 | 2 | * List Item: 3 | 4 | code block 5 | 6 | with a blank line 7 | 8 | within a list item. -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_brackets.text: -------------------------------------------------------------------------------- 1 | [ZIP archives](http://en.wikipedia.org/wiki/ZIP_(file_format) "ZIP (file format) - Wikipedia, the free encyclopedia") 2 | 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/email.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is an email address: ", ["a", { 2 | "href": "mailto:andrea@invalid.it" 3 | }, 4 | "andrea@invalid.it"]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Backslash_escapes.text: -------------------------------------------------------------------------------- 1 | Tricky combinaisons: backslash with \\-- two dashes backslash with \\> greater than \\\[test](not a link) \\\*no emphasis* -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode.html: -------------------------------------------------------------------------------- 1 |

blah [HTML_REMOVED] blah

2 | 3 |

[HTML_REMOVED]yowzer![HTML_REMOVED]

4 | 5 |

blah

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans_safe_mode.html: -------------------------------------------------------------------------------- 1 |

This is a code span. 2 | And This is one with an `embedded backtick`.

3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/raw_html.html: -------------------------------------------------------------------------------- 1 |

Hi, there. blah

2 | 3 |
4 | **ack** 5 |
6 | -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/test/test_data/parasite.shstrtab: -------------------------------------------------------------------------------- 1 | .symtab.strtab.shstrtab.note.gnu.build-id.rela.text.rela.init.text.rela.exit.text.rodata.modinfo__versions.rela.data.gnu.linkonce.this_module.bss.comment.note.GNU-stack -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/angular/angular.min.js.gzip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/angular/angular.min.js.gzip -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/embedded_backtick.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "This is a ", 4 | ["code", 5 | "code span with an `embedded` backtick"], 6 | "." 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/definition_lists/long.text: -------------------------------------------------------------------------------- 1 | first term 2 | : the quick brown fox jumps 3 | over the lazy dog 4 | 5 | second term 6 | : pack my box with five 7 | dozen liquor jugs 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/atx_closing_hashes.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["h1", 3 | "One" 4 | ], 5 | ["h2", 6 | "Two" 7 | ], 8 | ["h3", 9 | "Three" 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/hr_inside.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | [ "li", 4 | ["p", "before"], 5 | ["hr"], 6 | ["p", "after"] 7 | ] 8 | ] 9 | ] 10 | 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/align.text: -------------------------------------------------------------------------------- 1 | | # | Item | Value | 2 | | :- | :-------: | -----:| 3 | | 1 | Computer | $1600 | 4 | | 2 | Phone | $12 | 5 | | 3 | Pipe | $1 | 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists7.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Ciao"], 2 | ["ul", ["li", "Tab * Tab * Tab"]], 3 | ["p", "Ciao"], 4 | ["ul", ["li", "Tab * Tab * Tab"]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_edge_cases.html: -------------------------------------------------------------------------------- 1 |

Blah 123 becomes a line with two underscores.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/lists.text: -------------------------------------------------------------------------------- 1 | count: 2 | 3 | * one 4 | * two 5 | * three 6 | 7 | count in spanish: 8 | 9 | 1. uno 10 | 2. dos 11 | 3. tres 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/rekall_gui/plugins/webconsole/static/tests/data/Format.json: -------------------------------------------------------------------------------- 1 | [["m",{"tool_name":"rekall","plugin_name":"render_sample","tool_version":"1.0.3"}],["f",["*","This is a formatted string: %s %d %s"],["*","foo"],42,["*","bar"]],["x"]] -------------------------------------------------------------------------------- /rekall_framework/tools/linux/lmap/elfrelink/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | add_definitions(-std=c99 -Wall -Wextra -ggdb) 2 | 3 | add_library(elfrelink elfrelink.c elf_object.c elf_sections.c elf_symbols.c elf_relocations.c) 4 | 5 | target_link_libraries(elfrelink log) 6 | -------------------------------------------------------------------------------- /subversion_techniques/verification.yar: -------------------------------------------------------------------------------- 1 | rule token_string { 2 | 3 | strings: 4 | $s1 = "AAAAAAAAAAAAAAAAAA_what.the.eyes.see.and.the.ears.hear..the.mind.believes_AAAAAAAAAAAAAAAAAA" ascii 5 | 6 | condition: 7 | all of them 8 | } 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/angular-animate/bower.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "angular-animate", 3 | "version": "1.2.26", 4 | "main": "./angular-animate.js", 5 | "dependencies": { 6 | "angular": "1.2.26" 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/angular-resource/bower.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "angular-resource", 3 | "version": "1.2.26", 4 | "main": "./angular-resource.js", 5 | "dependencies": { 6 | "angular": "1.2.26" 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/event/support.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "../var/support" 3 | ], function( support ) { 4 | 5 | support.focusinBubbles = "onfocusin" in window; 6 | 7 | return support; 8 | 9 | }); 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/horizontal_rules.text: -------------------------------------------------------------------------------- 1 | fsfsfsf 2 | * * * 3 | 4 | *** 5 | 6 | ***** 7 | 8 | - - - 9 | 10 | --------------------------------------- 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_in_code.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Autolinks don't happen inside code: ", 4 | ["code", 5 | "" 6 | ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/nested.text: -------------------------------------------------------------------------------- 1 | 1. one 2 | * alpha 3 | - almond 4 | - brazil 5 | * beta 6 | - cashew 7 | 2. two 8 | 3. three 9 | * gamma 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/inner_whitespace.text: -------------------------------------------------------------------------------- 1 | We can have no whitespace 2 | {:#none} 3 | 4 | Or a single whitespace 5 | {: #one } 6 | 7 | And even lots of whitespace 8 | {: #lots } 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code.html: -------------------------------------------------------------------------------- 1 |

Here is an example of AppleScript:

2 | 3 |
tell application "Foo"
4 |     beep
5 | end tell
6 | 	tab
7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list1.json: -------------------------------------------------------------------------------- 1 | ["html", ["ul", ["li", ["p", "A list item with a blockquote:"], 2 | ["blockquote", ["p", "This is a blockquote inside a list item."]]]]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraphs.text: -------------------------------------------------------------------------------- 1 | Paragraph 1 2 | 3 | Paragraph 2 4 | 5 | 6 | Paragraph 3 7 | Paragraph 4 8 | Paragraph Br-> 9 | Paragraph 5 10 | 11 | 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["code", "This"], " is a code span.\u000aAnd ", ["code", "This is one with an `embedded backtick`"], "."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall.xcodeproj/project.xcworkspace/contents.xcworkspacedata: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/MANIFEST.in: -------------------------------------------------------------------------------- 1 | recursive-exclude .git * 2 | recursive-exclude build * 3 | include README.md 4 | recursive-include manuskript/static * 5 | recursive-include rekall_gui/plugins/webconsole/static * 6 | exclude .gitignore 7 | exclude *.pyc 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/spaces_in_url.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | { "href" : "Link to file/Lorem Ipsum.txt", "title" : "Alt2" }, 5 | "link text" 6 | ] 7 | ] 8 | ] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/document.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | { 3 | "key" : "value", 4 | "anotherkey" : "another value" 5 | }, 6 | ["p", 7 | "A regular paragraph" 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/simple_leading.text: -------------------------------------------------------------------------------- 1 | | First Header | Second Header | 2 | | ------------- | ------------- | 3 | | Content 1 | Content 2 | 4 | | Content 3 | Content 4 | 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Unicode.xhtml: -------------------------------------------------------------------------------- 1 |
2 |

Fo—o

3 |
4 | 5 |

μορεοϋερ

6 | 7 |
8 |

ßåř

9 |
10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists7.html: -------------------------------------------------------------------------------- 1 |

Ciao

2 | 3 |
    4 |
  • Tab * Tab * Tab
  • 5 |
6 |

Ciao

7 | 8 |
    9 |
  • Tab * Tab * Tab
  • 10 |
11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/paragraphs.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Paragraph 1"], 2 | ["p", "Paragraph 2"], 3 | ["p", "Paragraph 3 Paragraph 4 Paragraph Br->", ["br"], "Paragraph 5"]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "blah [HTML_REMOVED] blah"], 2 | ["p", "[HTML_REMOVED]yowzer![HTML_REMOVED]"], 3 | ["p", "blah"]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode_escape.html: -------------------------------------------------------------------------------- 1 |

blah <img src="dangerous"> blah

2 | 3 |

<div>yowzer!</div>

4 | 5 |

blah

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/basic_safe_mode_escape.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "blah blah"], 2 | ["p", "
yowzer!
"], 3 | ["p", "blah"]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_safe_emphasis.text: -------------------------------------------------------------------------------- 1 | This is *italic* and this is **bold**. 2 | This is NOT _italic_ and this is __bold__ because --code-safe is turned on. 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/hr.html: -------------------------------------------------------------------------------- 1 |

Dashes:

2 | 3 |
4 | 5 |
6 | 7 |
8 | 9 |
10 | 11 |
---
12 | 
13 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/ng-file-upload/FileAPI.flash.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/ng-file-upload/FileAPI.flash.swf -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/Rekall-Prefix.pch: -------------------------------------------------------------------------------- 1 | // 2 | // Prefix header 3 | // 4 | // The contents of this file are implicitly included at the beginning of every source file. 5 | // 6 | 7 | #ifdef __OBJC__ 8 | #import 9 | #endif 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-core/rekall/tests.py: -------------------------------------------------------------------------------- 1 | # pylint: disable=unused-import 2 | 3 | from rekall import addrspace_test 4 | from rekall import io_manager_test 5 | from rekall import obj_test 6 | from rekall import session_test 7 | 8 | from rekall.plugins import tests 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "An ", 4 | ["a", 5 | { "href" : "http://inline.com" }, 6 | "inline" 7 | ], 8 | " link." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/leading_whitespace.text: -------------------------------------------------------------------------------- 1 | Zero 2 | {: #zero} 3 | 4 | One 5 | {: #one} 6 | 7 | Two 8 | {: #two} 9 | 10 | Three 11 | {: #three} 12 | 13 | Four 14 | {: #four} 15 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Backslash_escapes.text: -------------------------------------------------------------------------------- 1 | Tricky combinaisons: backslash with \\-- two dashes backslash with \\> greater than \\\[test](not a link) \\\*no emphasis* -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_brackets.xhtml: -------------------------------------------------------------------------------- 1 |

ZIP archives

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Here is an example of AppleScript:"], 2 | ["pre", ["code", "tell application \"Foo\"\u000a beep\u000aend tell\u000a\u0009tab"]]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codespans_safe_mode.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["code", "This"], " is a code span.\u000aAnd ", ["code", "This is one with an `embedded backtick`"], "."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emphasis.html: -------------------------------------------------------------------------------- 1 |

This is italic and this is bold. 2 | This is also italic and this is bold.

3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/MANIFEST.in: -------------------------------------------------------------------------------- 1 | include README.rst _version.py 2 | recursive-exclude .git * 3 | recursive-exclude build * 4 | 5 | recursive-include rekall_agent * 6 | recursive-exclude rekall_agent *.pyc 7 | 8 | exclude .gitignore 9 | exclude *.pyc 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/horizontal_rules.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["pre", 3 | ["code", 4 | "fsfsfsf\n* * *\n\n***\n\n*****\n\n- - -\n\n---------------------------------------" 5 | ] 6 | ] 7 | ] 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/in_blockquotes.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["blockquote", 3 | ["p", 4 | "Let's fork this repo!" 5 | ], 6 | ["p", 7 | "[markdown][]" 8 | ] 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_multiline_bugs_1.html: -------------------------------------------------------------------------------- 1 |

http://bugs.debian.org/459885

2 | 3 |

link 4 | text

5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists9.json: -------------------------------------------------------------------------------- 1 | ["html", ["ul", ["li", ["p", "Due"], 2 | ["ol", ["li", "tre"], 3 | ["li", "tre"], 4 | ["li", "tre"]]], 5 | ["li", ["p", "Due"]]]] 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Images_(Untitled).html: -------------------------------------------------------------------------------- 1 |

alt text

2 | 3 |

alt text

4 | 5 |

alt text

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Inline_HTML_comments.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Paragraph one."], "\u000a\u000a", "\u000a\u000a", ["p", "Paragraph two."], "\u000a\u000a", "\u000a\u000a", ["p", "The end."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codeblock.html: -------------------------------------------------------------------------------- 1 |
some code
2 | 
3 | 4 |

some 'splaining

5 | 6 |
some more code
7 | 2 > 1
8 | 
9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/missing_link_defn.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is a [missing link][missing] and a ", ["a", { 2 | "href": "http://foo.com" 3 | }, 4 | "used link"], "."]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/ng-file-upload-shim/FileAPI.flash.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/ng-file-upload-shim/FileAPI.flash.swf -------------------------------------------------------------------------------- /rekall_framework/src/profiles/macho/macho.xcodeproj/project.xcworkspace/contents.xcworkspacedata: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/tools/osx/MacPmem/MacPmem.xcodeproj/project.xcworkspace/contents.xcworkspacedata: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/loose_with_inline.text: -------------------------------------------------------------------------------- 1 | * List item _ending_ 2 | with _emphasis_. 3 | 4 | * List item 5 | with **strong emphasis**. 6 | 7 | * List item 8 | with [a link](http://google.com). 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Literal_quotes_in_titles.text: -------------------------------------------------------------------------------- 1 | Foo [bar][]. 2 | 3 | Foo [bar](/url/ "Title with "quotes" inside"). 4 | 5 | 6 | [bar]: /url/ "Title with "quotes" inside" 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Strong_and_em_together.text: -------------------------------------------------------------------------------- 1 | ***This is strong and em.*** 2 | 3 | So is ***this*** word. 4 | 5 | ___This is strong and em.___ 6 | 7 | So is ___this___ word. 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/HTML5-attributes.text: -------------------------------------------------------------------------------- 1 |

foo

2 | 3 |

4 | this is a paragraph 5 |

6 | 7 |

8 | an h2 9 |

10 | 11 | normal 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Nesting.text: -------------------------------------------------------------------------------- 1 | Valid nesting: 2 | 3 | **[Link](url)** 4 | 5 | [**Link**](url) 6 | 7 | **[**Link**](url)** 8 | 9 | Invalid nesting: 10 | 11 | [[Link](url)](url) -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/blockquote.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "[Trent wrote]"], 2 | ["blockquote", ["p", "no way"]], 3 | ["p", "[Jeff wrote]"], 4 | ["blockquote", ["p", "way"]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/codeblock.json: -------------------------------------------------------------------------------- 1 | ["html", ["pre", ["code", "some code\u000a"]], 2 | ["p", "some 'splaining"], 3 | ["pre", ["code", "some more code\u000a2 > 1\u000a"]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/header.json: -------------------------------------------------------------------------------- 1 | ["html", ["h1", "an h1"], "\u000a\u000a", ["h2", "an h2"], "\u000a\u000a", ["h1", "another h1"], "\u000a\u000a", ["h2", "another h2"], "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/missing_link_defn.text: -------------------------------------------------------------------------------- 1 | 2 | This is a [missing link][missing] and a [used link][used]. 3 | 4 | 5 | [used]: http://foo.com 6 | [unused]: http://foo.com 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/parens_in_url_4.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "/url(test)", 3 | "title": "title" 4 | }, 5 | "Inline link 4 with non-escaped parens"], "."]] 6 | -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.cer: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.cer -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.pdb -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/mas_remapping_and_pte_subversions/windows/kernel_module/x64/Release/DriverKit.sys -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/emphasis/multiple_lines.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "You can ", 4 | ["em", 5 | "start emphasis on one line,\nand finish it" 6 | ], 7 | " on another." 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/title.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/path/to/img.jpg", 5 | "alt": "Alt text", 6 | "title": "Optional title" 7 | } ] 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/numeric.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ol", 3 | ["li", 4 | "one" 5 | ], 6 | ["li", 7 | "two" 8 | ], 9 | ["li", 10 | "three" 11 | ] 12 | ] 13 | ] 14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/tight.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | ["li", 4 | "alpha" 5 | ], 6 | ["li", 7 | "beta" 8 | ], 9 | ["li", 10 | "gamma" 11 | ] 12 | ] 13 | ] 14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/extra_table1.text: -------------------------------------------------------------------------------- 1 | CSS: style.css 2 | 3 | First Header | Second Header 4 | ------------- | ------------- 5 | Content Cell | Content Cell 6 | Content Cell | Content Cell 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml_instruction.html: -------------------------------------------------------------------------------- 1 | 2 |

Targets

3 | 4 |

Inside: last

5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_Spans.html: -------------------------------------------------------------------------------- 1 |

From <!-- to --> 2 | on two lines.

3 | 4 |

From <!-- 5 | to --> 6 | on three lines.

7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_block_with_tabs.html: -------------------------------------------------------------------------------- 1 |

Test with tabs for _Detab:

2 | 3 |
Code    'block' with    some    "tabs"  and "quotes"
4 | 
5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-agent/rekall_agent/locations/__init__.py: -------------------------------------------------------------------------------- 1 | # Implementations of location handlers. 2 | # pylint: disable=unused-import 3 | 4 | #from rekall_agent.locations import cloud 5 | from rekall_agent.locations import files 6 | from rekall_agent.locations import http_location 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/crotcheted_url_with_title.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/url/", 5 | "alt": "alt text", 6 | "title": "with a title" 7 | } ] 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/reference.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "A ", 4 | ["a", 5 | { "href" : "http://reference.com" }, 6 | "link using a reference" 7 | ], 8 | "." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Nested_blockquotes.xhtml: -------------------------------------------------------------------------------- 1 |
2 |

foo

3 | 4 |
5 |

bar

6 |
7 | 8 |

foo

9 |
10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_comments.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Paragraph one."], "\u000a\u000a", "\u000a\u000a", ["p", "Paragraph two."], "\u000a\u000a", "\u000a\u000a", ["p", "The end."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Nesting.text: -------------------------------------------------------------------------------- 1 | Valid nesting: 2 | 3 | **[Link](url)** 4 | 5 | [**Link**](url) 6 | 7 | **[**Link**](url)** 8 | 9 | Invalid nesting: 10 | 11 | [[Link](url)](url) -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/CoreDumps5.8.json: -------------------------------------------------------------------------------- 1 | ["html", ["ul", ["li", "Unordered\u000a", ["ol", ["li", "Ordered"]]]], 2 | ["p", "Text"], 3 | ["ul", ["li", "Unordered\u000a", ["ol", ["li", "Ordered"]]]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/HTML5-attributes.html: -------------------------------------------------------------------------------- 1 |

foo

2 | 3 |

4 | this is a paragraph 5 |

6 | 7 |

8 | an h2 9 |

10 | 11 |

normal

12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Inline_HTML_comments.text: -------------------------------------------------------------------------------- 1 | Paragraph one. 2 | 3 | 4 | 5 | Paragraph two. 6 | 7 | 8 | 9 | The end. 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/nested_list.text: -------------------------------------------------------------------------------- 1 | shopping list: 2 | 3 | - veggies 4 | + carrots 5 | + lettuce 6 | - fruits 7 | + oranges 8 | + apples 9 | + *peaches* 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "manuskript", 3 | "branchVersion": "0.1.*", 4 | "devDependencies": { 5 | "grunt": "^0.4.4", 6 | "grunt-contrib-jshint": "^0.10.0" 7 | }, 8 | "licenses": [], 9 | "dependencies": {} 10 | } 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.eot -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.ttf -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/fonts/glyphicons-halflings-regular.woff -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/spaces_round_title.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["img", { 4 | "src": "/url/", 5 | "alt": "alt text", 6 | "title": "title has spaces afterward" 7 | } ] 8 | ] 9 | ] 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Tidyness.xhtml: -------------------------------------------------------------------------------- 1 |
2 |

A list within a blockquote:

3 |
    4 |
  • asterisk 1
  • 5 |
  • asterisk 2
  • 6 |
  • asterisk 3
  • 7 |
8 |
9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/email.html: -------------------------------------------------------------------------------- 1 |

This is an email address: andrea@invalid.it

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_safe_emphasis.html: -------------------------------------------------------------------------------- 1 |

This is italic and this is bold. 2 | This is NOT _italic_ and this is __bold__ because --code-safe is turned on.

3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_head_vars.json: -------------------------------------------------------------------------------- 1 | ["html", "\u000a\u000a", ["p", "This sentence talks about the Python __init__ method, which I'd rather not be\u000ainterpreted as Markdown's strong."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_edge_cases.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "http://foo.com/blah_blah_blah/123" 3 | }, 4 | "Blah 123"], " becomes a line with two underscores."]] 5 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/visitors/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing visitors for AST trees.""" 2 | 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/windows/user_space_tool/x64/Release/user_space_tool.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/mas_remapping_and_pte_subversions/windows/user_space_tool/x64/Release/user_space_tool.exe -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/windows/user_space_tool/x64/Release/user_space_tool.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/subversion_techniques/mas_remapping_and_pte_subversions/windows/user_space_tool/x64/Release/user_space_tool.pdb -------------------------------------------------------------------------------- /subversion_techniques/shared_memory/linux/Makefile: -------------------------------------------------------------------------------- 1 | CC=gcc 2 | CFLAGS=-pthread -lrt -lcurl -ldl 3 | INPUT=shared_memory_subversion.c 4 | OUTPUT=shared_memory_subversion 5 | 6 | all: shared_memory_subversion 7 | 8 | shared_memory_subversion: 9 | $(CC) $(CFLAGS) $(INPUT) -o $(OUTPUT) 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline_with_newline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "An ", 4 | ["a", 5 | { "href" : "http://inline.com" }, 6 | "inline\nlink" 7 | ], 8 | " with a newline." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Tidyness.json: -------------------------------------------------------------------------------- 1 | ["html", ["blockquote", ["p", "A list within a blockquote:"], 2 | ["ul", ["li", "asterisk 1"], 3 | ["li", "asterisk 2"], 4 | ["li", "asterisk 3"]]]] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Backslash_escapes.xhtml: -------------------------------------------------------------------------------- 1 |

Tricky combinaisons:

backslash with \-- two dashes

backslash with \> greater than

\[test](not a link)

\*no emphasis*

-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list1.html: -------------------------------------------------------------------------------- 1 |
    2 |
  • 3 |

    A list item with a blockquote:

    4 | 5 |
    6 |

    This is a blockquote inside a list item.

    7 |
    8 |
  • 9 |
10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list3.text: -------------------------------------------------------------------------------- 1 | * A list item with a blockquote: 2 | 3 | > This is a blockquote 4 | > inside a list item. 5 | 6 | * A list item with a code block: 7 | 8 | 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Inline_HTML_(Span).text: -------------------------------------------------------------------------------- 1 | ACINACS 2 | 3 | SB 4 | SB -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/hr.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Dashes:"], "\u000a\u000a", ["hr"], "\u000a\u000a", ["hr"], "\u000a\u000a", ["hr"], "\u000a\u000a", ["hr"], "\u000a\u000a", ["pre", ["code", "---\u000a"]]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/inline_links.text: -------------------------------------------------------------------------------- 1 | an inline [link](/url/) 2 | 3 | a [link "with" title](/url/ "title") 4 | 5 | an inline ![image link](/url/) 6 | 7 | an ![image "with" title](/url/ "title") 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/issue2_safe_mode_borks_markup.text: -------------------------------------------------------------------------------- 1 | ## Heading 2 2 | 3 | blah **blah** 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/nested_list_safe_mode.text: -------------------------------------------------------------------------------- 1 | shopping list: 2 | 3 | - veggies 4 | + carrots 5 | + lettuce 6 | - fruits 7 | + oranges 8 | + apples 9 | + *peaches* 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/raw_html.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Hi, ", ["span", { 2 | "foo": "*bar*" 3 | }, 4 | ["em", "there"]], ". ", " blah"], "\u000a\u000a", ["div", "\u000a **ack**\u000a"], "\u000a"] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/underline_in_autolink.text: -------------------------------------------------------------------------------- 1 | Eric wrote up a (long) intro to writing UDL definitions a while back on 2 | his blog: 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.eot -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.ttf -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DFRWS-memory-subversion/DFRWS-USA-2020/HEAD/rekall_framework/rekall-gui/manuskript/static/bower_components/bootstrap/dist/fonts/glyphicons-halflings-regular.woff -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/trailing_para.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Paragraph above" 4 | ], 5 | ["pre", 6 | ["code", 7 | "Code block" 8 | ] 9 | ], 10 | ["p", 11 | "Paragraph below" 12 | ] 13 | ] 14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/ref_with_image_ref.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | {"href": "http://link_url"}, 5 | ["img", 6 | {"src": "http://image_url", "alt": "alt text"} 7 | ] 8 | ] 9 | ] 10 | ] -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/lazy_wrapping.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | ["li", 4 | "If you're too\nlazy to wrap your" 5 | ], 6 | ["li", 7 | "Lists nicely, this\nwill still work" 8 | ] 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Inline_HTML_comments.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Paragraph one."], "\u000a\u000a", "\u000a\u000a", "\u000a\u000a", ["p", "Paragraph two."], "\u000a\u000a", "\u000a\u000a", ["p", "The end."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_Spans.xhtml: -------------------------------------------------------------------------------- 1 |

From <!-- to --> 2 | on two lines.

3 | 4 |

From <!-- 5 | to --> 6 | on three lines.

7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_block_in_a_list_item.html: -------------------------------------------------------------------------------- 1 |
    2 |
  • List Item:

    3 | 4 |
    code block
     5 | 
     6 | 
     7 | with a blank line
     8 | 
    9 | 10 |

    within a list item.

  • 11 |
-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_block_in_a_list_item.json: -------------------------------------------------------------------------------- 1 | ["html", ["ul", ["li", ["p", "List Item:"], 2 | ["pre", ["code", "code block\u000a\u000a\u000awith a blank line\u000a"]], 3 | ["p", "within a list item."]]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_block_with_tabs.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Test with tabs for ", ["code", "_Detab"], ":"], 2 | ["pre", ["code", "Code 'block' with some \"tabs\" and \"quotes\"\u000a"]]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_tail_vars.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This sentence talks about the Python __init__ method, which I'd rather not be\u000ainterpreted as Markdown's strong."], "\u000a\u000a", "\u000a"] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emphasis.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is ", ["em", "italic"], " and this is ", ["strong", "bold"], ".\u000aThis is also ", ["em", "italic"], " and this is ", ["strong", "bold"], "."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_edge_cases.opts: -------------------------------------------------------------------------------- 1 | {"extras": ["link-patterns"], 2 | "link_patterns": [ 3 | (re.compile("Blah\s+(\d+)", re.I), r"http://foo.com/blah_blah_blah/\1"), 4 | ], 5 | } 6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/layout/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing classes to represent layouts. 2 | """ 3 | 4 | from __future__ import absolute_import 5 | from __future__ import division 6 | from __future__ import print_function 7 | from __future__ import unicode_literals 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/block.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Here is an example of AppleScript:" 4 | ], 5 | ["pre", 6 | ["code", 7 | "tell application \"Foo\"\n beep\nend tell\n\ttab" 8 | ] 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_url.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "URLs like ", 4 | ["a", 5 | { "href" : "http://google.com" }, 6 | "http://google.com" 7 | ], 8 | " get autolinkified." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_inline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | { "href": "/url(test)", 5 | "title": "title" }, 6 | "Inline link" 7 | ], 8 | " with non-escaped parens." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/multiline_inline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | ["li", 4 | "List items can have ", 5 | [ "em", "inline content\nthat spans multiple lines" ], 6 | ". Pain" 7 | ] 8 | ] 9 | ] 10 | 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Code_Spans.text: -------------------------------------------------------------------------------- 1 | `` 2 | 3 | Fix for backticks within HTML tag: like this 4 | 5 | Here's how you put `` `backticks` `` in a code span. -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_comments.text: -------------------------------------------------------------------------------- 1 | Paragraph one. 2 | 3 | 4 | 5 | Paragraph two. 6 | 7 | 8 | 9 | The end. 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_multiline_bugs_2.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | Bla, bla, bla, bla, bla, bla, bla, bla, bla, bla bla. This is [my 4 | University][]. 5 | 6 | [my university]: http://www.ua.es 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/headers.text: -------------------------------------------------------------------------------- 1 | A title with *emphasis* 2 | ======================= 3 | 4 | A title with *emphasis* 5 | ----------------------- 6 | 7 | 8 | #### A title with *emphasis* #### 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hex_entities.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Examples of numeric character references include © or © for the copyright symbol, Α or Α for the Greek capital letter alpha, and ا or ا for the Arabic letter alef."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists9.html: -------------------------------------------------------------------------------- 1 |
    2 |
  • 3 |

    Due

    4 | 5 |
      6 |
    1. tre
    2. 7 | 8 |
    3. tre
    4. 9 | 10 |
    5. tre
    6. 11 |
    12 |
  • 13 | 14 |
  • 15 |

    Due

    16 |
  • 17 |
18 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Code_Spans.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "From ", ["code", ""], "\u000aon two lines."], 2 | ["p", "From ", ["code", ""], "\u000aon three lines."]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Inline_HTML_comments.html: -------------------------------------------------------------------------------- 1 |

Paragraph one.

2 | 3 | 4 | 5 |

Paragraph two.

6 | 7 | 8 | 9 |

The end.

10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns.html: -------------------------------------------------------------------------------- 1 |

Recipe 123 and Komodo bug 234 are related.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/components/plaintext/plaintext.css: -------------------------------------------------------------------------------- 1 | .plaintext .readonly .CodeMirror { 2 | background: none; 3 | border: none; 4 | } 5 | 6 | .plaintext .readonly .CodeMirror-lines { 7 | background: none; 8 | border: none; 9 | cursor: default; 10 | } 11 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/preprocessing_visitors/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing visitors for Pre-AST trees.""" 2 | 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/lazy_wrapping.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["blockquote", 3 | ["p", 4 | "If you're too lazy\nto wrap your code nicely" 5 | ], 6 | ["p", 7 | "This will still work" 8 | ] 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_escaped_inline.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | { "href": "/url(test)", 5 | "title": "title" }, 6 | "Inline link" 7 | ], 8 | " with escaped parens." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/parens_reference.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | { "href": "/url(test)", 5 | "title": "title" }, 6 | "Reference link" 7 | ], 8 | " with non-escaped parens." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/list.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | { "id" : "list" }, 4 | ["li", 5 | "here's a\nloose list" 6 | ], 7 | ["li", 8 | "it might confuse the\nblock_meta routine" 9 | ] 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_block_in_a_list_item.json: -------------------------------------------------------------------------------- 1 | ["html", ["ul", ["li", ["p", "List Item:"], 2 | ["pre", ["code", "code block\u000a\u000awith a blank line\u000a"]], 3 | ["p", "within a list item."]]]] 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_(Span).text: -------------------------------------------------------------------------------- 1 | ACINACS 2 | 3 | SB 4 | SB -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Emphasis.text: -------------------------------------------------------------------------------- 1 | _M*A*S*H_ here I am going with original Markdown.. 2 | 3 | foo_bar_bas I am going with PHP Markdown Extra here (by default, there is an option for original style behavior - see 4 | docs).. 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown-todo/Inline_HTML_(Span).html: -------------------------------------------------------------------------------- 1 |

ACINACS

2 | 3 |

SB 4 | SB

-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/code_safe_emphasis.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is ", ["em", "italic"], " and this is ", ["strong", "bold"], ".\u000aThis is NOT _italic_ and this is __bold__ because --code-safe is turned on."]] 2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_head_vars.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | This sentence talks about the Python __init__ method, which I'd rather not be 4 | interpreted as Markdown's strong. 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/ref_links.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "http://www.google.com/" 3 | }, 4 | "Google"], " is fast ", ["img", { 5 | "src": "/img/star.png", 6 | "alt": "star" 7 | }], "."]] 8 | -------------------------------------------------------------------------------- /subversion_techniques/mas_remapping_and_pte_subversions/linux/user_space_tool/mal-proc.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | void malicious_print() { 4 | printf("The malicious action .....\n"); 5 | } 6 | 7 | void malicious_print2() { 8 | printf("The second malicious action.....\n"); 9 | } 10 | 11 | 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/images/inside_link.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | ["a", 4 | { "href": "https://link-url" }, 5 | ["img", { 6 | "alt": "alt", 7 | "src": "https://img-url" 8 | } ] 9 | ] 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/reference_with_space.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "A ", 4 | ["a", 5 | { "href" : "http://reference.com" }, 6 | "link using a reference" 7 | ], 8 | " separated by a space." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Literal_quotes_in_titles.xhtml: -------------------------------------------------------------------------------- 1 |

Foo bar.

2 | 3 |

Foo bar.

4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_block_in_a_list_item.xhtml: -------------------------------------------------------------------------------- 1 |
    2 |
  • List Item:

    3 | 4 |
    code block
     5 | 
     6 | with a blank line
     7 | 
    8 | 9 |

    within a list item.

  • 10 |
-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_brackets.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "http://en.wikipedia.org/wiki/ZIP_(file_format)", 3 | "title": "ZIP (file format) - Wikipedia, the free encyclopedia" 4 | }, 5 | "ZIP archives"]]] 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/blockquote.html: -------------------------------------------------------------------------------- 1 |

[Trent wrote]

2 | 3 |
4 |

no way

5 |
6 | 7 |

[Jeff wrote]

8 | 9 |
10 |

way

11 |
12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/blockquote_with_pre.text: -------------------------------------------------------------------------------- 1 | > Markdown indents blockquotes a couple of spaces 2 | > necessitating some tweaks for pre-blocks in that 3 | > blockquote: 4 | > 5 | > here is a check 6 | > for that 7 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/common/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing common classes and utils used by the project. 2 | """ 3 | 4 | from __future__ import absolute_import 5 | from __future__ import division 6 | from __future__ import print_function 7 | from __future__ import unicode_literals 8 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/preprocessing_parser/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing a parser for unpreprocessed C headers.""" 2 | 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/serialization/__init__.py: -------------------------------------------------------------------------------- 1 | """This module provides serialization for data.Data subclasses. 2 | """ 3 | 4 | from __future__ import absolute_import 5 | from __future__ import division 6 | from __future__ import print_function 7 | from __future__ import unicode_literals 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/plugins/markdown.py: -------------------------------------------------------------------------------- 1 | from manuskript import plugin 2 | 3 | 4 | class Markdown(plugin.Plugin): 5 | ANGULAR_MODULE = "manuskript.markdown" 6 | 7 | JS_FILES = ["/static/components/markdown/markdown-controller.js", 8 | "/static/components/markdown/markdown.js"] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/spaces_tolerance.text: -------------------------------------------------------------------------------- 1 | This is a table (look out, less than 4 spaces 2 | before headers and rule). 3 | 4 | Header | Header 5 | -------- | -------- 6 | 1 | 2 7 | 3 | 4 8 | 9 | Yeah, right. 10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Code_Spans.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "From ", ["code", ""], "\u000aon two lines."], 2 | ["p", "From ", ["code", ""], "\u000aon three lines."]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/code3.text: -------------------------------------------------------------------------------- 1 | 2 | This is code (4 spaces): 3 | 4 | Code 5 | This is not code 6 | 7 | Code 8 | 9 | This is code (1 tab): 10 | 11 | Code 12 | This is not code 13 | 14 | Code 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html4.html: -------------------------------------------------------------------------------- 1 |
2 | 3 |
4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list4.text: -------------------------------------------------------------------------------- 1 | This is a list: 2 | * one 3 | * two 4 | 5 | This is not a list: 6 | * one 7 | ciao 8 | 9 | This is a list: 10 | 1. one 11 | 1. two 12 | 13 | This is not a list: 14 | 1987. one 15 | ciao 16 | 17 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/xml_instruction.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Targets 8 | 9 | Inside: last 10 | 11 | 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Backslash_escapes.html: -------------------------------------------------------------------------------- 1 |

Tricky combinaisons:

2 | 3 |

backslash with \-- two dashes

4 | 5 |

backslash with \> greater than

6 | 7 |

\[test](not a link)

8 | 9 |

\*no emphasis*

10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_head_vars.html: -------------------------------------------------------------------------------- 1 | 2 | 3 |

This sentence talks about the Python __init__ method, which I'd rather not be 4 | interpreted as Markdown's strong.

5 | -------------------------------------------------------------------------------- /rekall_framework/tools/installers/README: -------------------------------------------------------------------------------- 1 | Building packages for various operating systems. 2 | ================================================ 3 | 4 | 5 | Debian 6 | ------ 7 | 8 | For linux we ship virtualenv packages: 9 | 10 | apt-get install libncurses5-dev 11 | 12 | 1. cd rekall 13 | 2. dpkg-buildpackage 14 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/builtins/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing definitions of compiler builtin types and functions. 2 | """ 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/config_parser/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing a parser for parsing Linux kernel .config files.""" 2 | 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/inline_with_title.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "An ", 4 | ["a", 5 | { "href" : "http://inline.com", 6 | "title" : "le title" }, 7 | "inline link" 8 | ], 9 | " with a title." 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/missing_references.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Link with [missing][id] reference" 4 | ], 5 | ["p", 6 | "Link with [empty][] reference" 7 | ], 8 | ["p", 9 | "Link with [inferred] reference" 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_(Span).xhtml: -------------------------------------------------------------------------------- 1 |

ACINACS

2 | 3 |

SB 4 | SB

-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_comments.html: -------------------------------------------------------------------------------- 1 |

Paragraph one.

2 | 3 | 4 | 5 |

Paragraph two.

6 | 7 | 8 | 9 |

The end.

10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/CoreDumps5.8.xhtml: -------------------------------------------------------------------------------- 1 |
    2 |
  • Unordered 3 |
      4 |
    1. Ordered
    2. 5 |
  • 6 |
7 | 8 |

Text

9 | 10 |
    11 |
  • Unordered 12 |
      13 |
    1. Ordered
    2. 14 |
  • 15 |
16 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hex_entities.html: -------------------------------------------------------------------------------- 1 |

Examples of numeric character references include © or © for the copyright symbol, Α or Α for the Greek capital letter alpha, and ا or ا for the Arabic letter alef.

2 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Tight_blocks.text: -------------------------------------------------------------------------------- 1 | Paragraph and no space: * ciao Paragraph and 1 space: * ciao Paragraph and 3 spaces: * ciao Paragraph and 4 spaces: * ciao Paragraph before header: #Header Paragraph before blockquote: >Some quote. -------------------------------------------------------------------------------- /rekall_framework/tools/layout_expert/layout_expert/preprocessing_loader/__init__.py: -------------------------------------------------------------------------------- 1 | """A module containing an include following loader for C header files.""" 2 | 3 | from __future__ import absolute_import 4 | from __future__ import division 5 | from __future__ import print_function 6 | from __future__ import unicode_literals 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/blockquotes/nested.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["blockquote", 3 | ["p", 4 | "One" 5 | ], 6 | ["blockquote", 7 | ["p", 8 | "Two" 9 | ] 10 | ], 11 | ["p", 12 | "Three" 13 | ] 14 | ] 15 | ] 16 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/tables/inline_formatting.text: -------------------------------------------------------------------------------- 1 | | Function name | Description | 2 | | ------------- | ------------------------------ | 3 | | `help()` | Display the help window. | 4 | | `destroy()` | **Destroy your computer!** | 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Emphasis.xhtml: -------------------------------------------------------------------------------- 1 |

M*A*S*H here I am going with original Markdown..

2 | 3 |

foo_bar_bas I am going with PHP Markdown Extra here (by default, there is an option for original style behavior - see 4 | docs)..

5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/extra_dl.text: -------------------------------------------------------------------------------- 1 | CSS: style.css 2 | 3 | 4 | Apple 5 | : Pomaceous fruit of plants of the genus Malus in 6 | the family Rosaceae. 7 | 8 | Orange 9 | : The fruit of an evergreen tree of the genus Citrus. 10 | 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/hex_entities.text: -------------------------------------------------------------------------------- 1 | Examples of numeric character references include © or © for the copyright symbol, Α or Α for the Greek capital letter alpha, and ا or ا for the Arabic letter alef. 2 | 3 | 4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/jquery/src/attributes.js: -------------------------------------------------------------------------------- 1 | define([ 2 | "./core", 3 | "./attributes/attr", 4 | "./attributes/prop", 5 | "./attributes/classes", 6 | "./attributes/val" 7 | ], function( jQuery ) { 8 | 9 | // Return jQuery for attributes-only inclusion 10 | return jQuery; 11 | }); 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/in_lists.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["ul", 3 | ["li", 4 | ["p", 5 | "Loose list" 6 | ], 7 | ["pre", 8 | ["code", 9 | "some code\n\nmore code" 10 | ] 11 | ] 12 | ] 13 | ] 14 | ] 15 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/autolink_email.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Email addresses written like ", 4 | ["a", 5 | { "href" : "mailto:bill@microsoft.com" }, 6 | "bill@microsoft.com" 7 | ], 8 | " get autolinkified." 9 | ] 10 | ] 11 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/lists/loose.text: -------------------------------------------------------------------------------- 1 | * the quick brown fox jumps 2 | over the lazy dog 3 | 4 | * pack my box with five 5 | dozen liquor jugs 6 | 7 | this item has a 8 | second paragraph 9 | 10 | * this item has 11 | only one paragraph 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Blockquotes_with_code_blocks.text: -------------------------------------------------------------------------------- 1 | > Example: 2 | > 3 | > sub status { 4 | > print "working"; 5 | > } 6 | > 7 | > Or: 8 | > 9 | > sub status { 10 | > return "working"; 11 | > } 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/headers.html: -------------------------------------------------------------------------------- 1 |

A title with emphasis

2 | 3 |

A title with emphasis

4 | 5 |

A title with emphasis

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Backslash_escapes.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Tricky combinaisons:"], 2 | ["p", "backslash with \\-- two dashes"], 3 | ["p", "backslash with \\> greater than"], 4 | ["p", "\\[test](not a link)"], 5 | ["p", "\\*no emphasis*"]] 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Inline_HTML_(Simple).text: -------------------------------------------------------------------------------- 1 | With some attributes: 2 | 3 |
4 | foo 5 |
6 | 7 |
9 | foo 10 |
11 | 12 | Hr's: 13 | 14 |
16 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/link_patterns_double_hit.html: -------------------------------------------------------------------------------- 1 |

There once was a Mozilla bug 123 and a Komodo bug 123.

2 | -------------------------------------------------------------------------------- /rekall_framework/osx/Rekall/Rekall/main.m: -------------------------------------------------------------------------------- 1 | // 2 | // main.m 3 | // Rekall 4 | // 5 | // Created by Adam Sindelar on 5/8/14. 6 | // Copyright (c) 2014 Rekall. All rights reserved. 7 | // 8 | 9 | #import 10 | 11 | int main(int argc, const char * argv[]) 12 | { 13 | return NSApplicationMain(argc, argv); 14 | } 15 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/meta/multiple_classes.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | { "class" : "foo bar" }, 4 | "Here's a paragraph and\nan ", 5 | ["em", 6 | { "class" : "foo bar" }, 7 | "em" 8 | ], 9 | "\nwith multiple classes" 10 | ] 11 | ] 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Tight_blocks.text: -------------------------------------------------------------------------------- 1 | Paragraph and no space: * ciao Paragraph and 1 space: * ciao Paragraph and 3 spaces: * ciao Paragraph and 4 spaces: * ciao Paragraph before header: #Header Paragraph before blockquote: >Some quote. -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/abbreviations.html: -------------------------------------------------------------------------------- 1 |

The HTML specification is maintained by the W3C.

2 | 3 |

Operation Tigra Genesis is going well.

4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/images2.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "This is an ", ["img", { 2 | "src": "image.jpg", 3 | "alt": "image" 4 | }], "."], 5 | ["p", "This is an ", ["img", { 6 | "src": "image.jpg", 7 | "alt": "image" 8 | }], "."]] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/table_attributes.text: -------------------------------------------------------------------------------- 1 | 2 | h | h 3 | ----------|-- 4 | {:t} c1 | c2 5 | {: summary="Table summary" .class1 style="color:red" border=3 width="50%" frame=lhs rules=cols cellspacing=2em cellpadding=4px} 6 | 7 | {:t: scope="row"} 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Emphasis.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["em", "M*A*S*H"], " here I am going with original Markdown.."], 2 | ["p", "foo_bar_bas I am going with PHP Markdown Extra here (by default, there is an option for original style behavior - see\u000adocs).."]] 3 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_multiline_bugs_1.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", ["a", { 2 | "href": "http://bugs.debian.org/459885" 3 | }, 4 | "http://bugs.debian.org/459885"]], 5 | ["p", ["a", { 6 | "href": "/someurl/" 7 | }, 8 | "link \u000atext"]]] 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/extra_dl.html: -------------------------------------------------------------------------------- 1 |
2 |
Apple
3 | 4 |
Pomaceous fruit of plants of the genus Malus in the family Rosaceae.
5 | 6 |
Orange
7 | 8 |
The fruit of an evergreen tree of the genus Citrus.
9 |
10 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/extra_dl.json: -------------------------------------------------------------------------------- 1 | ["html", ["dl", ["dt", "Apple"], 2 | ["dd", "Pomaceous fruit of plants of the genus Malus in the family Rosaceae."], 3 | ["dt", "Orange"], 4 | ["dd", "The fruit of an evergreen tree of the genus Citrus."]], "\u000a"] 5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html4.text: -------------------------------------------------------------------------------- 1 |
2 | 5 |
6 | 7 | 8 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/issue2_safe_mode_borks_markup.html: -------------------------------------------------------------------------------- 1 |

Heading 2

2 | 3 |

blah [HTML_REMOVED]alert('this should be removed')[HTML_REMOVED] blah

4 | 5 |

[HTML_REMOVED]alert('as should this')[HTML_REMOVED]

6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/lists.html: -------------------------------------------------------------------------------- 1 |

count:

2 | 3 |
    4 |
  • one
  • 5 |
  • two
  • 6 |
  • three
  • 7 |
8 | 9 |

count in spanish:

10 | 11 |
    12 |
  1. uno
  2. 13 |
  3. dos
  4. 14 |
  5. tres
  6. 15 |
16 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/Links_multiline_bugs_2.html: -------------------------------------------------------------------------------- 1 |

http://bugs.debian.org/459885

2 | 3 |

Bla, bla, bla, bla, bla, bla, bla, bla, bla, bla bla. This is my
4 | University
.

5 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Text-Markdown.mdtest/PHP-ASP_tags.text: -------------------------------------------------------------------------------- 1 | I am going with the same as Markdown.pl 1.0.2b8 here. *However* I reserve the right to also leave Template toolkit alone at a later date if I need to.. 2 | 3 | <%foo ok %> 4 | 5 | 6 | 7 | [% template_toolkit %] -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-php-markdown/Inline_HTML_(Simple).html: -------------------------------------------------------------------------------- 1 |

With some attributes:

2 | 3 |
4 | foo 5 |
6 | 7 |
9 | foo 10 |
11 | 12 |

Hr's:

13 | 14 |
-------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_tail_vars.text: -------------------------------------------------------------------------------- 1 | This sentence talks about the Python __init__ method, which I'd rather not be 2 | interpreted as Markdown's strong. 3 | 4 | 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/code/blank_lines.text: -------------------------------------------------------------------------------- 1 | This block is composed of three lines: 2 | 3 | one 4 | 5 | three 6 | 7 | This block is composed of 5 8 | 9 | 10 | one 11 | 12 | 13 | four 14 | 15 | 16 | This block is composed of 2 17 | 18 | 19 | two 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/headers/atx.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["h1", 3 | "One" 4 | ], 5 | ["h2", 6 | "Two" 7 | ], 8 | ["h3", 9 | "Three" 10 | ], 11 | ["h4", 12 | "Four" 13 | ], 14 | ["h5", 15 | "Five" 16 | ], 17 | ["h6", 18 | "Six" 19 | ] 20 | ] 21 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Backslash_escapes.json: -------------------------------------------------------------------------------- 1 | ["html", ["p", "Tricky combinaisons:"], 2 | ["p", "backslash with \\-- two dashes"], 3 | ["p", "backslash with \\> greater than"], 4 | ["p", "\\[test](not a link)"], 5 | ["p", "\\*no emphasis*"]] 6 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_(Simple).text: -------------------------------------------------------------------------------- 1 | With some attributes: 2 | 3 |
4 | foo 5 |
6 | 7 |
9 | foo 10 |
11 | 12 | Hr's: 13 | 14 |
16 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/html5.html: -------------------------------------------------------------------------------- 1 |
2 | Aperitif 3 |
4 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/list2.text: -------------------------------------------------------------------------------- 1 | * This is a list item with two paragraphs. 2 | 3 | This is the second paragraph in the list item. You're 4 | only required to indent the first line. Lorem ipsum dolor 5 | sit amet, consectetuer adipiscing elit. 6 | 7 | * other 8 | 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/lists8.html: -------------------------------------------------------------------------------- 1 |

Here is a paragraph.

2 | 3 |
    4 |
  • Item 1
  • 5 | 6 |
  • Item 2
  • 7 | 8 |
  • Item 3
  • 9 |
10 | -----| WARNING | ----- 11 |

Here is a paragraph.

12 | 13 |

* Item 1 * Item 2 * Item 3

14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/syntax_hl.text: -------------------------------------------------------------------------------- 1 | This is ruby code: 2 | 3 | require 'maruku' 4 | 5 | puts Maruku.new($stdin).to_html 6 | 7 | This is ruby code: 8 | 9 | require 'maruku' 10 | {: lang=ruby html_use_syntax} 11 | 12 | puts Maruku.new($stdin).to_html 13 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/emacs_tail_vars.html: -------------------------------------------------------------------------------- 1 |

This sentence talks about the Python __init__ method, which I'd rather not be 2 | interpreted as Markdown's strong.

3 | 4 | 9 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-pythonmarkdown2-tm-cases-pass/footnotes_safe_mode_escape.text: -------------------------------------------------------------------------------- 1 | This is a para with a footnote.[^1] 2 | 3 | [^1]: Here is the body of the footnote. 4 | 5 |
And here is the second para of the footnote.
6 | 7 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/horizontal_rules/abutting_blocks.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "para" 4 | ], 5 | ["hr"], 6 | ["ul", 7 | ["li", 8 | "list" 9 | ] 10 | ], 11 | ["hr"], 12 | ["blockquote", 13 | ["p", 14 | "blockquote" 15 | ] 16 | ] 17 | ] 18 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/features/links/ref_reuse.json: -------------------------------------------------------------------------------- 1 | ["html", 2 | ["p", 3 | "Two ", 4 | ["a", 5 | { "href" : "http://google.com" }, 6 | "links" 7 | ], 8 | ", one ", 9 | ["a", 10 | { "href" : "http://google.com" }, 11 | "ref" 12 | ] 13 | ] 14 | ] 15 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/MD5_Hashes.text: -------------------------------------------------------------------------------- 1 | # Character Escapes 2 | 3 | The MD5 value for `+` is "26b17225b626fb9238849fd60eabdf60". 4 | 5 | # HTML Blocks 6 | 7 |

test

8 | 9 | The MD5 value for `

test

` is: 10 | 11 | 6205333b793f34273d75379350b36826 -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/abbreviations.text: -------------------------------------------------------------------------------- 1 | 2 | The HTML specification is maintained by the W3C. 3 | 4 | *[HTML]: Hyper Text Markup Language 5 | *[W3C]: World Wide Web Consortium 6 | 7 | 8 | 9 | Operation Tigra Genesis is going well. 10 | 11 | *[Tigra Genesis]: 12 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/docs-maruku-unittest/bug_table.text: -------------------------------------------------------------------------------- 1 | 2 | 3 | hello 4 | {: summary="Table summary" .class1 style="color:red"} 5 | 6 | h | h 7 | ----------|-- 8 | {:t} c1 | c2 9 | {: summary="Table summary" .class1 style="color:red"} 10 | 11 | 12 | 13 | {:t: scope="row"} 14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/Markdown-from-MDTest1.1.mdtest/Inline_HTML_comments.text: -------------------------------------------------------------------------------- 1 | Paragraph one. 2 | 3 | 4 | 5 | 8 | 9 | Paragraph two. 10 | 11 | 12 | 13 | The end. 14 | -------------------------------------------------------------------------------- /rekall_framework/rekall-gui/manuskript/static/bower_components/markdown/test/fixtures/PHP_Markdown-from-MDTest1.1.mdtest/Inline_HTML_(Simple).html: -------------------------------------------------------------------------------- 1 |

With some attributes:

2 | 3 |
4 | foo 5 |
6 | 7 |
9 | foo 10 |
11 | 12 |

Hr's:

13 | 14 |
--------------------------------------------------------------------------------