Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
066a4e64f2
Minor fix for construct_layers.
2019-09-26 21:16:46 +01:00
Mike Auty
ae010a2390
Improve log levels and distribution of messages.
2019-09-26 21:16:12 +01:00
Mike Auty
211ad0d524
Remove useless calls to validate.
2019-09-26 15:58:22 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
dad88692b8
Minor improvements for pyinstaller packages.
2019-09-21 21:06:05 +01:00
Mike Auty
fc2ee7e401
Improve plugin category detection for systems such as volshell.
2019-09-16 11:36:43 +01:00
Mike Auty
421af88c29
Classmethod make_subconfig so other classmethods can use it.
2019-09-08 14:50:48 +01:00
Mike Auty
10ea65a236
Remove unnecessary imports.
2019-09-08 14:19:58 +01:00
Mike Auty
ffc7682d61
Ensure that layers are automatically imported when needed.
2019-09-08 14:13:28 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty
398c583432
Ensure failed downloads are reported.
2019-07-30 22:14:19 +01:00
Mike Auty
6fc295410f
Support progress callbacks and improve pdb downloading.
2019-07-30 22:14:19 +01:00
Mike Auty
3bb113b0a7
Improve documentation and integration.
2019-07-30 22:14:19 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Andrew Case
bc6e63cb19
Mac - skip invaid kaslr shift results
2019-05-28 19:59:14 -05:00
Mike Auty
4cfde031f6
Additional typing fixes.
2019-05-11 22:57:06 +01:00
Mike Auty
a7160dd6b6
Move the PDB downloading code and test for file writability.
2019-04-27 21:06:25 +01:00
Mike Auty
7c16c403d5
Ensure we delete the temorary file even if things go wrong.
2019-04-23 22:43:16 +01:00
Mike Auty
9350f7b88a
Don't forget to cleanup.
2019-04-23 00:32:29 +01:00
Mike Auty
ac282d01fb
Add in initial support at automatic downloading.
2019-04-23 00:16:19 +01:00
Mike Auty
03eddbfb74
Fix missing imports removed by the rebase.
2019-02-26 22:25:15 +00:00
Andrew Case and ikelos
c9adc6a0fa
remove usage of old string methods
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
6d2a5fbfaa
add mac_netstat and supporting networking code
2019-02-26 22:20:33 +00:00
Mike Auty
4e8c8a7232
Fix issues with SymbolRequirement refactoring.
2019-02-11 22:30:22 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
b13fcb186c
Improve typing issues.
2019-01-03 01:13:53 +00:00
Mike Auty
19f908b075
Rejig pdbscan to find potential offsets then check them.
...
Originally we found physical offsets for pdbs that matched,
then found potential offsets and tested them against each other.
Now, we find the potential offsets and then look for pdbs at that offset
(technically within a 4Mb block after the start). The scanning is quick
(probably quicker than scanning the whole physical space) and should
catch most pdbs unless they're splayed out in virtual memory.
2019-01-01 01:14:34 +00:00
Mike Auty
afdd8b657e
Fix memory problems with banner_caches.
...
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required. As the cache builders are separate at the
moment, we previously ran banner searches without any banners. This was
bad. It inflated memory hugely and killed the buildbot.
We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Andrew Case and ikelos
731447000d
avoid use of _context in extension
2018-12-27 22:41:03 +00:00
Mike Auty
59d3f2b8ee
Clean up an unecessary import.
2018-12-25 16:48:15 +00:00
Mike Auty
4308245499
Revert "prevent double shifting of ASLR slides"
...
This reverts commit 2655fd1666
2018-12-20 15:40:53 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty