Commit Graph
63 Commits
Author SHA1 Message Date
Mike Auty d0a5d4ba3f layers: Ensure the new registry check doesn't throw an exception. 2019-11-12 09:09:51 +00:00
Mike Auty face38436e layers: Fix up uses of is_valid. 2019-11-12 09:09:51 +00:00
Mike Auty 679a0eabc2 Tidy Exceptions and ensure LayerExceptions are passed a layer name. 2019-09-26 15:44:36 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00
Mike Auty a3caf39097 Use a mapping to determine kind to class. 2019-08-31 12:57:53 +01:00
Mike Auty 9cde94bceb Change the license blurb on all files. 2019-08-27 23:11:00 +01:00
Mike Auty 42b2fb120a Swap TranslationLayerInterface decendents over to LinearMappedLayers 2019-08-27 21:09:13 +01:00
Mike Auty be27aab8ae Refactor symbol to object_type (so it doesn't shadow builtin type). 2019-08-14 20:50:42 +01:00
superponibleandikelos 95ac651f7e make get_maxaddr private and rename maxaddr variables for clarity 2019-08-13 20:37:46 +01:00
superponibleandikelos 317c1cdb7b store cmhive name instead of _cmhive 2019-08-13 20:37:46 +01:00
Dave Lassalleandikelos 60193b2a3f remove HBIN bounds check 2019-08-13 20:37:46 +01:00
Dave Lassalleandikelos 0e22eea58d improved exception handling in registry and printkey 2019-08-13 20:37:46 +01:00
Mike Auty f898dca296 Refactor SymbolRequirement to SymbolTableRequirement for clarity. 2019-02-06 21:26:32 +00:00
Mike Auty 6bb927ebfa Fix up terminology to ensure we only refer to layers not spaces. 2019-01-03 00:40:13 +00:00
Mike Auty 040da46deb Fix up the descriptions for non-simple requirements. 2019-01-03 00:39:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). 2018-09-20 16:14:57 +01:00
Mike Auty ac8401991c Convert all remaining plugins to use the new classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty ddeacd3524 Fix up my mistaken advice. 2018-06-16 09:56:10 +01:00
Dave Lassalleandikelos a0edd1e38e root_cell_offset changes seem to have fixed maxaddr problems 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos f2029d5657 add comment about registry key case sensitivity and re-work root_cell_offset 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos b85c143af9 yield UnreadableValues when key not found, and set default RootCell on exception 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 201fc5780a don't use BaseBlock.Length for maxaddr 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 0c3866ef77 make registry path comparison case insensitive 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos abfcdba524 add Windows 10 Registry process support 2018-06-04 20:17:28 +01:00
Mike Auty 7a52ac9deb Fix a large number of typing issues.
There are several instances where mypy didn't detect

if blah is not None:
    blah = thing

and so were rewritten as:

blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty 8bc5a4e898 Ensure maxaddr is never includes the volatile bit. 2018-05-23 19:41:13 +01:00
Mike Auty 347b4854ff Comment out the HBIN size check for now
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty 689756dc9a Deal with NULL base blocks in the registry code. 2018-05-20 23:25:20 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty 6402c94078 Rework IntermediateSymbolFile loading to a classmethod. 2018-04-12 15:15:25 +01:00
Mike Auty 6482059521 Fix up typing issues identified by mypy. 2018-03-22 00:44:49 +00:00
Mike Auty dd41ea1cd1 Improve registry docstrings. 2018-03-11 21:40:54 +00:00
Mike Auty 18fa9e74d7 Add in the capability for get_key to return full node_paths.
Also resolves issue #18.
2018-03-11 21:25:58 +00:00
Mike Auty d4ea03f51d Add in hive offsets to printkey output. 2018-03-09 01:00:48 +00:00
Mike Auty bc8429a2b0 Convert all helper_ properties to get_ methods. 2018-03-09 00:47:00 +00:00
Mike Auty ac12098317 Add type-annotations for reamining layer files. 2017-12-13 20:48:52 +00:00
Mike Auty b075d8c31c Standardize on nt_symbols for standard symboltable requirements.
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty 3a591688a6 Add in a little more information about signatures. 2017-11-11 15:34:06 +00:00
Mike Auty 35d47b0fb0 Improve checks for invalid values
We determine address_masks using log/ln2, which cannot accept 0.
Therefore we don't support address spaces with a maximum_address of 0.
This can affect registry hives, so we've added a check in registry hives
to prevent creating layers with invalid maximum_addresses.
2017-11-11 15:15:14 +00:00
Mike Auty 527ef44800 Make sure the cell boundaries are checked correctly. 2017-11-09 23:13:38 +00:00
Mike Auty 497f0f4950 Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements. 2017-11-08 11:40:17 +00:00
Mike Auty 2db214e2f8 Ensure we appropriately truncate unicode strings. 2017-11-08 01:00:53 +00:00
Mike Auty 01043b9f3e Rework isf_filename to isf_url since we can load it from a remote location if required. 2017-11-04 15:47:52 +00:00