Mike Auty
83a8afba6b
Objects: Simplify get_symbol_table to get_symbol_table_name.
2019-12-04 23:41:27 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Mike Auty
1eea645da0
EPROCESS: Wrap get_peb functions in error handlers
2019-12-04 21:13:19 +00:00
Mike Auty
17247426d8
pdbconv: Avoid more name-collisions
...
Previously we allow name-collisions for types with name <anonymouos-tag>
so this has now been resolved, as well as descending too deeply down the
type to tree determine the size of array occassionally.
2019-12-04 20:04:22 +00:00
xabiugarte and ikelos
35abb343da
Raise exception instead of return None
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
3545ab7746
Fixes on pydoc, types, exception catching
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
c9520dc37f
Remove extra line
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
11d3d304ba
Refactor get_peb functionality in EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
a6944f7a06
Add InitOrder and MemOrder functions to EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
949a2a2ddc
Change unsigned long long by pointer
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
8da9d90c19
Small fix on EPROCESS is_valid
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
1123ed074d
Tiny fix in EPROCESS.is_valid
2019-12-02 13:07:04 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
06c4a6dcc7
pdbconv: Swap the suffix ordering to make the less common option second.
2019-11-20 20:04:14 +00:00
Mike Auty
9928b40afb
pdbconv: ResourceAccessor now logs the written file
2019-11-20 20:04:14 +00:00
Mike Auty
cb41c5e960
Pdbconv: Switch pdb downloading to resource accessing
2019-11-20 20:04:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
ce2b83fc34
Add in support for sizing LF_ARGLISTs. Fixes issue #99 .
2019-10-23 00:09:45 +01:00
atcuno
2cad54ea6b
Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages
2019-10-17 10:27:14 -04:00
Mike Auty
2229c50de8
Remove executable bit from data files.
2019-10-13 10:09:10 +01:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
ba14e10d00
pdbconv: Ensure voids do not have a size
...
This partially reverts e17427b9a0
2019-09-29 15:36:26 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Mike Auty
2acdc3e060
Fix up PADDING_INFO for very specific versions of windows.
2019-09-26 13:35:23 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
ee008cb76b
Make sure we accurately check the PADDING_INFO presence.
2019-09-25 21:32:53 +01:00
Mike Auty
2252876375
Correct the PADDING_INFO handling.
2019-09-25 21:32:53 +01:00
Mike Auty
5a8946da83
Shift the InfoMask stuff into the top-down approach.
2019-09-25 21:32:53 +01:00
Mike Auty
b0559656fc
Update the header offsets for the InfoMask.
2019-09-25 21:32:53 +01:00
Mike Auty
6a3a6cdb3c
Add this as more of an example of how to cache.
...
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache. It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
2019-09-25 21:32:53 +01:00
Mike Auty
0fd9bf2dbb
Try to shave some time from the poolscanner by Infomask checking.
2019-09-25 21:32:53 +01:00
Mike Auty
926288a7ac
Ensure process layer name contains the process ID.
2019-09-25 01:15:58 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Michael Ligh and ikelos
e71b72b3a7
add the windows callbacks plugin
2019-09-08 16:08:48 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
a3caf39097
Use a mapping to determine kind to class.
2019-08-31 12:57:53 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Dave Lassalle and ikelos
0e22eea58d
improved exception handling in registry and printkey
2019-08-13 20:37:46 +01:00
Mike Auty
196da74fdb
Fix up a manual typo (and remove trailing spaces).
2019-08-11 17:16:57 +01:00
Mike Auty
a412d3ef2f
Guard against list size returns.
2019-08-08 20:30:33 +01:00
Mike Auty
1120854350
Ensure we descend LF_MODIFIERs when finding forward referenced array sizes.
2019-08-08 17:15:25 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty