Mike Auty
83a8afba6b
Objects: Simplify get_symbol_table to get_symbol_table_name.
2019-12-04 23:41:27 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Mike Auty
1eea645da0
EPROCESS: Wrap get_peb functions in error handlers
2019-12-04 21:13:19 +00:00
xabiugarte and ikelos
35abb343da
Raise exception instead of return None
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
3545ab7746
Fixes on pydoc, types, exception catching
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
c9520dc37f
Remove extra line
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
11d3d304ba
Refactor get_peb functionality in EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
a6944f7a06
Add InitOrder and MemOrder functions to EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
949a2a2ddc
Change unsigned long long by pointer
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
8da9d90c19
Small fix on EPROCESS is_valid
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
1123ed074d
Tiny fix in EPROCESS.is_valid
2019-12-02 13:07:04 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
atcuno
2cad54ea6b
Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages
2019-10-17 10:27:14 -04:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Mike Auty
2acdc3e060
Fix up PADDING_INFO for very specific versions of windows.
2019-09-26 13:35:23 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
ee008cb76b
Make sure we accurately check the PADDING_INFO presence.
2019-09-25 21:32:53 +01:00
Mike Auty
2252876375
Correct the PADDING_INFO handling.
2019-09-25 21:32:53 +01:00
Mike Auty
5a8946da83
Shift the InfoMask stuff into the top-down approach.
2019-09-25 21:32:53 +01:00
Mike Auty
b0559656fc
Update the header offsets for the InfoMask.
2019-09-25 21:32:53 +01:00
Mike Auty
6a3a6cdb3c
Add this as more of an example of how to cache.
...
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache. It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
2019-09-25 21:32:53 +01:00
Mike Auty
0fd9bf2dbb
Try to shave some time from the poolscanner by Infomask checking.
2019-09-25 21:32:53 +01:00
Mike Auty
926288a7ac
Ensure process layer name contains the process ID.
2019-09-25 01:15:58 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
a3caf39097
Use a mapping to determine kind to class.
2019-08-31 12:57:53 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Dave Lassalle and ikelos
0e22eea58d
improved exception handling in registry and printkey
2019-08-13 20:37:46 +01:00
Analyst and ikelos
6e4fa57421
move type_classes to dictionaries stored in their modules rather than separate classes (see 81d3293)
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e6ae049d18
add svcscan and associated types
2019-07-15 21:16:32 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
81d3293414
Move type_classes to dictionaries stored in their modules rather than separate tables.
2019-05-29 22:14:38 +01:00
Analyst
5120860a60
fix two bugs that prevented poolscanners from working on 2012 samples
...
in 2012, cookie is None and will raise TypeError, so we need to catch that in addition to AttributeError. also, the Session pointer is always in the native layer
2019-03-25 09:51:55 -05:00
Analyst
93e66381ad
use an alignmemt based on the cpu arch, not the pool header size
...
this fixes an issue with pool scanning on win10 32-bit samples, because the size of a pool header increased to 16 bytes, but we still want 8 byte alignment on 32-bit machines
2019-03-20 11:53:26 -05:00
Michael Ligh
2138152b10
fix a bug in psscan on xp images
...
we need to get the kvo using the native_layer_name rather than the layer_name
2019-03-19 11:14:10 -05:00
Mike Auty
372533b234
Improve registry subkey support (now recurses properly).
...
The old code didn't propertly recurse nodes beyond the first layer, and
also skipped entries in the top layer. Now we check the signature to
determine when/how to skip and we recurse down node lists that contain
further node lists.
2019-03-13 00:03:02 +00:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Mike Auty
7904be3fd2
Yapf reformat all files.
2019-03-04 22:11:44 +00:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
b1c3ecfa17
add mutantscan
2019-02-27 12:49:50 -06:00
Mike Auty