Commit Graph
316 Commits
Author SHA1 Message Date
Mike Auty 9e042ad1ce Ensure we use configured paths at import.
Previously if submodules were imported after the plugin/symbol __path__s had
been set, it would only use the __path__s from the constants module.

We now use the parent module's __path__s to ensure we get the right
sub__path__s.

This seems better/more flexible than changing the original constants
(since they'd no longer be constant) and allows people more chance to
override things.  It brings with it potential confusion as a local
plugin directory will need __init__ files with this magic to allow the
core modules to run (since they come first in the path list).
2019-11-04 19:42:24 +00:00
Mike Auty dd3e09f1e2 frameworkinfo: Make this a core plugin, not an optional extra. 2019-10-31 22:14:43 +00:00
Mike Auty 8a5196bc60 Add in framework information plugin to list vol components. 2019-10-31 22:14:43 +00:00
Mike Auty 2603c29ff7 Statistics: Record unexpected page errors. Fixes issue #102. 2019-10-24 20:59:12 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty f872aa3390 Revert "Add in no-dump option to certificates plugin."
Arg, too much mind changing.  This option would make sense if the
certificates plugin returned much useful information, but parsing
certificates isn't easy in with just stdlib, and therefore dumping the
certificates is the most sensible thing for this plugin to do (meaning
no need for a no-dump option).

This reverts commit 5491825652.
2019-09-17 16:59:50 +01:00
Mike Auty 444fd5451b Add in no-dump option to certificates plugin. 2019-09-17 16:59:50 +01:00
Mike Auty 83e113dad0 Revert "Provide a more user friendly filename."
As Dave pointed out in the pull request, "User" assumes only one user
and not multiple hives.

This reverts commit a802ecab86.
2019-09-17 16:59:50 +01:00
Mike Auty 1b953e3c80 Provide a more user friendly filename. 2019-09-17 16:59:50 +01:00
superponibleandikelos b6b2275c13 add hive_offset to crt filenames 2019-09-17 16:59:50 +01:00
superponibleandikelos 2e4a8c7247 add user level hives for certificates 2019-09-17 16:59:50 +01:00
superponibleandikelos 2053d957bc update docstring copied from printkey 2019-09-17 16:59:50 +01:00
Mike Auty c6cdbc7342 Move the hive_iterator to HiveList, since it's more intuitively where it should live. 2019-09-17 16:59:50 +01:00
Mike Auty 46c047b7b3 Update API slightly to return objects not strings. 2019-09-17 16:59:50 +01:00
Mike Auty f2220e16b9 Add in initial attempt at certificate plugin. 2019-09-17 16:59:50 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00
Mike Auty 9cde94bceb Change the license blurb on all files. 2019-08-27 23:11:00 +01:00
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Mike Auty 040da46deb Fix up the descriptions for non-simple requirements. 2019-01-03 00:39:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Andrew Caseandikelos ab877b3907 move plugins into proper directory 2018-12-19 19:43:56 +00:00
Mike Auty 2a3b7348be Add in minor changes and remove the duplicate plugins for mac. 2018-12-19 01:01:53 +00:00
Andrew Caseandikelos 7b3420f5b7 updated mac_psaux to report requirements correctly and remove stale debug print 2018-12-19 00:54:51 +00:00
Mike Auty 857c970125 Update typing to match master. 2018-12-19 00:54:51 +00:00
Mike Auty 1322ebd44f More minor cleanup. 2018-12-19 00:54:51 +00:00
Mike Auty c5ebf91915 Yapf reformat of the patches. 2018-12-19 00:54:51 +00:00
Andrew Caseandikelos 5ab483a0c3 add malfind plugin 2018-12-19 00:54:51 +00:00
Andrew Caseandikelos 002ced1b5d add mac_pslist 2018-12-19 00:54:51 +00:00
Andrew Caseandikelos e9ae7c45ce add mac_psaux plugin 2018-12-19 00:54:51 +00:00
Andrew Caseandikelos e2e2bf9758 Fix call to find_aslr 2018-12-19 00:54:51 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 4bf995059b Improve documentation for __init__ files. 2018-12-16 14:06:47 +00:00
Mike Auty 35ad2325a8 Move all core plugins over to framework/plugins.
This should have no impact functionality-wise.
The statistics plugin was left out a) as an example and b) because it
was committed by mistake in the first place and was never meant to be a
real plugin.
2018-12-16 13:40:15 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty 8c7cab163b Minor fixes from the monkeytype run. 2018-12-13 23:49:24 +00:00
Mike Auty dfe2f86fe2 Lots and lots of typing additions found by an initial monkeytype run. 2018-12-13 23:46:37 +00:00
Mike Auty 04c5007fbb Fix minor issue with the conversion change. 2018-12-13 21:38:20 +00:00
Mike Auty c0fcd15d4f Minor changes to various checks to be more pythonic. 2018-12-13 21:07:25 +00:00
Mike Auty a534ef216e Pycharm reformatting. 2018-12-13 21:07:25 +00:00
Andrew Caseandikelos 03d41c3f79 Add mac psaux plugin 2018-12-13 21:07:25 +00:00
Andrew Caseandikelos 622c86f9ed Add initial mac backend code, with broken DTB finding, along with the pslist plugin 2018-12-13 15:56:24 +00:00
Mike Auty a16fb3bf7d Don't break on validity tests. 2018-12-13 01:16:05 +00:00
Mike Auty 76264cee34 Catch invalid _OBJECT_HEADER objects. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 650a188d51 updates for win8/win10 poolscanning 2018-12-13 01:16:05 +00:00
Mike Auty fa033b8ab7 Back out the symbol_table_name parameter, and provide full symbol names in the constraints. 2018-12-13 01:16:05 +00:00
Mike Auty eacc45dab6 Ensure POOL_HEADER finds the right object in the right symbol table. 2018-12-13 01:16:05 +00:00
Michael Lighandikelos 4c68da8b06 move the functionality for getting an object's type into the _OBJECT_HEADER extension 2018-12-13 01:16:05 +00:00