Mike Auty
fa552aa3b0
Add in the native_layer_name concept to ObjectInformation.
2018-09-12 22:45:34 +01:00
Mike Auty
dd5edc395a
Add in commented code for keeping the zip file in sync if we decide it's needed.
2018-09-03 22:14:48 +01:00
Mike Auty
abee0f8de7
Change the ASLR finding code to return no shift values (and log when it's found none).
2018-09-03 21:48:16 +01:00
Mike Auty
f584be8d18
Fix up the linux symbol caching code.
2018-09-03 21:39:48 +01:00
Mike Auty
0c46da22c3
Readd the check to ensure we don't stack on top of an existing Intel layer.
2018-09-02 19:03:39 +01:00
Mike Auty
7f966901cf
Ensure the dtb can't get specified from an earlier run around the loop.
2018-09-02 18:28:59 +01:00
Mike Auty
c1dc36a327
Fix up the breakage from the preivous commit.
2018-09-02 18:27:28 +01:00
Mike Auty
29f1a0f216
Change the default state for stacking to ensure layer isn't set unless successful.
2018-09-02 17:42:55 +01:00
Mike Auty
5668f271df
Fix issue when handling zip files on windows.
2018-09-02 00:13:33 +01:00
Mike Auty
dff7e6d6df
Add in support for specific symbol directories.
2018-09-01 21:57:49 +01:00
Mike Auty
5791cfaab7
Stop overriding the builtin filter method, and ensure suitable parameter names.
2018-08-30 11:41:19 +01:00
superponible and ikelos
26a4eb66d9
move import to the top
2018-08-30 10:57:18 +01:00
superponible and ikelos
f5e075ab72
change comment to docstring
2018-08-30 10:57:18 +01:00
superponible and ikelos
eb9a426760
switch enum.Enum to enum.IntEnum
2018-08-30 10:57:18 +01:00
Dave Lassalle and ikelos
c676f17fc8
refs #39 - update _CM_KEY_BODY.get_full_key_name()
2018-08-30 10:57:18 +01:00
Mike Auty
059be517fc
Fix up minor typing issues.
2018-08-29 23:29:00 +01:00
Mike Auty
3a6b4ad35c
Add in the has_member method for objects and templates.
2018-08-29 22:54:56 +01:00
Dave Lassalle and ikelos
c7e0ff9fa0
docstring and comment about get() vs _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
0d12a6dbf3
alternative to RegValueTypes enum in lieu of _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
32bcdf2ebc
add userassist types to registry.json
2018-08-29 21:51:52 +01:00
Mike Auty
ee38c9c4fe
Add in caching for the lengthy symbol sorting.
2018-08-23 17:29:16 +01:00
Mike Auty
b74eb68c04
Pull the check on layer names out so that DataLayerInterface types get it as well.
2018-08-22 09:33:47 +01:00
Mike Auty
981d333195
Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError.
2018-08-17 10:52:48 +01:00
Mike Auty
218567c228
Allow Context.module to create a SizedModule if a size is provided.
2018-08-09 14:53:21 +01:00
Mike Auty
0a55a7c3f2
Introduced SizedModules to simplify when we just don't care about the size.
2018-08-09 14:42:18 +01:00
Mike Auty
0f08432aa5
Refactor Symbol interface to SymbolInterface.
2018-08-09 14:28:08 +01:00
Mike Auty
366269deb2
Refactor Module in interfaces to ModuleInterface.
2018-08-09 13:55:16 +01:00
Mike Auty
9e4875009d
Move the horrendously slow no-module-size calculation to an on-demand calculation.
2018-08-09 13:39:07 +01:00
Mike Auty
99f8859549
It turns out that cloning native_templates was unnecessary or slow. Fix and document why clearly.
2018-08-09 12:49:51 +01:00
Mike Auty
19bdc367bf
Add in a new exception for when expected data structures cannot be found.
2018-08-08 21:26:25 +01:00
Mike Auty
e19ac82480
Improve generator documentation.
2018-08-05 16:26:27 +01:00
Mike Auty
d08c29ffab
Improve style to use default iterators rather than explicit ones.
2018-08-05 16:18:53 +01:00
Mike Auty
b1d46f843b
Convert documentation to napoleon/Google format docstrings.
2018-08-05 15:52:12 +01:00
Mike Auty
7fc19ef110
Updating typing information.
2018-08-05 15:02:11 +01:00
Mike Auty
eb08fb9e96
Convert the pdb scanner to use the kernel module names constants.
2018-08-04 12:34:18 +01:00
Mike Auty
105816beeb
Add in Windows specific constants for kernel modules (whose symbol tables are loaded by automagic).
2018-08-02 10:59:14 +01:00
Mike Auty
bca972f28a
Remove the python implementation of __getattribute__ for speed.
...
The __getattribute__ method is called for *all* attribute lookups, and
the python implementation is likely slow. The only function the python
implementation provided was to check that properties started with
helper_. Since this only provided a log message, we could add it back
in only if the log level is high enough? Either way, it's not
significant enough to warrant costing extra time in every attribute
lookup on every object.
2018-07-30 23:58:02 +01:00
Mike Auty
552101b593
Attempt to reduce the amount of time taken in calling templates.
2018-07-30 23:53:00 +01:00
Mike Auty
79d2bab44d
A few additional typing fixes.
2018-07-22 13:29:43 +01:00
Mike Auty
4897b7ab81
Fix up some typing errors.
2018-07-22 13:19:20 +01:00
Mike Auty
b6b4c44300
Ensure cross-platform support for linux_cache.
2018-07-22 11:55:10 +01:00
Mike Auty
2f3f291e53
Fix up missing parameter in symbol_space.
2018-07-19 09:54:56 +01:00
Mike Auty
2f28dfa6c9
Support finding symbols by ranges.
2018-07-19 09:51:51 +01:00
Mike Auty
083fd43890
Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset.
2018-07-19 09:22:57 +01:00
Mike Auty
3ba628da7a
Add in NotAvailableValue for specific uses.
2018-07-18 22:44:27 +01:00
Mike Auty
106a0cb6fd
Rework the array_of_pointers utility function.
...
It now makes use of the original array's symbol table to get the pointer
template, such that the size of the pointer is correct according to the
original table. Resolves "pointer.size" attribute errors (firing inside
a property and thus throwing off unusual exceptions).
2018-07-18 22:35:13 +01:00
Mike Auty
5c41e05876
Improve Module construction.
...
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.
We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
2018-07-18 21:46:56 +01:00
Mike Auty
cc5b470602
Remove the caching to see if it's causing the exceptions.
2018-07-18 21:08:50 +01:00
Mike Auty
ce05510413
Additional fixes for module collections.
2018-07-18 14:35:54 +01:00
Mike Auty
91e94440fe
Add in hashing for module differentiation and additional collection features.
2018-07-18 00:42:48 +01:00
Mike Auty