Mike Auty
dd5edc395a
Add in commented code for keeping the zip file in sync if we decide it's needed.
2018-09-03 22:14:48 +01:00
Mike Auty
abee0f8de7
Change the ASLR finding code to return no shift values (and log when it's found none).
2018-09-03 21:48:16 +01:00
Mike Auty
f584be8d18
Fix up the linux symbol caching code.
2018-09-03 21:39:48 +01:00
Mike Auty
0c46da22c3
Readd the check to ensure we don't stack on top of an existing Intel layer.
2018-09-02 19:03:39 +01:00
Mike Auty
7f966901cf
Ensure the dtb can't get specified from an earlier run around the loop.
2018-09-02 18:28:59 +01:00
Mike Auty
c1dc36a327
Fix up the breakage from the preivous commit.
2018-09-02 18:27:28 +01:00
Mike Auty
29f1a0f216
Change the default state for stacking to ensure layer isn't set unless successful.
2018-09-02 17:42:55 +01:00
Mike Auty
5791cfaab7
Stop overriding the builtin filter method, and ensure suitable parameter names.
2018-08-30 11:41:19 +01:00
Mike Auty
3a6b4ad35c
Add in the has_member method for objects and templates.
2018-08-29 22:54:56 +01:00
Mike Auty
b1d46f843b
Convert documentation to napoleon/Google format docstrings.
2018-08-05 15:52:12 +01:00
Mike Auty
eb08fb9e96
Convert the pdb scanner to use the kernel module names constants.
2018-08-04 12:34:18 +01:00
Mike Auty
b6b4c44300
Ensure cross-platform support for linux_cache.
2018-07-22 11:55:10 +01:00
Mike Auty
ffa54c45eb
Fix linux invalid keyword argument bug.
2018-06-20 22:15:42 +01:00
Mike Auty
113c23a66d
Last of the typing fix-ups.
2018-06-04 23:55:38 +01:00
Mike Auty
a07691b04f
Ensure scanners don't return duplicates in the overlap.
2018-05-13 20:55:54 +01:00
Mike Auty
b9fbf272d1
Add support for filename requirements
...
At the moment these are no different than strings, but they allow us to
do things like add URI handlers to file names if no scheme is provided,
and eventually do file existence testing. This also allows the web URI
to allow uploads as a means of passing a file in.
The configuration will only store the filename, because otherwise
someone could add a huge file which would need to be carried around in
the config forever after. Handling file existence errors is up to the
UI after the volatility library returns a "file not found" type
exception.
2018-05-08 23:54:08 +01:00
Mike Auty
4dbfdcc9dd
Fix up typing and metadata usage.
2018-05-01 21:21:12 +01:00
Mike Auty
9512cbe9eb
Commit metadata changeset.
...
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers). Metadata can only be set at construction
time, and the metadata dictionary is readonly. The hope is this will
make enumerating metadata keys across the codebase simpler.
The current metadata items that layers hold is:
architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)
This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty
623180ddbd
Make many typing fixes, based on mypy-0.590.
2018-04-22 20:45:59 +01:00
Mike Auty
2e50cde2e7
Fix minor typing issues.
2018-04-11 20:50:11 +01:00
Mike Auty
5938254c3c
Add caching to the stack automagic in case it's reused.
2018-04-02 02:13:59 +01:00
Mike Auty
19236199b1
Refactor stacking and move the automagic location to a constant.
2018-04-02 02:09:56 +01:00
Mike Auty
154732126d
Refactor the automagic choosing code.
2018-03-25 18:15:43 +01:00
Mike Auty
c6a58ffc06
Fix up sphinx warnings.
2018-03-20 22:30:05 +00:00
Mike Auty
98624203c4
Add in windows swap-file automagic.
2018-02-11 18:35:40 +00:00
Mike Auty
f3b6b5311f
Fix up a couple extra typing issues, improving code quality.
2018-02-10 22:51:56 +00:00
Mike Auty
970cfc3cd8
Fix up pdbscan to avoid running if not needed.
2018-02-10 22:44:44 +00:00
Mike Auty
24be045266
Minor fix ups with typing and exceptions.
2018-02-10 22:42:31 +00:00
Mike Auty
5a85f88636
Improve construction automagic (it now continues recursing after errors).
2018-02-10 22:38:50 +00:00
Mike Auty
152dc9a210
Error check for when we can't find the file_symbol_url.
2018-02-07 19:56:02 +00:00
Mike Auty
e362c50460
Ensure we don't run through signatures when we've found one that gives a layer.
2017-12-13 20:48:52 +00:00
Mike Auty
265182b66b
Fix bug that massively broken the wintelstacker, slowing everything else down.
2017-12-13 20:48:52 +00:00
Mike Auty
e23bb65162
Add in better logging.
2017-12-13 20:48:52 +00:00
Mike Auty
f40fae197d
Convert to python3.5 syntax (no local type-annotations).
2017-12-13 20:48:52 +00:00
Mike Auty
6c52e04489
Fix up exception in DTBtests.
...
The exception was being caused by reading too little data from the
stream. We now skip it if that happens.
2017-12-13 20:48:52 +00:00
Mike Auty
de3b8cf76b
Fix exception being thrown in the middle of Nlpdtbfinder for layers without validity details.
2017-12-13 20:48:52 +00:00
Mike Auty
50b60c0df6
Add in more interfaces (and fix additional errors now that type information is available).
2017-12-13 20:48:52 +00:00
Mike Auty
2cc456e847
Finish off the automagic directory type annotations.
2017-12-13 20:48:52 +00:00
Mike Auty
d7d13eb19c
Add type annotations to most of the automagic files.
2017-12-13 20:48:52 +00:00
Mike Auty
30059766b6
Plug the WindowsMixin into the automagic.
2017-11-24 12:02:34 +00:00
Mike Auty
3a215c185e
Ensure the linux caching happens early, so the user doesn't have to run it twice.
2017-11-06 00:17:30 +00:00
Mike Auty
671f65ed56
Centralize the ISF locating code.
...
This might benefit from a recache of the linux banners, although it
should continue to work no recache is performed.
We're now in a position to add support for loading symbols directly from
zip files by altering the ResourceAccessor and adding code to the
symbol finder.
2017-11-05 15:18:20 +00:00
Mike Auty
fd582f62e2
Fix a potential exception when earlier automagics don't succeed.
2017-11-04 18:54:52 +00:00
Mike Auty
9d7d547667
Minor linting.
2017-11-04 18:45:18 +00:00
Mike Auty
a4b4a8eed3
Improve the error handling with automagics.
2017-11-04 18:45:08 +00:00
Mike Auty
8166b0cc96
Add better logging around the stacker.
2017-11-04 17:13:01 +00:00
Mike Auty
d9d67efa3a
Add in the capability to stash linux_banners.
...
Since the stacker and Linux automagic will always be different objects
(even if they're the same class), and we don't want to add OS specific
code to the stacker, this is the simplest way of allowing the Linux
symbol automagic to get information from the dtb finding stacker.
2017-11-04 17:09:59 +00:00
Mike Auty
dab5caf104
Paths from the banner cache are already URIs, so we don't need to reconvert them.
2017-11-04 15:52:02 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
4b7543f2f4
Unify the resource opening.
2017-11-02 21:46:39 +00:00
Mike Auty