WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-24 15:12:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,245 Commits 80 Branches 17 Tags
00a7f9ce2d2978f69e2095a56bf5afe50c3fed7f
Commit Graph
329 Commits
Author SHA1 Message Date
Mike Auty fa552aa3b0 Add in the native_layer_name concept to ObjectInformation. 2018-09-12 22:45:34 +01:00
Mike Auty 059be517fc Fix up minor typing issues. 2018-08-29 23:29:00 +01:00
Mike Auty 3a6b4ad35c Add in the has_member method for objects and templates. 2018-08-29 22:54:56 +01:00
Mike Auty ee38c9c4fe Add in caching for the lengthy symbol sorting. 2018-08-23 17:29:16 +01:00
Mike Auty b74eb68c04 Pull the check on layer names out so that DataLayerInterface types get it as well. 2018-08-22 09:33:47 +01:00
Mike Auty 981d333195 Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError. 2018-08-17 10:52:48 +01:00
Mike Auty 218567c228 Allow Context.module to create a SizedModule if a size is provided. 2018-08-09 14:53:21 +01:00
Mike Auty 0a55a7c3f2 Introduced SizedModules to simplify when we just don't care about the size. 2018-08-09 14:42:18 +01:00
Mike Auty 0f08432aa5 Refactor Symbol interface to SymbolInterface. 2018-08-09 14:28:08 +01:00
Mike Auty 366269deb2 Refactor Module in interfaces to ModuleInterface. 2018-08-09 13:55:16 +01:00
Mike Auty 9e4875009d Move the horrendously slow no-module-size calculation to an on-demand calculation. 2018-08-09 13:39:07 +01:00
Mike Auty b1d46f843b Convert documentation to napoleon/Google format docstrings. 2018-08-05 15:52:12 +01:00
Mike Auty 79d2bab44d A few additional typing fixes. 2018-07-22 13:29:43 +01:00
Mike Auty 4897b7ab81 Fix up some typing errors. 2018-07-22 13:19:20 +01:00
Mike Auty 2f28dfa6c9 Support finding symbols by ranges. 2018-07-19 09:51:51 +01:00
Mike Auty 5c41e05876 Improve Module construction. 
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.

We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
 2018-07-18 21:46:56 +01:00
Mike Auty ce05510413 Additional fixes for module collections. 2018-07-18 14:35:54 +01:00
Mike Auty 91e94440fe Add in hashing for module differentiation and additional collection features. 2018-07-18 00:42:48 +01:00
Mike Auty 5fbf923186 Fix documentation and try to guess the size where possible. 2018-07-17 21:15:09 +01:00
Mike Auty 8fd1196de7 Fix minor typo. 2018-06-25 00:22:00 +01:00
Mike Auty 9c06c25fae Add in support for module sizes. 2018-06-25 00:16:17 +01:00
Mike Auty c012842bd6 Refactor the name to be more accurate. 2018-06-21 00:27:38 +01:00
Mike Auty aedcf40fc2 Add support for separate symbol_tables and name in Modules. 2018-06-21 00:25:55 +01:00
Mike Auty c0ec52822b Add some typing fixes. 2018-06-16 14:19:36 +01:00
Mike Auty b228ad8e95 Add comment concerning reconstructability of SymbolTables. 2018-06-06 23:10:21 +01:00
Mike Auty 113c23a66d Last of the typing fix-ups. 2018-06-04 23:55:38 +01:00
Mike Auty 2dc3d2928d Fix more typing issues. 2018-06-04 23:28:26 +01:00
Mike Auty 7a52ac9deb Fix a large number of typing issues. 
There are several instances where mypy didn't detect

if blah is not None:
    blah = thing

and so were rewritten as:

blah = blah or thing
 2018-06-04 01:25:02 +01:00
Mike Auty f72e39d558 Fix up small but significant typo. 
When asking for data with padding, the padding was guaranteed to always
be at the end without spaces between pages.
 2018-05-29 00:42:52 +01:00
Mike Auty 67239002bc Attempt to fix an intel read issue spotted by imhlv2 
The length value inside the read method of the TranslationLayer base class
would potentially get overwritten by the inner loop which also defined a
length value.
 2018-05-28 23:25:49 +01:00
Mike Auty a5df5372f5 Add in table_mapping through the ISF classes. 2018-05-23 22:23:32 +01:00
Mike Auty 61bf1d40b0 Fix scan_iterator parameter type. 2018-05-15 00:06:43 +01:00
Mike Auty 037ac28534 Move around the scanning functions and create an API for the iterators. 2018-05-14 01:03:43 +01:00
Mike Auty a07691b04f Ensure scanners don't return duplicates in the overlap. 2018-05-13 20:55:54 +01:00
Mike Auty f23c4b51e4 Add in ModuleCollections for identifying symbols. 2018-05-07 00:05:01 +01:00
Mike Auty ffe2907fa0 Minor typing fix. 2018-05-01 21:22:26 +01:00
Mike Auty 4dbfdcc9dd Fix up typing and metadata usage. 2018-05-01 21:21:12 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset. 
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
 2018-04-26 12:48:14 +01:00
Mike Auty 556fa29ada Deprecate/remove 'provides' attribute. 2018-04-26 12:31:33 +01:00
Mike Auty 623180ddbd Make many typing fixes, based on mypy-0.590. 2018-04-22 20:45:59 +01:00
Mike Auty 59283ad892 Refactor SimpleTypes to BaseTypes since we've added Disassembly. 2018-04-15 15:39:48 +01:00
Mike Auty f25d059d49 Add in file producer/consumer API. 2018-04-14 19:51:49 +01:00
Mike Auty 90641befd2 Remove the TZ*Values and rely on datetime.datetime directly. 2018-04-12 15:43:02 +01:00
Mike Auty d8f497eb71 Allow unpickling of PrimitiveObjects. 2018-04-08 22:25:46 +01:00
Mike Auty 3f9657a2e1 Remove unnecessary type information given it's in the function signature. 2018-04-04 00:41:43 +01:00
Mike Auty 1bae0f26c9 Make sure we don't get in getattr loops. 2018-04-04 00:40:30 +01:00
Mike Auty 4b6b68cf2c Fix up a typo that accidentally got introduced. 2018-04-02 02:20:16 +01:00
Mike Auty e1fed0af20 Rejig configuration deleting again 
Had second thoughts and deletion should only remove data, not sub
hierarchies.  If the entire hierarchy needs clearing out, it'll need to
be done manually, or by splicing in an empty HierarchicalDict.
 2018-04-02 02:18:20 +01:00
Mike Auty a815e39a0c Fix up the configuration deletion logic. 2018-04-02 02:13:39 +01:00
Mike Auty 0d075e6ee3 Fix major (but easily missable) bug in the configuration system. 2018-04-01 22:54:28 +01:00