 Mike Auty
|
00a7f9ce2d
|
Rework the way verinfo works.
|
2018-09-13 00:24:57 +01:00 |
|
|
Mike Auty
|
6dc8b4d517
|
Create a windows.registry category.
|
2018-09-12 22:55:41 +01:00 |
|
|
Mike Auty
|
312e74cd08
|
Improve typing information for verinfo.
|
2018-09-01 22:14:34 +01:00 |
|
|
Mike Auty
|
0550186ed2
|
Fix a couple bugs in moddump.
|
2018-09-01 22:04:51 +01:00 |
|
|
Mike Auty
|
9d05482e50
|
Make sure we appropriately use classmethods now they're in place.
|
2018-08-30 16:40:39 +01:00 |
|
|
Mike Auty
|
ce63ee2e83
|
Conver the verinfo plugin to using the classmethod moddump.
|
2018-08-30 12:03:17 +01:00 |
|
|
Mike Auty
|
edac0bee6f
|
Update moddump to use classmethods.
|
2018-08-30 12:03:17 +01:00 |
|
|
Mike Auty
|
5791cfaab7
|
Stop overriding the builtin filter method, and ensure suitable parameter names.
|
2018-08-30 11:41:19 +01:00 |
|
|
Mike Auty
|
f4dd40ba0b
|
Ensure we're catching the appropriate expcetions rather than all of them.
|
2018-08-30 09:41:39 +01:00 |
|
|
superponible
|
19dcb80de6
|
catch os detection exception, change loop break to continue
|
2018-08-29 20:59:42 -05:00 |
|
|
Mike Auty
|
cc99d08c88
|
Move userassist keys over to a JSON data file.
|
2018-08-30 00:52:02 +01:00 |
|
|
Mike Auty
|
93607b2586
|
Fix up exception catching with no exception specified.
|
2018-08-30 00:36:32 +01:00 |
|
|
Mike Auty
|
fe9a1617c9
|
Include printkey in the hivelist conversion.
|
2018-08-29 23:31:39 +01:00 |
|
|
Mike Auty
|
0aa6ba0fe0
|
Convert hivelist to classmethod style.
|
2018-08-29 23:29:51 +01:00 |
|
|
Mike Auty
|
059be517fc
|
Fix up minor typing issues.
|
2018-08-29 23:29:00 +01:00 |
|
|
Mike Auty
|
303c63da68
|
Revert userassist to creating a new layer for each userassist data.
|
2018-08-29 23:14:28 +01:00 |
|
|
Mike Auty
|
62451ecef6
|
Reformat code and use has_member instead of RelativeChildOffset.
|
2018-08-29 23:01:02 +01:00 |
|
|
superponible
|
40b83c505a
|
refactor userassist, stop creating registry tables for each entry
|
2018-08-29 16:10:53 -05:00 |
|
|
superponibleandikelos
|
4d0bdb7d72
|
removed additional object creation for determining OS version
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
140ed54331
|
use context.module for userassist
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
719f1d30e8
|
clean up exception handling
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
9723eb847e
|
handle win7 vs winxp assignments together
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
57166fa549
|
change method for detecting win7
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
93e05f4def
|
longer loop variable names
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
dcb4ae08e3
|
change check for valid node path
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
0d12a6dbf3
|
alternative to RegValueTypes enum in lieu of _missing_()
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
4b500b66e9
|
fix variable name mismatch
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
d6a1e9acfc
|
add an optional filter to hivelist to return only matching names
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
ebd528610d
|
initial userassist plugin
|
2018-08-29 21:51:52 +01:00 |
|
|
Michael Lighandikelos
|
6862573734
|
only ask for the requirements that we need
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
617510f6d6
|
change how we iterate through the symbol_generator results
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
ea63c7e80e
|
define a find_address() method for consistent behavior for 32 and 64-bit systems
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
45ea3437f1
|
explicitly list the nt_symbols requirement
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
13e5145e46
|
use from ... import ... statements
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
34bb059cfe
|
add the ssdt plugin for windows
|
2018-08-29 15:10:46 +01:00 |
|
|
Mike Auty
|
b84a7abd37
|
Ensure we only offer the configuration options we use.
|
2018-08-28 22:39:40 +01:00 |
|
|
Mike Auty
|
244af47a2a
|
Swap inheritted config options for explicit config options.
|
2018-08-28 22:32:52 +01:00 |
|
|
Mike Auty
|
ec3c6f34b8
|
Convert malfind to classmethod convention (and fix a broken protect_values call).
|
2018-08-17 11:03:49 +01:00 |
|
|
Mike Auty
|
366269deb2
|
Refactor Module in interfaces to ModuleInterface.
|
2018-08-09 13:55:16 +01:00 |
|
|
Mike Auty
|
b1d46f843b
|
Convert documentation to napoleon/Google format docstrings.
|
2018-08-05 15:52:12 +01:00 |
|
|
Mike Auty
|
4897b7ab81
|
Fix up some typing errors.
|
2018-07-22 13:19:20 +01:00 |
|
|
Michael Lighandikelos
|
3d7c10dd32
|
add the cmdline plugin for windows
|
2018-07-19 21:26:32 +01:00 |
|
|
Mike Auty
|
5906c76b1b
|
Fix omission where protect_values became a class method.
|
2018-07-17 21:15:41 +01:00 |
|
|
Mike Auty
|
0ebf11dcfa
|
Add typing information (and basic linting/formatting).
|
2018-06-25 00:18:02 +01:00 |
|
|
Mike Auty
|
d68d62e47d
|
Fix methodclass conversion for linux pslist.
|
2018-06-20 22:19:24 +01:00 |
|
|
Michael Lighandikelos
|
ab6a9fa43b
|
add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
e4fbc82ab3
|
verinfo still needs the primary and nt_symbols requirements
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
c43c53a7d7
|
initial draft of verinfo
|
2018-06-19 09:59:28 +01:00 |
|
|
Mike Auty
|
70abef1f46
|
Rework how we handle import errors.
|
2018-06-19 09:58:09 +01:00 |
|
|
Mike Auty
|
4ca705a05c
|
Ensure the lack of yara doesn't kill volatility completely.
|
2018-06-17 20:39:29 +01:00 |
|