Mike Auty
059be517fc
Fix up minor typing issues.
2018-08-29 23:29:00 +01:00
Mike Auty
303c63da68
Revert userassist to creating a new layer for each userassist data.
2018-08-29 23:14:28 +01:00
Mike Auty
62451ecef6
Reformat code and use has_member instead of RelativeChildOffset.
2018-08-29 23:01:02 +01:00
Mike Auty
3a6b4ad35c
Add in the has_member method for objects and templates.
2018-08-29 22:54:56 +01:00
superponible
40b83c505a
refactor userassist, stop creating registry tables for each entry
2018-08-29 16:10:53 -05:00
superponible and ikelos
4d0bdb7d72
removed additional object creation for determining OS version
2018-08-29 21:51:52 +01:00
superponible and ikelos
140ed54331
use context.module for userassist
2018-08-29 21:51:52 +01:00
superponible and ikelos
719f1d30e8
clean up exception handling
2018-08-29 21:51:52 +01:00
superponible and ikelos
9723eb847e
handle win7 vs winxp assignments together
2018-08-29 21:51:52 +01:00
superponible and ikelos
57166fa549
change method for detecting win7
2018-08-29 21:51:52 +01:00
superponible and ikelos
93e05f4def
longer loop variable names
2018-08-29 21:51:52 +01:00
superponible and ikelos
dcb4ae08e3
change check for valid node path
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
c7e0ff9fa0
docstring and comment about get() vs _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
0d12a6dbf3
alternative to RegValueTypes enum in lieu of _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
4b500b66e9
fix variable name mismatch
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
d6a1e9acfc
add an optional filter to hivelist to return only matching names
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
32bcdf2ebc
add userassist types to registry.json
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
823cbddef5
fix an off by one error in printing hex
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
ebd528610d
initial userassist plugin
2018-08-29 21:51:52 +01:00
Michael Ligh and ikelos
6862573734
only ask for the requirements that we need
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
617510f6d6
change how we iterate through the symbol_generator results
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
ea63c7e80e
define a find_address() method for consistent behavior for 32 and 64-bit systems
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
45ea3437f1
explicitly list the nt_symbols requirement
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
13e5145e46
use from ... import ... statements
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
34bb059cfe
add the ssdt plugin for windows
2018-08-29 15:10:46 +01:00
Mike Auty
b84a7abd37
Ensure we only offer the configuration options we use.
2018-08-28 22:39:40 +01:00
Mike Auty
244af47a2a
Swap inheritted config options for explicit config options.
2018-08-28 22:32:52 +01:00
Mike Auty
ee38c9c4fe
Add in caching for the lengthy symbol sorting.
2018-08-23 17:29:16 +01:00
Mike Auty
b74eb68c04
Pull the check on layer names out so that DataLayerInterface types get it as well.
2018-08-22 09:33:47 +01:00
Mike Auty
ec3c6f34b8
Convert malfind to classmethod convention (and fix a broken protect_values call).
2018-08-17 11:03:49 +01:00
Mike Auty
981d333195
Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError.
2018-08-17 10:52:48 +01:00
Mike Auty
218567c228
Allow Context.module to create a SizedModule if a size is provided.
2018-08-09 14:53:21 +01:00
Mike Auty
0a55a7c3f2
Introduced SizedModules to simplify when we just don't care about the size.
2018-08-09 14:42:18 +01:00
Mike Auty
0f08432aa5
Refactor Symbol interface to SymbolInterface.
2018-08-09 14:28:08 +01:00
Mike Auty
366269deb2
Refactor Module in interfaces to ModuleInterface.
2018-08-09 13:55:16 +01:00
Mike Auty
9e4875009d
Move the horrendously slow no-module-size calculation to an on-demand calculation.
2018-08-09 13:39:07 +01:00
Mike Auty
99f8859549
It turns out that cloning native_templates was unnecessary or slow. Fix and document why clearly.
2018-08-09 12:49:51 +01:00
Mike Auty
19bdc367bf
Add in a new exception for when expected data structures cannot be found.
2018-08-08 21:26:25 +01:00
Mike Auty
60f31852b9
Add in basic documentation covering an example plugin.
2018-08-08 00:41:08 +01:00
Mike Auty
d092a0614d
Add in volatility 3 basics documentation.
2018-08-06 14:21:33 +01:00
Mike Auty
e19ac82480
Improve generator documentation.
2018-08-05 16:26:27 +01:00
Mike Auty
d08c29ffab
Improve style to use default iterators rather than explicit ones.
2018-08-05 16:18:53 +01:00
Mike Auty
b1d46f843b
Convert documentation to napoleon/Google format docstrings.
2018-08-05 15:52:12 +01:00
Mike Auty
7fc19ef110
Updating typing information.
2018-08-05 15:02:11 +01:00
Mike Auty
eb08fb9e96
Convert the pdb scanner to use the kernel module names constants.
2018-08-04 12:34:18 +01:00
Mike Auty
105816beeb
Add in Windows specific constants for kernel modules (whose symbol tables are loaded by automagic).
2018-08-02 10:59:14 +01:00
Mike Auty
bca972f28a
Remove the python implementation of __getattribute__ for speed.
...
The __getattribute__ method is called for *all* attribute lookups, and
the python implementation is likely slow. The only function the python
implementation provided was to check that properties started with
helper_. Since this only provided a log message, we could add it back
in only if the log level is high enough? Either way, it's not
significant enough to warrant costing extra time in every attribute
lookup on every object.
2018-07-30 23:58:02 +01:00
Mike Auty
552101b593
Attempt to reduce the amount of time taken in calling templates.
2018-07-30 23:53:00 +01:00
Mike Auty
79d2bab44d
A few additional typing fixes.
2018-07-22 13:29:43 +01:00
Mike Auty
4897b7ab81
Fix up some typing errors.
2018-07-22 13:19:20 +01:00
Mike Auty