 Mike Auty
|
059be517fc
|
Fix up minor typing issues.
|
2018-08-29 23:29:00 +01:00 |
|
|
Mike Auty
|
303c63da68
|
Revert userassist to creating a new layer for each userassist data.
|
2018-08-29 23:14:28 +01:00 |
|
|
Mike Auty
|
62451ecef6
|
Reformat code and use has_member instead of RelativeChildOffset.
|
2018-08-29 23:01:02 +01:00 |
|
|
superponible
|
40b83c505a
|
refactor userassist, stop creating registry tables for each entry
|
2018-08-29 16:10:53 -05:00 |
|
|
superponibleandikelos
|
4d0bdb7d72
|
removed additional object creation for determining OS version
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
140ed54331
|
use context.module for userassist
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
719f1d30e8
|
clean up exception handling
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
9723eb847e
|
handle win7 vs winxp assignments together
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
57166fa549
|
change method for detecting win7
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
93e05f4def
|
longer loop variable names
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
dcb4ae08e3
|
change check for valid node path
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
0d12a6dbf3
|
alternative to RegValueTypes enum in lieu of _missing_()
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
4b500b66e9
|
fix variable name mismatch
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
d6a1e9acfc
|
add an optional filter to hivelist to return only matching names
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
ebd528610d
|
initial userassist plugin
|
2018-08-29 21:51:52 +01:00 |
|
|
Michael Lighandikelos
|
6862573734
|
only ask for the requirements that we need
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
617510f6d6
|
change how we iterate through the symbol_generator results
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
ea63c7e80e
|
define a find_address() method for consistent behavior for 32 and 64-bit systems
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
45ea3437f1
|
explicitly list the nt_symbols requirement
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
13e5145e46
|
use from ... import ... statements
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
34bb059cfe
|
add the ssdt plugin for windows
|
2018-08-29 15:10:46 +01:00 |
|
|
Mike Auty
|
b84a7abd37
|
Ensure we only offer the configuration options we use.
|
2018-08-28 22:39:40 +01:00 |
|
|
Mike Auty
|
244af47a2a
|
Swap inheritted config options for explicit config options.
|
2018-08-28 22:32:52 +01:00 |
|
|
Mike Auty
|
ec3c6f34b8
|
Convert malfind to classmethod convention (and fix a broken protect_values call).
|
2018-08-17 11:03:49 +01:00 |
|
|
Mike Auty
|
366269deb2
|
Refactor Module in interfaces to ModuleInterface.
|
2018-08-09 13:55:16 +01:00 |
|
|
Mike Auty
|
b1d46f843b
|
Convert documentation to napoleon/Google format docstrings.
|
2018-08-05 15:52:12 +01:00 |
|
|
Mike Auty
|
4897b7ab81
|
Fix up some typing errors.
|
2018-07-22 13:19:20 +01:00 |
|
|
Michael Lighandikelos
|
3d7c10dd32
|
add the cmdline plugin for windows
|
2018-07-19 21:26:32 +01:00 |
|
|
Mike Auty
|
5906c76b1b
|
Fix omission where protect_values became a class method.
|
2018-07-17 21:15:41 +01:00 |
|
|
Mike Auty
|
0ebf11dcfa
|
Add typing information (and basic linting/formatting).
|
2018-06-25 00:18:02 +01:00 |
|
|
Michael Lighandikelos
|
ab6a9fa43b
|
add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
e4fbc82ab3
|
verinfo still needs the primary and nt_symbols requirements
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
c43c53a7d7
|
initial draft of verinfo
|
2018-06-19 09:59:28 +01:00 |
|
|
Mike Auty
|
70abef1f46
|
Rework how we handle import errors.
|
2018-06-19 09:58:09 +01:00 |
|
|
Mike Auty
|
4ca705a05c
|
Ensure the lack of yara doesn't kill volatility completely.
|
2018-06-17 20:39:29 +01:00 |
|
|
Mike Auty
|
f28ee6077e
|
Update for the new classmethod model.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
a1caf8d149
|
Add in initial VAD yarascan code.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
c0ec52822b
|
Add some typing fixes.
|
2018-06-16 14:19:36 +01:00 |
|
|
Mike Auty
|
60df83ef15
|
Convert modules/moddump to classmethod.
|
2018-06-16 14:03:22 +01:00 |
|
|
Mike Auty
|
ecb9d5cf05
|
Convert vadinfo calls to classmethods.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
c4c6d30d42
|
Rejig where the pslist plugin exists.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
ac8401991c
|
Convert all remaining plugins to use the new classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
6ca34e6607
|
Start converting plugins to use classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
aea59ffa34
|
Make the change for the core pslist (breaks lots of plugins).
|
2018-06-16 13:38:48 +01:00 |
|
|
Dave Lassalleandikelos
|
09475d5992
|
set default value for key since we combined exception handling
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
c68d02d565
|
combine exception handling to reduce code duplication
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
b85c143af9
|
yield UnreadableValues when key not found, and set default RootCell on exception
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
481ea01149
|
catch the KeyError so we can iterate over all hives for a key path
|
2018-06-16 09:54:45 +01:00 |
|
|
Mike Auty
|
33e146533e
|
Fix minor typo in malfind.
|
2018-06-15 23:04:01 +01:00 |
|
|
Michael Lighandikelos
|
7338cdbf8a
|
BaseDllName should be an UnreadableValue() if it cannot be accessed
|
2018-06-13 15:10:58 +01:00 |
|