Mike Auty
066a4e64f2
Minor fix for construct_layers.
2019-09-26 21:16:46 +01:00
Mike Auty
ae010a2390
Improve log levels and distribution of messages.
2019-09-26 21:16:12 +01:00
Mike Auty
211ad0d524
Remove useless calls to validate.
2019-09-26 15:58:22 +01:00
Mike Auty
679a0eabc2
Tidy Exceptions and ensure LayerExceptions are passed a layer name.
2019-09-26 15:44:36 +01:00
Mike Auty
2acdc3e060
Fix up PADDING_INFO for very specific versions of windows.
2019-09-26 13:35:23 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
ee008cb76b
Make sure we accurately check the PADDING_INFO presence.
2019-09-25 21:32:53 +01:00
Mike Auty
2252876375
Correct the PADDING_INFO handling.
2019-09-25 21:32:53 +01:00
Mike Auty
5a8946da83
Shift the InfoMask stuff into the top-down approach.
2019-09-25 21:32:53 +01:00
Mike Auty
b0559656fc
Update the header offsets for the InfoMask.
2019-09-25 21:32:53 +01:00
Mike Auty
6a3a6cdb3c
Add this as more of an example of how to cache.
...
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache. It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
2019-09-25 21:32:53 +01:00
Mike Auty
0fd9bf2dbb
Try to shave some time from the poolscanner by Infomask checking.
2019-09-25 21:32:53 +01:00
Mike Auty
37cb541013
Change the layer naming convention to include the underscores when necessary.
2019-09-25 19:38:39 +01:00
Mike Auty
c05b8dfd6a
Volshell: Add support for constructing objects at specific offsets.
2019-09-25 01:22:48 +01:00
Mike Auty
926288a7ac
Ensure process layer name contains the process ID.
2019-09-25 01:15:58 +01:00
Mike Auty
628ff6f740
Volshell: Add a convenience display symbols function.
2019-09-25 01:02:43 +01:00
Mike Auty
320f24d23f
Volshell: Rename key methods and separate out NullFileConsumer.
2019-09-24 00:05:41 +01:00
Mike Auty
21f3d29576
Volshell: split running the plugin into separate run and render steps.
2019-09-24 00:00:25 +01:00
Mike Auty
6a43cd4593
Volshell: improve help function if arguments are used.
2019-09-23 23:59:54 +01:00
Mike Auty
b25094035d
Update renderers to work on populated treegrids.
2019-09-23 23:59:35 +01:00
Mike Auty
0e61062cb0
Volshell: Try not to pollute the configuration dictionary.
2019-09-23 23:11:45 +01:00
Mike Auty
89938cfbbc
Volshell: Add support for quickly running plugins
2019-09-23 22:59:56 +01:00
Mike Auty
6c4c3f5a52
Volshell: improve dt error handling
2019-09-23 22:31:12 +01:00
Mike Auty
03c2444fbb
Volshell: Fix up typo and improve spacing
2019-09-23 22:17:25 +01:00
Mike Auty
152572182f
volshell: Improve dt method
2019-09-23 22:13:32 +01:00
Mike Auty
575463e69e
Improve volshell: aliases and mode
2019-09-23 21:41:35 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
dad88692b8
Minor improvements for pyinstaller packages.
2019-09-21 21:06:05 +01:00
Mike Auty
d2b892cf94
Fix up docstring errors in documentation build
2019-09-19 23:00:37 +01:00
Mike Auty
1f9605abf7
Revert "Fix warnings when generated documentation."
...
This actually broke autodoc generation and wasn't accurate. The
documentation warnings may have to stay for now.
This reverts commit 37e13321f9
2019-09-17 18:32:44 +01:00
Mike Auty
a248bdc804
Fix up old code and docstring indent issue.
2019-09-17 18:15:05 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
33451967b2
Typing fixes for virtmap and remove extranious exception.
2019-09-17 17:58:47 +01:00
Mike Auty
f872aa3390
Revert "Add in no-dump option to certificates plugin."
...
Arg, too much mind changing. This option would make sense if the
certificates plugin returned much useful information, but parsing
certificates isn't easy in with just stdlib, and therefore dumping the
certificates is the most sensible thing for this plugin to do (meaning
no need for a no-dump option).
This reverts commit 5491825652
2019-09-17 16:59:50 +01:00
Mike Auty
444fd5451b
Add in no-dump option to certificates plugin.
2019-09-17 16:59:50 +01:00
Mike Auty
ab4b77a754
Revert "Add in the option to not produce files."
...
It makes more sense to allow each plugin to individually decide whether
to produce files or not.
This reverts commit 07adce2721
2019-09-17 16:59:50 +01:00
superponible and ikelos
ae8822dddf
check if hive offset is valid before yielding
2019-09-17 16:59:50 +01:00
Mike Auty
442b47c87d
Add in the option to not produce files.
2019-09-17 16:59:50 +01:00
Mike Auty
83e113dad0
Revert "Provide a more user friendly filename."
...
As Dave pointed out in the pull request, "User" assumes only one user
and not multiple hives.
This reverts commit a802ecab86
2019-09-17 16:59:50 +01:00
Mike Auty
1b953e3c80
Provide a more user friendly filename.
2019-09-17 16:59:50 +01:00
superponible and ikelos
b6b2275c13
add hive_offset to crt filenames
2019-09-17 16:59:50 +01:00
superponible and ikelos
2fa9e6b84d
fix typo in comment
2019-09-17 16:59:50 +01:00
superponible and ikelos
508a9148ed
catch InvalidAddressException when creating RegistryHive
2019-09-17 16:59:50 +01:00
superponible and ikelos
2e4a8c7247
add user level hives for certificates
2019-09-17 16:59:50 +01:00
superponible and ikelos
2053d957bc
update docstring copied from printkey
2019-09-17 16:59:50 +01:00
superponible and ikelos
36f5e47d5b
fix up docstrings to match yield values
2019-09-17 16:59:50 +01:00
Mike Auty
c6cdbc7342
Move the hive_iterator to HiveList, since it's more intuitively where it should live.
2019-09-17 16:59:50 +01:00
Mike Auty
b292188319
Update userassist to use the new printkey API.
2019-09-17 16:59:50 +01:00
Mike Auty
46c047b7b3
Update API slightly to return objects not strings.
2019-09-17 16:59:50 +01:00
Mike Auty
f2220e16b9
Add in initial attempt at certificate plugin.
2019-09-17 16:59:50 +01:00
Mike Auty