Mike Auty
0690cf4459
Fix up to use layers rather than memory.
2019-07-30 22:14:19 +01:00
Mike Auty
0e1702af63
A few further changes to extracting streams.
2019-07-30 22:14:19 +01:00
Mike Auty
80c693a91a
Add in MSF and Stream layer support.
2019-07-30 22:14:19 +01:00
Mike Auty
3da5f63393
Initial attempts at an MSF layer.
2019-07-30 22:14:19 +01:00
Mike Auty
230d32f569
Add in initial code for PDB reading.
2019-07-30 22:14:19 +01:00
Mike Auty
164079c203
Casting will use the original object's symbol_table if none is provided.
2019-07-23 00:46:09 +01:00
Mike Auty
e78839b5e9
DON'T import from framework.plugins. It won't work.
2019-07-16 00:37:23 +01:00
Analyst and ikelos
6e4fa57421
move type_classes to dictionaries stored in their modules rather than separate classes (see 81d3293)
2019-07-15 21:16:32 +01:00
Analyst and ikelos
79c7c6df95
change context.memory to context.layers per 272224a
2019-07-15 21:16:32 +01:00
Analyst and ikelos
a26b9bb57d
don't require pslist.PsList.list_processes_filter_requirements - it introduces --pid to the plugin's arguments
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e1d160baee
fix typing for get_vad_maps()
2019-07-15 21:16:32 +01:00
Analyst and ikelos
20d7152050
remove unnecessary debugging
2019-07-15 21:16:32 +01:00
Analyst and ikelos
3ea0432ee4
fix the typing for get_record_tuple()
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e6ae049d18
add svcscan and associated types
2019-07-15 21:16:32 +01:00
Mike Auty
f5615e28f6
Fix up more typing discrepancies.
2019-07-15 17:43:43 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
ba868c7c27
Improve enumeration type naming.
2019-07-07 17:42:31 +01:00
Mike Auty
db2809a0d4
Revert the enumeration base/type change.
2019-07-01 02:21:04 +01:00
Mike Auty
7c7de62900
Fix up long standing bugs in enumeration usage.
2019-07-01 00:17:08 +01:00
Mike Auty
94703d88d8
Fix up enumeration object creation.
2019-06-30 23:05:15 +01:00
Mike Auty
e503c3667f
Improve enumeration support.
2019-06-30 14:12:43 +01:00
Mike Auty
5e37080c14
Fix up misnamed get_enum/has_enum.
2019-06-30 13:35:13 +01:00
Mike Auty
ef28a9b733
Apparently, it wasn't in 3.5, but it throws type-checking errors
...
Python3.6 introduced it, but annoying the type-checker realizes that
we're using it like any int (ie, A | B) and throws a wobbly. Really
want to see the back of python3.5...
Revert "IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen."
This reverts commit 17a0e1eac8
2019-06-28 15:31:59 +01:00
Mike Auty
17a0e1eac8
IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen.
2019-06-28 15:29:40 +01:00
Mike Auty
81d3293414
Move type_classes to dictionaries stored in their modules rather than separate tables.
2019-05-29 22:14:38 +01:00
Mike Auty
6a12361977
Fix up minor typo in info plugin.
2019-05-29 22:14:25 +01:00
Andrew Case
2a8a1523e5
Mac - add lsof plugin
2019-05-29 14:49:55 -05:00
Andrew Case
66690bcbfe
Merge branch 'master' of https://github.com/volatilityfoundation/volatility3
2019-05-29 14:07:06 -05:00
Andrew Case
600af7299b
Mac - add check_sysctl plugin
2019-05-29 14:06:51 -05:00
Analyst and ikelos
a90f3ed1a7
fixup an instance of is_windows_7 in poolscanner
2019-05-29 14:46:22 +01:00
Mike Auty
4ff137bc18
Fix up a is_windows_8_or_later call.
2019-05-29 14:46:22 +01:00
Mike Auty
38f249aef2
Change the os-distguisher to make it more flexible.
2019-05-29 14:46:22 +01:00
Mike Auty
867edc9501
Add in the os-distinguisher code.
2019-05-29 14:46:22 +01:00
Andrew Case
15e546c23c
Mac - add check_trap_table
2019-05-28 22:01:28 -05:00
Andrew Case
bc6e63cb19
Mac - skip invaid kaslr shift results
2019-05-28 19:59:14 -05:00
Mike Auty
2b6007857e
Fix up type signature of filter_func for windows pslist.
2019-05-26 20:45:24 +01:00
Mike Auty
91f1909a01
Add in more accurate generic typing for class_subclasses.
2019-05-11 23:20:16 +01:00
Mike Auty
84a1307c93
More minor typing fixes.
2019-05-11 23:10:39 +01:00
Mike Auty
4cfde031f6
Additional typing fixes.
2019-05-11 22:57:06 +01:00
Mike Auty
cf5cf5cacd
Add in caching just at the page read point of intel spaces.
2019-05-11 20:58:06 +01:00
Mike Auty
86a60985ec
Revert "Add in poor man's lru_caching to see if it's the caching or lru_cache itself."
...
This reverts commit 48826a9051
2019-05-11 20:52:45 +01:00
Mike Auty
48826a9051
Add in poor man's lru_caching to see if it's the caching or lru_cache itself.
2019-05-11 20:33:18 +01:00
Mike Auty
2d939a7ddb
Fix syntax error.
2019-05-11 20:32:21 +01:00
Mike Auty
9378c445db
lru_cache just seems to break file reading.
2019-05-09 01:56:17 +01:00
Mike Auty
488b9be2ba
Attempt to apply lru_cache but without using staticmethod.
2019-05-09 01:43:00 +01:00
Mike Auty
a87d3c0dad
Make sure the separation of read isn't the issue.
2019-05-09 01:05:34 +01:00
Mike Auty
df4c81a7c0
Trade off memory for disk reads (take 2).
2019-05-09 00:49:36 +01:00
Mike Auty
1c0cd7ddaf
Make sure objects.utility is imported automatically.
2019-05-09 00:07:59 +01:00
Mike Auty
d0ff961ed1
Revert "Trade off memory for disk reads."
...
This reverts commit 20c609b180
2019-05-09 00:06:07 +01:00
Mike Auty
20c609b180
Trade off memory for disk reads.
2019-05-08 23:47:02 +01:00
Mike Auty