iMHLv2 and ikelos
0a9e663c41
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0c09b98318
use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
25b56b5ca4
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Mike Auty
56ff75a74b
Layers: Add internal intel debugging flag
2020-12-10 12:18:14 +00:00
Mike Auty
db86aeb861
Volshell: Fix up filename/location confusion
2020-12-10 12:17:39 +00:00
Mike Auty
b759ff3966
Volshell: Clarify load_file to accept location and filename
2020-12-10 10:07:44 +00:00
Mike Auty
dbda8998bc
Volshell: Make it easier to make configurables
2020-12-10 10:07:44 +00:00
Mike Auty
e28016e45b
Pdbutility: Improve usability of symbol_table_from_offset
2020-12-08 16:34:59 +00:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
Mike Auty
754cfcd7ac
Documentation: Add more detail on writing objects
...
Fixes #390
2020-12-06 23:55:49 +00:00
Mike Auty
3b700bbee5
Documentation: Ensure non-os plugins are documented
2020-12-06 23:55:26 +00:00
Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
Mike Auty
9fa107a6c0
CLI: Support MultiTypeData in JSON output. Fixes #384
2020-12-02 23:41:21 +00:00
Mike Auty
27fcd1a641
CLI: Error on non-existant output_dir
2020-12-02 23:16:17 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
Mike Auty
f88ce55199
Automagic: Improve debugging output for linux/mac
2020-12-02 09:51:42 +00:00
Mike Auty
8fb53a32a8
PdbUtility: Support multiple debug directories
2020-12-01 01:21:36 +00:00
Mike Auty
4d0a07194a
PDBUtility: Update to use only pefile
2020-12-01 01:21:36 +00:00
Mike Auty
d77399b82b
Pdbconv: Use both pefile and volatility to get the guid
2020-12-01 01:21:36 +00:00
Mike Auty
65310eb841
Pdbconv: Slight tweaks to database_name finding
2020-11-29 23:05:21 +00:00
Mike Auty
dd0f690988
Pdbconv: Extract appropriate database name if possible
...
Fixes #381
2020-11-29 22:56:01 +00:00
AsafEitani and ikelos
4ec006e606
Fix 'maxsize variable doing nothing' bug
...
In one of the earlier commits the varible was erased from being passed to vaddump - that corrects it.
2020-11-18 19:56:30 +00:00
Mike Auty
9150cd971b
Core: Change base class for FileHandlerInterface
...
Python 3.6 doesn't appear to support IO[bytes] (and this is also from
the typing library), so we instead now inherit from RawIOBase. This
provides read, but does not come with a constructor (like FileIO) so
is suitable for our needs.
Fixes issue #376 .
2020-11-17 22:04:55 +00:00
Mike Auty
30de81795c
Windows: Update requirements to pslist 2.0.0
2020-11-16 09:41:42 +00:00
Mike Auty
745fce2281
Symbols: Fix pool error handling
...
Fixes #375
2020-11-15 23:56:07 +00:00
Mike Auty
4a8b4d1706
Plugins: Bump remaining plugins to framework require 2.0.0
2020-11-15 16:53:03 +00:00
Mike Auty
44c37d9761
Objects: Fix the comparison of enumerations
2020-11-12 17:32:56 +00:00
Mike Auty
60a70d06ca
PDB: Fix issue #374
2020-11-12 17:02:40 +00:00
Mike Auty
49aeaf2a49
Plugins: Resolve remaining LGTM recommendations
2020-11-09 00:03:07 +00:00
Mike Auty
0a655d76a8
Core: Fix LGTM recommendations
...
This is mostly unused imports and unused variables.
2020-11-04 22:41:39 +00:00
Mike Auty
7c75018fc4
Core: Fix Warnings from LGTM
2020-11-04 21:02:36 +00:00
Mike Auty
ae3a97e2c7
Core: Fix errors found by LGTM
2020-11-04 20:05:12 +00:00
Mike Auty
cee63ab6e8
Development: Fix warnings from external tool
2020-11-04 20:01:03 +00:00
Mike Auty
a9c742b3a2
Codebase: Fix == None (from lgtm audit)
2020-11-04 14:32:42 +00:00
Mike Auty
ac95d1f481
Renderers: Allow bytes in JSON output
...
Fixes #367
2020-11-02 00:04:30 +00:00
Mike Auty
1d8081e409
Plugins: Fix exception thrown in handles
...
Fixes #368
2020-11-01 14:50:48 +00:00
Mike Auty
e9c753cfc7
Automagic: Optimize windows layer construction
2020-11-01 00:11:34 +00:00
Mike Auty
46f6ee2eae
Automagic: Ensure progress percentages complete
2020-10-31 23:32:17 +00:00
Mike Auty
47ff37b07b
Plugins: Make layerwiter more configurable
...
This adds support for dumping multiple layers at once, listing available
layers and selects the highest non-mapped layer. Mapping is specified
in the metadata and currently is only applied to intel layers.
2020-10-31 23:30:22 +00:00
Mike Auty
dbd00b9759
Plugins: Fix paths read by isfinfo
2020-10-31 21:26:26 +00:00
Mike Auty
7a36628e48
Extensions: Meaningful error for failed inet_ntop
2020-10-31 11:47:38 +00:00
Mike Auty
31ff6ce482
Plugins: Bump isfinfo framework version
2020-10-30 16:11:35 +00:00
Mike Auty
c622ee4897
Plugins: Bump framework version for banners
2020-10-30 14:59:01 +00:00
Mike Auty
5aa67d12af
Volshell: More fixes for framework 2.0.0
2020-10-29 09:43:16 +00:00
