Mike Auty
0ca78bc890
Add an efficient multi-string search module (based on Wu-Manber 1994).
...
Empirically this seems far quicker than either Aho-Corasick or
Commentz-Walter for our dataset (very many long search terms).
2017-07-16 01:13:49 +01:00
Mike Auty
8c4bdc8c61
Change the behaviour of multithreaded scans to return results as soon as possible (at the cost of ordering).
2017-07-14 01:16:30 +01:00
Mike Auty
2b718f104d
Remove imports that will break the code.
2017-07-14 01:15:52 +01:00
Mike Auty
a4bb297db7
Improve the progress calculator for multithreaded progress.
2017-07-13 01:31:47 +01:00
Mike Auty
a5e8d98a9c
Refactor the location of the linux banner cache.
2017-07-13 01:31:19 +01:00
Mike Auty
dd7c9d777a
Refactor the scanners to allow for better organization.
2017-07-13 01:30:01 +01:00
Mike Auty
2453b7f180
Add a little information to the log to see when the cache is being built.
2017-07-10 01:24:52 +01:00
Mike Auty
d1cdf805df
Update the comments slightly.
2017-07-10 01:20:01 +01:00
Mike Auty
0811bdaa1a
Add in initial version of linux banner cache mechanism.
2017-07-10 01:17:09 +01:00
Mike Auty
9127f1827f
Carry out the base64 decoding when the symbol is constructed.
2017-07-10 00:06:17 +01:00
Mike Auty
d80fbf1a69
Fix validation typo preventing the newer symbols from properly working.
2017-07-10 00:04:29 +01:00
Mike Auty
f12ab2a460
Move the symbol paths into the constants package.
2017-07-10 00:02:31 +01:00
Mike Auty
5675942050
Add in symbol constant_data and bump the schema to 0.4.1.
...
Special thanks to @npetroni for having to suffer a very long discussion
with me about my need for things to have particular names because I
don't know the field very well. 5:S Sorry! 5:)
2017-07-08 21:50:25 +01:00
Mike Auty
2efbd3dd68
Ensure framework plugins are loaded just like non-framework plugins.
2017-07-01 22:22:43 +01:00
Mike Auty
8625343792
Add the ability to create 'hidden' classes.
...
These will not be returned as part of the subclasses of
their descendents when listed using the classes_subclasses function.
They can be inherited from and their descendents will be listed unless
they also specify the hidden property and mark it as True
(ideally, using the class decorator hide_from_subclasses).
2017-07-01 22:19:50 +01:00
Mike Auty
d79d428edc
Ensure we use the native dictionary for more recent IFF versions (and correct issues with pointers and chars).
2017-06-23 15:44:58 +01:00
Mike Auty
df527d2f00
Convert from abstractproperty which was deprecated in python-3.3.
2017-06-20 15:14:13 +01:00
Mike Auty
d0ebeab253
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-06-05 23:01:34 +01:00
Mike Auty
5dedf00f64
Update the linux automagic based on the VMCOREINFO structure.
2017-06-05 23:01:22 +01:00
Mike Auty
761777c8ef
Add commentary as to why we can't scan faster by ignoring surjective duplicates.
2017-06-03 20:57:19 +01:00
Mike Auty
c05599d78a
Minor clean-up of segmented layer.
2017-06-03 20:26:45 +01:00
Mike Auty
b72c3aaed5
Handle invalid translations lower than the top layer when scanning.
2017-06-03 20:26:21 +01:00
Mike Auty
0675350346
Fix up minor logical error in multithreaded scanning global flag.
2017-06-03 17:49:56 +01:00
Mike Auty
c862f38917
Add in flag to forcibly disable all multithreaded scanning.
2017-06-03 17:48:32 +01:00
Mike Auty
9a2bfe7c92
Remove unused variable.
2017-06-03 17:44:59 +01:00
Mike Auty
93a6efd666
Ensure we don't get name confusion when dealing with variables.
2017-06-03 17:44:13 +01:00
Mike Auty
bc4c386d6d
Fix a multiprocessing issue (and tidy away the kwargs).
...
By not passing the arguments from exceptions down to the
base class Exception, it causes an issue when they are
pickled to be passed between processes. For more information,
see http://bugs.python.org/issue1692335 .
2017-06-03 12:41:18 +01:00
Mike Auty
fc325f8324
Ensure the pdb scanning heuristic works with 32-bit systems as well as 64-bit ones.
2017-06-01 23:52:30 +01:00
Mike Auty
904a5b18a3
Try to bomb out of the NlpDtbFinder if the space already has a dtb.
2017-06-01 01:00:49 +01:00
Mike Auty
bcfc40acfe
Fix egregious typo. 5:S
2017-06-01 00:56:40 +01:00
Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
17a3f1630c
Add back in the masking, since it is important if maxmium_address is ever not 1 less than a power of 2.
2017-05-10 17:37:38 +01:00
Mike Auty
a05a470347
Fix up some complete and utter daftness, tactfully pointed out by npetroni.
2017-05-10 17:30:45 +01:00
Mike Auty
4065cfa090
Add in first draft of Linux identification stacker.
2017-05-06 14:09:49 +01:00
Mike Auty
6da8076050
Add in Regular Expression scanner.
2017-05-06 14:02:09 +01:00
Mike Auty
16b1aca56b
Make the WintelHelper documentation accurate again.
2017-05-06 10:56:21 +01:00
Mike Auty
fe04c423ab
Remove left-over debugging features that slowed down the NLP dtb finder.
2017-05-02 14:51:50 +01:00
Mike Auty
d579f7f583
Add in a condensed version of Nick Petroni's DTB finder/stacker code.
2017-05-01 16:11:00 +01:00
Mike Auty
6e9791deb0
Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles.
2017-05-01 15:59:24 +01:00
Mike Auty
7e1965715d
Ensure the pdbscanner can operate when not handed an appropriate intel layer.
2017-05-01 14:38:47 +01:00
Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty