 Mike Auty
|
0ebf11dcfa
|
Add typing information (and basic linting/formatting).
|
2018-06-25 00:18:02 +01:00 |
|
|
Mike Auty
|
9c06c25fae
|
Add in support for module sizes.
|
2018-06-25 00:16:17 +01:00 |
|
|
Mike Auty
|
c012842bd6
|
Refactor the name to be more accurate.
|
2018-06-21 00:27:38 +01:00 |
|
|
Mike Auty
|
aedcf40fc2
|
Add support for separate symbol_tables and name in Modules.
|
2018-06-21 00:25:55 +01:00 |
|
|
Mike Auty
|
d68d62e47d
|
Fix methodclass conversion for linux pslist.
|
2018-06-20 22:19:24 +01:00 |
|
|
Mike Auty
|
ffa54c45eb
|
Fix linux invalid keyword argument bug.
|
2018-06-20 22:15:42 +01:00 |
|
|
Michael Lighandikelos
|
ab6a9fa43b
|
add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
e4fbc82ab3
|
verinfo still needs the primary and nt_symbols requirements
|
2018-06-19 09:59:28 +01:00 |
|
|
Michael Lighandikelos
|
c43c53a7d7
|
initial draft of verinfo
|
2018-06-19 09:59:28 +01:00 |
|
|
Mike Auty
|
70abef1f46
|
Rework how we handle import errors.
|
2018-06-19 09:58:09 +01:00 |
|
|
Mike Auty
|
4ca705a05c
|
Ensure the lack of yara doesn't kill volatility completely.
|
2018-06-17 20:39:29 +01:00 |
|
|
Mike Auty
|
f28ee6077e
|
Update for the new classmethod model.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
a1caf8d149
|
Add in initial VAD yarascan code.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
9c2ba66c53
|
Add in initial version of yarascan plugin.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
d9ed86bcc5
|
Ensure we return the correct values for dir().
|
2018-06-16 14:29:51 +01:00 |
|
|
Mike Auty
|
c0ec52822b
|
Add some typing fixes.
|
2018-06-16 14:19:36 +01:00 |
|
|
Mike Auty
|
60df83ef15
|
Convert modules/moddump to classmethod.
|
2018-06-16 14:03:22 +01:00 |
|
|
Mike Auty
|
ecb9d5cf05
|
Convert vadinfo calls to classmethods.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
c4c6d30d42
|
Rejig where the pslist plugin exists.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
ac8401991c
|
Convert all remaining plugins to use the new classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
6ca34e6607
|
Start converting plugins to use classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
aea59ffa34
|
Make the change for the core pslist (breaks lots of plugins).
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
86c5302c99
|
_missing_ was a python-3.6 feature.
|
2018-06-16 12:36:00 +01:00 |
|
|
Mike Auty
|
ddeacd3524
|
Fix up my mistaken advice.
|
2018-06-16 09:56:10 +01:00 |
|
|
Dave Lassalleandikelos
|
a0edd1e38e
|
root_cell_offset changes seem to have fixed maxaddr problems
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
09475d5992
|
set default value for key since we combined exception handling
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
c68d02d565
|
combine exception handling to reduce code duplication
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
f2029d5657
|
add comment about registry key case sensitivity and re-work root_cell_offset
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
b85c143af9
|
yield UnreadableValues when key not found, and set default RootCell on exception
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
201fc5780a
|
don't use BaseBlock.Length for maxaddr
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
0c3866ef77
|
make registry path comparison case insensitive
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
5467c1c5e3
|
prevent from halting on an unknown registry value type
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
218b1fd37c
|
use masked length to extract data
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
481ea01149
|
catch the KeyError so we can iterate over all hives for a key path
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
6cfd3b6499
|
fix typo in debug statement
|
2018-06-16 09:54:45 +01:00 |
|
|
Mike Auty
|
33e146533e
|
Fix minor typo in malfind.
|
2018-06-15 23:04:01 +01:00 |
|
|
Michael Lighandikelos
|
7338cdbf8a
|
BaseDllName should be an UnreadableValue() if it cannot be accessed
|
2018-06-13 15:10:58 +01:00 |
|
|
Michael Lighandikelos
|
3eeb48cc0e
|
add the moddump plugin for windows
|
2018-06-13 15:10:58 +01:00 |
|
|
Michael Ligh
|
95214216ea
|
BaseDllName and FullDllName should be UnreadableValue() if they cannot be accessed
|
2018-06-13 09:10:47 -05:00 |
|
|
Mike Auty
|
5f130a3b2a
|
Update timeliner and convert pslist to support it.
|
2018-06-12 09:01:01 +01:00 |
|
|
Mike Auty
|
eed92de9ef
|
Bulk of the modifications for the timeliner interface.
|
2018-06-12 09:01:01 +01:00 |
|
|
Michael LighandMike Auty
|
76f5d35499
|
update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
7ae0d654c2
|
pass native_types to KdbgIntermedSymbols.create() instead of table_mapping
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
ae9d7dbc86
|
use *args and **kwargs when inheriting from IntermediateSymbolTable
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
7797a6a385
|
add a class string to windows.info so that the plugin has a description
|
2018-06-12 08:40:21 +01:00 |
|
|
Michael LighandMike Auty
|
fb57e2c5f2
|
wininfo, procdump, dlldump, and json for pe & kdbg
|
2018-06-12 08:40:21 +01:00 |
|
|
Mike Auty
|
2cbd444603
|
Add in symbol table address masker.
|
2018-06-06 23:12:46 +01:00 |
|
|
Mike Auty
|
b228ad8e95
|
Add comment concerning reconstructability of SymbolTables.
|
2018-06-06 23:10:21 +01:00 |
|
|
Mike Auty
|
253304270b
|
Ensure we can add native_types when we create tables.
|
2018-06-06 00:42:23 +01:00 |
|
|
Mike Auty
|
36dee38a9e
|
Leave pointer out of the default types (since it needs an appropriate size).
|
2018-06-05 21:46:02 +01:00 |
|