Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
334412330c
Ensure offsets are appropriately prefixed, given we can now support accepting 0x### numbers.
2017-10-09 00:02:03 +01:00
Mike Auty
8dc6401ad8
Add in gentle deprecation warnings about non-helper properties to prevent member confusion.
2017-10-08 23:02:13 +01:00
Mike Auty
624289b94d
Drop out the NlpDtbfinder from the linux plugins, since the LayerStacker should sort it.
2017-10-08 20:24:24 +01:00
Mike Auty
ae9e33292f
Add in restrictions on automagics should be used for each type of plugin.
2017-10-08 20:22:10 +01:00
Mike Auty
42579ca619
Allow subtypes for array_of_pointers to be strings.
2017-10-05 00:30:16 +01:00
Mike Auty
06767bd44c
Ensure we get a warning of some kind when a bad scheme is provided.
2017-10-05 00:13:45 +01:00
Mike Auty
5fbc90e699
Add in utility function for recasting objects as array of pointers of objects.
2017-10-05 00:10:02 +01:00
Mike Auty
88fa13bbdd
Allow count to be specified as a parameter.
2017-10-04 22:21:29 +01:00
Mike Auty
6523364c90
Add a validate method to all objects to allow for (optional) validation of data on construction.
2017-09-22 09:57:01 +01:00
Mike Auty
fea912baaa
Change the InvalidDataException to include the object that threw the validation error.
2017-09-22 09:56:22 +01:00
Mike Auty
393d657d6f
Add exception for data validation.
2017-09-21 21:23:20 +01:00
Mike Auty
71cfec18a6
Add commentary around a potential conflict of method with property.
2017-09-20 09:38:28 +01:00
Mike Auty
5261da780b
Allow the size of array to be changed (may override an existing count member).
2017-09-18 23:23:23 +01:00
Mike Auty
255228ecb0
Convert to abc (post python-3.3).
2017-09-18 23:22:08 +01:00
Mike Auty
7db811fa09
Move nlpdtbscanner's stack order lower down since it isn't accurate for linux (and was tried before it previously).
2017-09-05 11:00:51 +01:00
Mike Auty
946fbd5e61
Use the convenience function built for exactly this circumstance.
2017-09-04 01:26:40 +01:00
Mike Auty
0599ec8f36
Slightly improve potential error condition.
2017-09-03 23:17:07 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
e90b4e2d02
Add and make use of free_table_name for symbol_spaces.
2017-09-03 22:54:42 +01:00
Mike Auty
a4bb32d797
Rework the linux automagic to include utility functions for finding the ASLR and KASLR shifts.
2017-09-03 21:51:11 +01:00
Mike Auty
6265fc4e2d
Catch errors if the stacker didn't manage to stack correctly.
2017-08-31 01:04:01 +01:00
Mike Auty
9346e220ed
Add more detailed information for non-threaded scanners.
2017-08-31 01:02:42 +01:00
Mike Auty
e09ad9b884
Make the automagic progress a little easier to understand.
2017-08-31 00:23:41 +01:00
Mike Auty
aa87c87a22
Remove the additional import that was entirely my fault being there in the first place.
2017-08-16 21:40:58 +01:00
ikelos and GitHub
8698328654
Merge pull request #10 from npetroni/linux-proc-maps
...
Linux proc maps (as reviewed in PR #9 ) 5:)
2017-08-16 21:39:15 +01:00
Mike Auty
59b9645b04
Import linux so we don't need to subimport it everywhere we need to use it.
2017-08-16 21:34:37 +01:00
Nick L. Petroni, Jr
c4e6b07ee0
refactored constants.linux usage
2017-08-16 16:30:12 -04:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
efc2d75a86
Ensure that other constant modules are imported.
2017-08-16 14:28:43 +01:00
Mike Auty
91fdc2166e
Don't forget to fix up the path move.
2017-08-15 01:10:38 +01:00
Mike Auty
6b24dd1d03
Convert constants to a module in preparation for pull request #9 .
2017-08-15 01:07:01 +01:00
Mike Auty
eeeda60bfb
A couple more small documentation updates.
2017-08-11 19:30:39 +01:00
Mike Auty
2954d7433f
Improve documentation and ordering.
2017-08-11 19:29:37 +01:00
Mike Auty
e434909e50
Make SymbolTable.symbols consistent with enumerations and types.
2017-08-11 19:25:13 +01:00
Mike Auty
f7f1c1d5e0
Raise the right kind of exception in Intermediate Format SymbolTables.
2017-08-11 08:49:49 +01:00
Mike Auty
c6724a538a
Initial support for compressed files.
2017-08-11 01:12:50 +01:00
Mike Auty
efdd961313
Prevent exceptions if there are no linux symboltables.
2017-08-11 00:05:50 +01:00
Mike Auty
a008686c20
Reduce the logging level of the Pdbscan automagic.
2017-08-10 23:58:34 +01:00
Mike Auty
c336a39695
Fix up the Char type (struct.unpack returns a bytes, not a string).
2017-08-10 20:44:21 +01:00
Mike Auty
ab5f4fa3ab
Refactor the List and Choice Requirements
...
These are required by the Automagic interface, and so to prevent
importing from outside the interfaces namespace, these two classes
were moved into interfaces.
2017-08-09 22:44:06 +01:00
Mike Auty
d32fc223e2
Fix up additional imports inconsistent with the coding style.
...
Note: also remove interfaces_configuration where ever possible
(this is not possible in the interfaces directory itself
because it would cause an import loop).
2017-08-09 22:32:44 +01:00
Mike Auty
bfb83f0c33
Fix up silly typo (and replace another hardcoded bang).
2017-08-09 21:34:26 +01:00
Mike Auty
9c3ad5588a
Improve the error handling the LinuxSymbolCache.
2017-08-09 18:06:35 +01:00
Mike Auty
ce89564f71
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-08-08 17:45:52 +01:00
Mike Auty
f0d7dbdf68
Add in translate method for TranslationLayers.
2017-08-08 17:45:36 +01:00
Mike Auty