Mike Auty
5d2b0f9004
Add in support for determining if a key is volatile.
2017-10-23 17:09:25 +01:00
Mike Auty
f085c9d2e3
Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX.
2017-10-09 01:41:08 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
3f70ee92be
Improve the debugging output for unknown registry node signatures.
2017-10-09 00:54:02 +01:00
Mike Auty
587b6e9d9e
Add back in the deprecated helper for _CMHIVE.
2017-10-09 00:20:32 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
042ff5ca25
Use .vol.count for consistency.
2017-10-09 00:19:05 +01:00
Mike Auty
fadb421331
Improve the support for signatures of cells.
2017-10-09 00:19:05 +01:00
Mike Auty
757837633f
Make sure we don't lose volatile bit for members.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
334412330c
Ensure offsets are appropriately prefixed, given we can now support accepting 0x### numbers.
2017-10-09 00:02:03 +01:00
Mike Auty
8dc6401ad8
Add in gentle deprecation warnings about non-helper properties to prevent member confusion.
2017-10-08 23:02:13 +01:00
Mike Auty
624289b94d
Drop out the NlpDtbfinder from the linux plugins, since the LayerStacker should sort it.
2017-10-08 20:24:24 +01:00
Mike Auty
ae9e33292f
Add in restrictions on automagics should be used for each type of plugin.
2017-10-08 20:22:10 +01:00
Mike Auty
42579ca619
Allow subtypes for array_of_pointers to be strings.
2017-10-05 00:30:16 +01:00
Mike Auty
06767bd44c
Ensure we get a warning of some kind when a bad scheme is provided.
2017-10-05 00:13:45 +01:00
Mike Auty
5fbc90e699
Add in utility function for recasting objects as array of pointers of objects.
2017-10-05 00:10:02 +01:00
Mike Auty
88fa13bbdd
Allow count to be specified as a parameter.
2017-10-04 22:21:29 +01:00
Mike Auty
6523364c90
Add a validate method to all objects to allow for (optional) validation of data on construction.
2017-09-22 09:57:01 +01:00
Mike Auty
fea912baaa
Change the InvalidDataException to include the object that threw the validation error.
2017-09-22 09:56:22 +01:00
Mike Auty
393d657d6f
Add exception for data validation.
2017-09-21 21:23:20 +01:00
Mike Auty
71cfec18a6
Add commentary around a potential conflict of method with property.
2017-09-20 09:38:28 +01:00
Mike Auty
5261da780b
Allow the size of array to be changed (may override an existing count member).
2017-09-18 23:23:23 +01:00
Mike Auty
255228ecb0
Convert to abc (post python-3.3).
2017-09-18 23:22:08 +01:00
Mike Auty
7db811fa09
Move nlpdtbscanner's stack order lower down since it isn't accurate for linux (and was tried before it previously).
2017-09-05 11:00:51 +01:00
Mike Auty
946fbd5e61
Use the convenience function built for exactly this circumstance.
2017-09-04 01:26:40 +01:00
Mike Auty
0599ec8f36
Slightly improve potential error condition.
2017-09-03 23:17:07 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
e90b4e2d02
Add and make use of free_table_name for symbol_spaces.
2017-09-03 22:54:42 +01:00
Mike Auty
a4bb32d797
Rework the linux automagic to include utility functions for finding the ASLR and KASLR shifts.
2017-09-03 21:51:11 +01:00
Mike Auty
6265fc4e2d
Catch errors if the stacker didn't manage to stack correctly.
2017-08-31 01:04:01 +01:00
Mike Auty
9346e220ed
Add more detailed information for non-threaded scanners.
2017-08-31 01:02:42 +01:00
Mike Auty
e09ad9b884
Make the automagic progress a little easier to understand.
2017-08-31 00:23:41 +01:00
Mike Auty
aa87c87a22
Remove the additional import that was entirely my fault being there in the first place.
2017-08-16 21:40:58 +01:00
ikelos and GitHub
8698328654
Merge pull request #10 from npetroni/linux-proc-maps
...
Linux proc maps (as reviewed in PR #9 ) 5:)
2017-08-16 21:39:15 +01:00
Mike Auty
59b9645b04
Import linux so we don't need to subimport it everywhere we need to use it.
2017-08-16 21:34:37 +01:00
Nick L. Petroni, Jr
c4e6b07ee0
refactored constants.linux usage
2017-08-16 16:30:12 -04:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
efc2d75a86
Ensure that other constant modules are imported.
2017-08-16 14:28:43 +01:00
Mike Auty
91fdc2166e
Don't forget to fix up the path move.
2017-08-15 01:10:38 +01:00
Mike Auty
6b24dd1d03
Convert constants to a module in preparation for pull request #9 .
2017-08-15 01:07:01 +01:00
Mike Auty