Mike Auty
ac8401991c
Convert all remaining plugins to use the new classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
abfcdba524
add Windows 10 Registry process support
2018-06-04 20:17:28 +01:00
Mike Auty
9711793503
Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions.
2018-06-04 09:40:26 +01:00
Mike Auty
7a52ac9deb
Fix a large number of typing issues.
...
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
037ac28534
Move around the scanning functions and create an API for the iterators.
2018-05-14 01:03:43 +01:00
Mike Auty
04d609064a
Remove TODO that's in the wrong place, and we've just to-done.
2018-05-13 21:32:05 +01:00
Mike Auty
63a1fb3690
Simplify intel scanning to ensure overlaps are handled correctly.
2018-05-13 20:57:11 +01:00
Mike Auty
a07691b04f
Ensure scanners don't return duplicates in the overlap.
2018-05-13 20:55:54 +01:00
Mike Auty
8b5c58fee9
Fix up slight intel scanner issue.
2018-05-13 15:46:02 +01:00
Mike Auty
5c0140ed74
Fix typo in intel scanning engine.
2018-05-10 02:40:08 +01:00
Mike Auty
83eb346ba5
Clarify logic and fix an issue in intel scanning.
2018-05-10 02:13:46 +01:00
Mike Auty
19b8a0f696
Improve scan chunking for intel layers
...
We now use mapping to skip unmapped pages when scanning. This
should be slightly quicker and likely more accurate. We also now
don't chunk over the size requested by the scanner. We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty
b791b6c1a1
Add an ignore_errors check for positive lengths.
2018-05-09 01:16:47 +01:00
Mike Auty
983eabac86
Fix an issue with IntelPAE's mapping domain size.
2018-05-08 00:02:14 +01:00
Mike Auty
e53cb16485
Vastly speed-up intel memory traversals
...
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer. This means large holes in the memory
can be skipped more quickly. It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty
093b354f7e
Pylint and fix the _check_header return type.
2018-05-02 20:20:24 +01:00
Mike Auty
8cf92051d5
Put back in the comments we wanted to keep.
2018-05-02 20:14:06 +01:00
awalters and ikelos
848d55a59a
Updated to use new create convenience function for IntermediateSymbolTable.
2018-05-02 20:10:14 +01:00
awalters and ikelos
e8f64664a8
Initial changes based on @ikelos review. Also updated crash structs.
2018-05-02 20:10:14 +01:00
awalters and ikelos
6eeafbc391
Windows Crash Layer
2018-05-02 20:10:14 +01:00
Mike Auty
9512cbe9eb
Commit metadata changeset.
...
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers). Metadata can only be set at construction
time, and the metadata dictionary is readonly. The hope is this will
make enumerating metadata keys across the codebase simpler.
The current metadata items that layers hold is:
architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)
This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty
556fa29ada
Deprecate/remove 'provides' attribute.
2018-04-26 12:31:33 +01:00
Mike Auty
623180ddbd
Make many typing fixes, based on mypy-0.590.
2018-04-22 20:45:59 +01:00
Mike Auty
6402c94078
Rework IntermediateSymbolFile loading to a classmethod.
2018-04-12 15:15:25 +01:00
Mike Auty
470c139e81
Throw swap exceptions if the page is supposed to be swapped out, but the swap layer can't be found.
2018-03-23 00:48:28 +00:00
Mike Auty
6482059521
Fix up typing issues identified by mypy.
2018-03-22 00:44:49 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Mike Auty
3f37ab760c
Change inheritance to fix type checking.
2018-03-08 00:23:49 +00:00
Mike Auty
e8422f0774
Refactor to reduce duplication in swap support.
2018-03-05 23:53:34 +00:00
Mike Auty
994bd7c394
Fix up the finding of swap layers so swap actually works.
2018-02-11 21:41:39 +00:00
Mike Auty
b7c68f4e98
Rework LayerListRequirement from a ListRequirement to a MultiRequirement.
2018-02-11 18:35:18 +00:00
Mike Auty
cd8f6876ff
Add in LayerListRequirement type.
2018-02-10 22:42:59 +00:00
Mike Auty
24be045266
Minor fix ups with typing and exceptions.
2018-02-10 22:42:31 +00:00
Mike Auty
cbe75dadf7
Add in Intel32e and improve IntelPAE.
2018-02-10 00:03:13 +00:00
Mike Auty
8b75c458ba
Fix up the calculations and filtering for pagefile offsets.
2018-02-09 01:19:22 +00:00
Mike Auty
8344497e85
Merge branch 'master' into local/swap-support
2018-02-01 00:51:53 +00:00
Mike Auty
3e3a3a85ba
Slightly clean-up magic import errors.
2018-01-30 15:22:50 +00:00
Mike Auty
08531c5859
Gracefully handle non-addurlinfo classes from the opener.
2018-01-30 15:22:33 +00:00
Mike Auty