Mike Auty
ac8401991c
Convert all remaining plugins to use the new classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
abfcdba524
add Windows 10 Registry process support
2018-06-04 20:17:28 +01:00
Mike Auty
7a52ac9deb
Fix a large number of typing issues.
...
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
9512cbe9eb
Commit metadata changeset.
...
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers). Metadata can only be set at construction
time, and the metadata dictionary is readonly. The hope is this will
make enumerating metadata keys across the codebase simpler.
The current metadata items that layers hold is:
architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)
This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty
6402c94078
Rework IntermediateSymbolFile loading to a classmethod.
2018-04-12 15:15:25 +01:00
Mike Auty
6482059521
Fix up typing issues identified by mypy.
2018-03-22 00:44:49 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Mike Auty
ac12098317
Add type-annotations for reamining layer files.
2017-12-13 20:48:52 +00:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
3a591688a6
Add in a little more information about signatures.
2017-11-11 15:34:06 +00:00
Mike Auty
35d47b0fb0
Improve checks for invalid values
...
We determine address_masks using log/ln2, which cannot accept 0.
Therefore we don't support address spaces with a maximum_address of 0.
This can affect registry hives, so we've added a check in registry hives
to prevent creating layers with invalid maximum_addresses.
2017-11-11 15:15:14 +00:00
Mike Auty
527ef44800
Make sure the cell boundaries are checked correctly.
2017-11-09 23:13:38 +00:00
Mike Auty
497f0f4950
Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements.
2017-11-08 11:40:17 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
f085c9d2e3
Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX.
2017-10-09 01:41:08 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
3f70ee92be
Improve the debugging output for unknown registry node signatures.
2017-10-09 00:54:02 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
fadb421331
Improve the support for signatures of cells.
2017-10-09 00:19:05 +01:00
Mike Auty
757837633f
Make sure we don't lose volatile bit for members.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty