Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
c187067fbf
Core: Change the classproperties to subclass from property
2019-11-27 11:30:14 +00:00
Mike Auty
0d37a3db5c
Volshell: Improve typing issues identified by mypy
2019-11-23 20:36:49 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
06c4a6dcc7
pdbconv: Swap the suffix ordering to make the less common option second.
2019-11-20 20:04:14 +00:00
Mike Auty
9928b40afb
pdbconv: ResourceAccessor now logs the written file
2019-11-20 20:04:14 +00:00
Mike Auty
2d3cceda46
ResourceAccessor: Warn and retry without validation on certificate failure
2019-11-20 20:04:14 +00:00
Mike Auty
cb41c5e960
Pdbconv: Switch pdb downloading to resource accessing
2019-11-20 20:04:14 +00:00
Mike Auty
9334add1fc
ResourceAccessor: Fix downloading progress indicator.
2019-11-20 20:04:14 +00:00
Mike Auty
22fd48516e
ResourceAccessor: Improve typing information
2019-11-20 20:04:14 +00:00
Mike Auty
d7b996ff85
ResourceAccessor: Only list the handlers once.
2019-11-20 20:04:14 +00:00
Mike Auty
249c3ec223
Svcscan: Ensure or later checks are done in order.
...
Relates to issue 139.
2019-11-18 20:57:34 +00:00
Mike Auty
dc5420df55
Stackers: Give the vmware stacker an ordering.
2019-11-16 12:58:38 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
1f0e81a898
layers: Stackers are sorted by stack_order not layer priorities.
2019-11-16 12:53:56 +00:00
Mike Auty
19d46563ae
layers: Fix up the maths around scanning chunks
2019-11-13 21:44:13 +00:00
Mike Auty
ca8099e7d7
layers: Improve scanning of layered chunks
...
Previously, for segmented layers, no chunk larger than a full segment
was scanned. Now, we combine contiguous segments up to
scanner.chunk_size (or until a non-present segment) in order to scan it.
This may be slightly slower (by concatting the data together) but gives
results of hits across page boundaries (the point of the scanning
capability), whereas previously each page was scanned individually.
2019-11-13 21:44:13 +00:00
Mike Auty
0f9c6a7362
vmware layer: Fix up a typo.
2019-11-13 19:58:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
8532eef781
CLI: Clean-up final exception output
2019-11-13 19:27:00 +00:00
Mike Auty
40fcdf9469
exceptions: SymbolErrors now contain specific information
2019-11-13 19:27:00 +00:00
Mike Auty
ce3f4fb134
CLI: Initial attempt to standardize exception output
2019-11-13 19:27:00 +00:00
doomedraven and ikelos
4543b0af33
Update vaddump.py
2019-11-13 18:54:19 +00:00
doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
648cded5e1
Objects: Fix incorrect Bitfield maths
...
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit. We should mask then shift, not the
other way around.
May well fix issue #135 (pdb generation will have been affected by
this).
2019-11-13 16:48:14 +00:00
Mike Auty
d0a5d4ba3f
layers: Ensure the new registry check doesn't throw an exception.
2019-11-12 09:09:51 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
xabiugarte and ikelos
5b04492463
Fix on 'end_bit' computation
2019-11-11 17:03:04 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
082b556f43
CLI: Ensure the QuickRenderer flushes after each line.
2019-11-05 23:15:45 +00:00
Daniel Milnes and ikelos
2532bb59e3
Revert copyright symbol change
2019-11-04 20:16:04 +00:00
Daniel Milnes and ikelos
5ba9c9d83d
GitHub Markdown is weird
2019-11-04 20:16:04 +00:00
Daniel Milnes and ikelos
fd64b14690
Add missing word
2019-11-04 20:16:04 +00:00
Daniel Milnes and ikelos
2435355094
Markdown all the things
2019-11-04 20:16:04 +00:00
Mike Auty
9e042ad1ce
Ensure we use configured paths at import.
...
Previously if submodules were imported after the plugin/symbol __path__s had
been set, it would only use the __path__s from the constants module.
We now use the parent module's __path__s to ensure we get the right
sub__path__s.
This seems better/more flexible than changing the original constants
(since they'd no longer be constant) and allows people more chance to
override things. It brings with it potential confusion as a local
plugin directory will need __init__ files with this magic to allow the
core modules to run (since they come first in the path list).
2019-11-04 19:42:24 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
Mike Auty
ee31ece006
Fix a logging on add_process_layer exceptions.
...
There were a number of issues with commit 3df5e995
2019-11-03 23:15:38 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
9d453ff916
Elf64: Ensure volatility objects aren't stored as part of the layer.
2019-11-03 20:37:12 +00:00
Mike Auty
bb04c3b882
Improvements to logging and support for virtualbox.
2019-11-03 20:37:12 +00:00
Mike Auty
6f73310d88
Add in initial Elf64 support.
2019-11-03 20:37:12 +00:00
Mike Auty
83f5771a44
setup.py: Fix a typo that included development files.
2019-11-02 12:51:52 +00:00
Mike Auty
bf1a57ffb5
MANIFEST: Improve the manifest file for different distutil versions
2019-11-01 11:39:54 +00:00
Mike Auty
acc74af06f
pdbparse-to-json: Fix missing HRESULT type.
2019-10-31 23:04:37 +00:00
Mike Auty
dd3e09f1e2
frameworkinfo: Make this a core plugin, not an optional extra.
2019-10-31 22:14:43 +00:00
Mike Auty
24e6d7c658
Ensure the documentation doesn't get stale.
2019-10-31 22:14:43 +00:00
Mike Auty
8a5196bc60
Add in framework information plugin to list vol components.
2019-10-31 22:14:43 +00:00
Mike Auty
4457bcaee0
vadyarascan: Ensure we scan the right layer
...
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
2019-10-31 19:15:02 +00:00
Mike Auty