Commit Graph
1055 Commits
Author SHA1 Message Date
Mike Auty 38e9c8f50b Add in initial version of the strings plugin. 2018-05-08 00:57:16 +01:00
Mike Auty 983eabac86 Fix an issue with IntelPAE's mapping domain size. 2018-05-08 00:02:14 +01:00
Mike Auty e53cb16485 Vastly speed-up intel memory traversals
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer.  This means large holes in the memory
can be skipped more quickly.  It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty 2cb5435911 Change the signature for add_process_layer to match linux. 2018-05-07 17:45:40 +01:00
Mike Auty a05dbe708d Fix up the issue @imhlv2 found in schema_validate. 2018-05-07 10:07:56 +01:00
Mike Auty f23c4b51e4 Add in ModuleCollections for identifying symbols. 2018-05-07 00:05:01 +01:00
Mike Auty 84c72c9ffc Remove the unnecessary Volshell check in timeliner.
Given that volshell's plugins are now separate and not stored in the
core plugins list, there is no need to protect against it (and there are
no other "interactive" plugins, which will likely be barred from being
in the core set).
2018-05-06 19:39:07 +01:00
Mike Auty a3eaef7696 Remove debugging statement. 2018-05-06 18:12:53 +01:00
Mike Auty 035bada7b7 Refactor volshell from a plugin to a standalone program. 2018-05-06 18:11:15 +01:00
Mike Auty 66306dad2a Change Hex byte rendering so it's always on a new line. 2018-05-06 15:34:24 +01:00
Mike Auty c38c6fa3c4 Merge branch 'master' of github.com:volatilityfoundation/volatility3 2018-05-06 15:25:30 +01:00
Michael Ligh 39413323b1 HexBytes() should inherit from bytes not int 2018-05-06 09:24:36 -05:00
Mike Auty 3f1a3e34c6 Add in the oft-requested -f flag.
I'm not entirely happy with this, it's an overly specific hard coded
change, but luckily it's only for this CLI, it has no impact on other
UIs, either text based on web based.

I really don't want people to become reliant on this, but also I don't
want to be that guy that stops people being able to do their work
quickly for reasons of correctness.  May future volatility devs forgive
me...
2018-05-06 15:22:39 +01:00
Mike Auty 38eff91371 Remove vestigal update_configuration methods. 2018-05-06 01:24:40 +01:00
Mike Auty 093b354f7e Pylint and fix the _check_header return type. 2018-05-02 20:20:24 +01:00
Mike Auty 8cf92051d5 Put back in the comments we wanted to keep. 2018-05-02 20:14:06 +01:00
awaltersandikelos 848d55a59a Updated to use new create convenience function for IntermediateSymbolTable. 2018-05-02 20:10:14 +01:00
awaltersandikelos e8f64664a8 Initial changes based on @ikelos review. Also updated crash structs. 2018-05-02 20:10:14 +01:00
awaltersandikelos 6eeafbc391 Windows Crash Layer 2018-05-02 20:10:14 +01:00
Mike Auty ffe2907fa0 Minor typing fix. 2018-05-01 21:22:26 +01:00
Mike Auty 4dbfdcc9dd Fix up typing and metadata usage. 2018-05-01 21:21:12 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty 556fa29ada Deprecate/remove 'provides' attribute. 2018-04-26 12:31:33 +01:00
Mike Auty 623180ddbd Make many typing fixes, based on mypy-0.590. 2018-04-22 20:45:59 +01:00
Mike Auty 0c28717322 Add disassembly support to the text renderer. 2018-04-15 15:41:41 +01:00
Mike Auty 59283ad892 Refactor SimpleTypes to BaseTypes since we've added Disassembly. 2018-04-15 15:39:48 +01:00
Mike Auty fbc8a9ce12 Move the text renderer to cli directory. 2018-04-15 00:15:50 +01:00
Mike Auty 8e5291ecb4 Make sure we write out bytes, not memory. 2018-04-14 23:52:59 +01:00
Mike Auty f25d059d49 Add in file producer/consumer API. 2018-04-14 19:51:49 +01:00
Mike Auty 90641befd2 Remove the TZ*Values and rely on datetime.datetime directly. 2018-04-12 15:43:02 +01:00
Mike Auty 6402c94078 Rework IntermediateSymbolFile loading to a classmethod. 2018-04-12 15:15:25 +01:00
Mike Auty 6fdf577058 Fix up another typing warning. 2018-04-12 14:57:10 +01:00
Mike Auty 66af2f16de Fix more typing issues. 2018-04-12 14:09:11 +01:00
Mike Auty c758c249d0 Fix classing issue introduced by recent pickling work. 2018-04-11 20:54:48 +01:00
Mike Auty 2e50cde2e7 Fix minor typing issues. 2018-04-11 20:50:11 +01:00
Mike Auty 8ac434ade9 Merge branch 'master' of github.com:volatilityfoundation/volatility3 2018-04-11 15:39:38 +01:00
Mike Auty 133eb916cf Handle bad unix timestamps. 2018-04-11 15:39:32 +01:00
Michael Ligh aa774ffca6 Refs #21 fix vadinfo's get_private_memory() on 10.0.14393.x 2018-04-11 09:24:02 -05:00
Mike Auty 470b8e1bea More typing updates to allow for string subtypes. 2018-04-11 09:34:09 +01:00
Mike Auty 3fc17f16bd Change the type for array of pointers to accept any object. 2018-04-11 09:25:47 +01:00
Mike Auty 1f733e7dc4 Make sure we don't get in a getattr loop.
This appears to get in a loop when it's been unpickled by
multiprocessing.  My guess is that it's trying to set _concrete_members
without it being done in __init__ and there gets in a loop.

We ensure then when doing a look-up inside __getattr__, it happens using
__getattribute__.
2018-04-08 23:28:14 +01:00
Mike Auty d8f497eb71 Allow unpickling of PrimitiveObjects. 2018-04-08 22:25:46 +01:00
Mike Auty 3f9657a2e1 Remove unnecessary type information given it's in the function signature. 2018-04-04 00:41:43 +01:00
Mike Auty 1bae0f26c9 Make sure we don't get in getattr loops. 2018-04-04 00:40:30 +01:00
Mike Auty e0a4ada363 Allow sorting of treegrid columns involving datetimes and BaseAbsentValues. 2018-04-02 18:15:35 +01:00
Mike Auty a55d1c0cab Add in basic pstree plugin. 2018-04-02 13:44:17 +01:00
Mike Auty b8aba83e85 Improve quicktext renderer to support trees. 2018-04-02 13:42:31 +01:00
Mike Auty 4b6b68cf2c Fix up a typo that accidentally got introduced. 2018-04-02 02:20:16 +01:00
Mike Auty e1fed0af20 Rejig configuration deleting again
Had second thoughts and deletion should only remove data, not sub
hierarchies.  If the entire hierarchy needs clearing out, it'll need to
be done manually, or by splicing in an empty HierarchicalDict.
2018-04-02 02:18:20 +01:00
Mike Auty 5938254c3c Add caching to the stack automagic in case it's reused. 2018-04-02 02:13:59 +01:00