Mike Auty
983eabac86
Fix an issue with IntelPAE's mapping domain size.
2018-05-08 00:02:14 +01:00
Mike Auty
e53cb16485
Vastly speed-up intel memory traversals
...
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer. This means large holes in the memory
can be skipped more quickly. It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty
2cb5435911
Change the signature for add_process_layer to match linux.
2018-05-07 17:45:40 +01:00
Mike Auty
f23c4b51e4
Add in ModuleCollections for identifying symbols.
2018-05-07 00:05:01 +01:00
Michael Ligh
39413323b1
HexBytes() should inherit from bytes not int
2018-05-06 09:24:36 -05:00
Mike Auty
093b354f7e
Pylint and fix the _check_header return type.
2018-05-02 20:20:24 +01:00
Mike Auty
8cf92051d5
Put back in the comments we wanted to keep.
2018-05-02 20:14:06 +01:00
awalters and ikelos
848d55a59a
Updated to use new create convenience function for IntermediateSymbolTable.
2018-05-02 20:10:14 +01:00
awalters and ikelos
e8f64664a8
Initial changes based on @ikelos review. Also updated crash structs.
2018-05-02 20:10:14 +01:00
awalters and ikelos
6eeafbc391
Windows Crash Layer
2018-05-02 20:10:14 +01:00
Mike Auty
ffe2907fa0
Minor typing fix.
2018-05-01 21:22:26 +01:00
Mike Auty
4dbfdcc9dd
Fix up typing and metadata usage.
2018-05-01 21:21:12 +01:00
Mike Auty
9512cbe9eb
Commit metadata changeset.
...
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers). Metadata can only be set at construction
time, and the metadata dictionary is readonly. The hope is this will
make enumerating metadata keys across the codebase simpler.
The current metadata items that layers hold is:
architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)
This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty
556fa29ada
Deprecate/remove 'provides' attribute.
2018-04-26 12:31:33 +01:00
Mike Auty
623180ddbd
Make many typing fixes, based on mypy-0.590.
2018-04-22 20:45:59 +01:00
Mike Auty
59283ad892
Refactor SimpleTypes to BaseTypes since we've added Disassembly.
2018-04-15 15:39:48 +01:00
Mike Auty
fbc8a9ce12
Move the text renderer to cli directory.
2018-04-15 00:15:50 +01:00
Mike Auty
f25d059d49
Add in file producer/consumer API.
2018-04-14 19:51:49 +01:00
Mike Auty
90641befd2
Remove the TZ*Values and rely on datetime.datetime directly.
2018-04-12 15:43:02 +01:00
Mike Auty
6402c94078
Rework IntermediateSymbolFile loading to a classmethod.
2018-04-12 15:15:25 +01:00
Mike Auty
6fdf577058
Fix up another typing warning.
2018-04-12 14:57:10 +01:00
Mike Auty
66af2f16de
Fix more typing issues.
2018-04-12 14:09:11 +01:00
Mike Auty
c758c249d0
Fix classing issue introduced by recent pickling work.
2018-04-11 20:54:48 +01:00
Mike Auty
2e50cde2e7
Fix minor typing issues.
2018-04-11 20:50:11 +01:00
Mike Auty
8ac434ade9
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2018-04-11 15:39:38 +01:00
Mike Auty
133eb916cf
Handle bad unix timestamps.
2018-04-11 15:39:32 +01:00
Michael Ligh
aa774ffca6
Refs #21 fix vadinfo's get_private_memory() on 10.0.14393.x
2018-04-11 09:24:02 -05:00
Mike Auty
470b8e1bea
More typing updates to allow for string subtypes.
2018-04-11 09:34:09 +01:00
Mike Auty
3fc17f16bd
Change the type for array of pointers to accept any object.
2018-04-11 09:25:47 +01:00
Mike Auty
1f733e7dc4
Make sure we don't get in a getattr loop.
...
This appears to get in a loop when it's been unpickled by
multiprocessing. My guess is that it's trying to set _concrete_members
without it being done in __init__ and there gets in a loop.
We ensure then when doing a look-up inside __getattr__, it happens using
__getattribute__.
2018-04-08 23:28:14 +01:00
Mike Auty
d8f497eb71
Allow unpickling of PrimitiveObjects.
2018-04-08 22:25:46 +01:00
Mike Auty
3f9657a2e1
Remove unnecessary type information given it's in the function signature.
2018-04-04 00:41:43 +01:00
Mike Auty
1bae0f26c9
Make sure we don't get in getattr loops.
2018-04-04 00:40:30 +01:00
Mike Auty
e0a4ada363
Allow sorting of treegrid columns involving datetimes and BaseAbsentValues.
2018-04-02 18:15:35 +01:00
Mike Auty
b8aba83e85
Improve quicktext renderer to support trees.
2018-04-02 13:42:31 +01:00
Mike Auty
4b6b68cf2c
Fix up a typo that accidentally got introduced.
2018-04-02 02:20:16 +01:00
Mike Auty
e1fed0af20
Rejig configuration deleting again
...
Had second thoughts and deletion should only remove data, not sub
hierarchies. If the entire hierarchy needs clearing out, it'll need to
be done manually, or by splicing in an empty HierarchicalDict.
2018-04-02 02:18:20 +01:00
Mike Auty
5938254c3c
Add caching to the stack automagic in case it's reused.
2018-04-02 02:13:59 +01:00
Mike Auty
a815e39a0c
Fix up the configuration deletion logic.
2018-04-02 02:13:39 +01:00
Mike Auty
19236199b1
Refactor stacking and move the automagic location to a constant.
2018-04-02 02:09:56 +01:00
Mike Auty
0d075e6ee3
Fix major (but easily missable) bug in the configuration system.
2018-04-01 22:54:28 +01:00
Mike Auty
050b5539c0
Add missing import.
2018-03-25 18:20:22 +01:00
Mike Auty
eaadd53951
Allow the optional setting of requirements to be changed (for sub-plugins).
2018-03-25 18:16:34 +01:00
Mike Auty
154732126d
Refactor the automagic choosing code.
2018-03-25 18:15:43 +01:00
Mike Auty
19c3536afc
Refactor the plugin listing code.
2018-03-25 18:15:22 +01:00
Mike Auty
10f65a67c8
Ensure the config/branch methods always return.
2018-03-25 18:13:41 +01:00
Mike Auty
d8cdd79843
Add in pointer is_readable method to check if the pointer would translate properly.
2018-03-24 11:00:22 +00:00
Mike Auty
b824daf322
Rejig text output to allow for progress callbacks.
2018-03-24 00:31:20 +00:00
Mike Auty
efada8a15f
Bring relative_child_offset typing in line with practice.
2018-03-23 16:04:03 +00:00
Mike Auty
396dc8f8e4
Add in the ability for plugins to report their progress if applicable.
2018-03-23 15:41:55 +00:00
Mike Auty