Mike Auty
7a1fcec1b5
Change subtype to base_type to match the __init__ parameter name.
2016-12-20 08:31:01 +00:00
Mike Auty
1e6911b753
Create appropriate VolTemplateProxy classes for BitField and Enumeration.
2016-12-20 08:29:41 +00:00
Mike Auty
a7d3a95ad0
Fix BitFields (and Enumerations) to accept only Integer basetypes and derive from them properly.
2016-12-20 08:25:55 +00:00
Mike Auty
0f548e864c
Add in comment in case of mutability trouble in the Struct TemplateProxy.
2016-12-18 20:52:38 +00:00
Mike Auty
be075939d2
Remove flags as a fully-fledged object until it's been discussed
2016-12-18 19:38:05 +00:00
Mike Auty
09ee0e6258
Fix fairly deep flaw where resolved templates could be modified by casting or creating an object.
2016-12-18 19:21:27 +00:00
Mike Auty
190bcd7bf1
Include an initial flags object.
...
This might get removed, given it could be achieve with a wrapper rather
than a fully defined Object.
2016-12-18 16:29:19 +00:00
Mike Auty
54678823f8
Refactor BitField subtype to base_type to match enums (and fix a minor enum typo too).
2016-12-18 16:12:08 +00:00
Mike Auty
45d37bb961
Remove misleading TODO.
2016-12-18 15:52:03 +00:00
Mike Auty
efad3362db
Reset the string encoding changes, since we were doing it right the first time.
2016-12-18 15:51:27 +00:00
Mike Auty
e4905febf9
Ensure all objects can be inherited from.
2016-12-18 15:38:11 +00:00
Mike Auty
6102054bb6
Enable string encoding and emphasize that max_length applies to bytes in memory not to number of characters in the string.
2016-12-18 15:37:05 +00:00
Mike Auty
fbb66e6603
Support inverse caching of enumerations.
2016-12-18 02:10:54 +00:00
Mike Auty
4ac682fc42
Rename Enumeration subtype to base_type, since it should always be a primitive.
2016-12-18 02:07:11 +00:00
Mike Auty
884e397836
Update Enumeration objects again, hopefully correctly this time.
2016-12-15 23:04:51 +00:00
Mike Auty
bf61357ed2
Don't forget to call super's struct_format.
2016-12-15 09:06:05 +00:00
Mike Auty
de58df2363
Fix negation flip that returned entirely the wrong values for arrays.
2016-12-15 02:07:25 +00:00
Mike Auty
d3f6a40d66
Change the docstrings to use name rather than entry for enumerations.
2016-12-15 02:07:03 +00:00
Mike Auty
de18fe234c
Add in an implementation for Enumeration for testing.
2016-12-15 02:02:30 +00:00
Mike Auty
b686c65c9e
Rework array slicing to piggy-back off python's code.
2016-12-14 23:26:31 +00:00
Mike Auty
2c02df125a
Fix the truncation of strings
...
MHL kindly pointed out that the string wasn't truncating, and it turns
out I misread the struct documentation, which truncates or pads with
\x00s to ensure the appropriate length. We now truncate to the first
null we find.
2016-12-13 20:41:09 +00:00
Mike Auty
1f6fcd7bad
Ensure that the value of pointers always fall within their layer.
2016-12-07 09:52:33 +00:00
Mike Auty
797e51608e
Move the masking code into the data layer.
2016-12-07 09:50:59 +00:00
Mike Auty
6cb5d06d6d
Ensure all offsets are normalized to fall within their layer's address range.
2016-12-07 00:07:57 +00:00
Mike Auty
1c7de06bd0
Fix up issue with pointer sizes. Since cls is never used we're not losing information.
2016-12-06 02:44:11 +00:00
Mike Auty
e4e563ead0
Fix up the array slicing code.
2016-12-03 00:23:00 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
d1b58143fe
Add in UnresolvedTemplate type.
...
This template type allows objects that have not been able to be resolved
to exist within the symbol system. It emits a debug message on creation
so that intermediate format developers can identify potential issues,
but does not raise an exception so as to allow partial tables to be
used.
If the UnresolvedTemplate is called (to create an object) before the
symbol has been added to the symbolspace, it will fail with a
SymbolError (as thrown by the individual SymbolTable). For this reason,
the class has been made private to the SymbolSpace class to prevent
unexpected use.
2016-10-30 16:54:12 +00:00
Mike Auty
6b405383c4
Refactor targets to subtypes.
2016-10-26 01:24:58 +01:00
Mike Auty
e02feed16e
Python 3 has a sane super() implementation (no arguments), so convert to using that.
2016-08-14 00:55:02 +01:00
Mike Auty
34b81a5265
Add in Unions
...
Since a Union is identical to a Struct (and at the moment a struct
doesn't enforce non-overlapping members), these are identical and a
Union is a descendent of Struct. If this ever becomes a problem there
is a filthy way to fix it, but it's really bad and will likely cause
more subtle and difficult to diagnose problems. Stick with inheritance.
2016-05-22 12:03:46 +01:00
Mike Auty
2d23c93def
Completely refactor constants and structures to symbols and types.
2016-05-22 11:51:06 +01:00
Mike Auty
d7aefdce28
Add a comment explaining why we don't truncate strings on \x00.
2016-02-14 02:50:37 +00:00
Mike Auty
0ef389dec9
Tidy up Bytes and String to require all the appropriate parameters.
2016-02-14 02:49:28 +00:00
Mike Auty
86526fa9ad
Separate out the object_info to make debugging easier in future.
2016-02-14 01:43:28 +00:00
Mike Auty
9c1dbf88e2
Change Bytes to not require a struct_format, since we generate it from the length parameter.
2016-02-14 01:43:09 +00:00
Mike Auty
bcbfee9016
Refactor the validity function names to make it easier for autocomplete to find.
2015-12-29 22:24:32 +00:00
Mike Auty
d258c56991
Rerun pylint with pycharm-5 and fix pep8 issues as well.
2015-11-21 13:12:00 +00:00
Mike Auty
49fa45cda1
Clean-up the namespace even more by putting the template proxy code into its own subclass.
2015-01-05 15:57:35 +00:00
Mike Auty
87967853f7
Convert volinfo namespace to vol namespace.
2015-01-05 15:04:40 +00:00
Mike Auty
6770aa1adb
Tidy up templates and template interfaces.
2015-01-04 23:09:30 +00:00
Mike Auty
73bd451759
Minor pylinting across the whole project.
2015-01-04 21:14:17 +00:00
Mike Auty
ea3ba27a04
Refactor template_* functions.
2015-01-04 20:52:34 +00:00
Mike Auty
95238f7f01
Eradicate **magic where possible and rename where appropriate.
2015-01-04 04:55:17 +00:00
Mike Auty
8560aa8a55
Tidy up the Object calling interface.
2015-01-04 04:38:34 +00:00
Mike Auty
446536d789
Remove the concept of template_info and revert to structure_name alone.
2015-01-04 04:27:52 +00:00
Mike Auty
15b2f6f717
Initial introduction of ObjectInformation class.
2015-01-04 03:41:37 +00:00
Mike Auty
9c919a3d91
Fill in a few more of the missing abstract methods.
2014-12-31 21:03:52 +00:00
Mike Auty
4a4deebda5
Fix up refactoring error in pointer dereference caching.
2014-12-31 03:45:56 +00:00
Mike Auty
47a1390bb9
Allow explicit dereferencing at a layer within memory.
...
This is in contrast to volatility-2.x where object were automatically
instantiated with a native_vm (or native_layer in 3.x parlance) and then
any dereferences occurred in the correct layer.
The space savings are now minimal since each object carries around only
a layer name, and not a reference to the entire space. However, given
situations such as kernel structures containing pointers into
process spaces, where the native_vm is useless, this decision is
designed to make working on a particular layer explicit and therefore
more obvious. It may mean exposing that up through levels of functions,
but hopefully it will make all the code more obvious and less
automagical.
2014-12-31 03:03:31 +00:00
Mike Auty