Mike Auty
f3b6b5311f
Fix up a couple extra typing issues, improving code quality.
2018-02-10 22:51:56 +00:00
Mike Auty
970cfc3cd8
Fix up pdbscan to avoid running if not needed.
2018-02-10 22:44:44 +00:00
Mike Auty
152dc9a210
Error check for when we can't find the file_symbol_url.
2018-02-07 19:56:02 +00:00
Mike Auty
f40fae197d
Convert to python3.5 syntax (no local type-annotations).
2017-12-13 20:48:52 +00:00
Mike Auty
2cc456e847
Finish off the automagic directory type annotations.
2017-12-13 20:48:52 +00:00
Mike Auty
d7d13eb19c
Add type annotations to most of the automagic files.
2017-12-13 20:48:52 +00:00
Mike Auty
671f65ed56
Centralize the ISF locating code.
...
This might benefit from a recache of the linux banners, although it
should continue to work no recache is performed.
We're now in a position to add support for loading symbols directly from
zip files by altering the ResourceAccessor and adding code to the
symbol finder.
2017-11-05 15:18:20 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
a008686c20
Reduce the logging level of the Pdbscan automagic.
2017-08-10 23:58:34 +01:00
Mike Auty
b7c8c8a058
Improve the docstrings for automagic.
2017-07-29 12:53:35 +01:00
Mike Auty
0b6e50daba
Convert pdbscanner to a generator.
2017-07-20 17:47:21 +01:00
Mike Auty
b8fe2a96be
Avoid a variable-reuse issue.
2017-07-20 11:58:16 +01:00
Mike Auty
f8767af1b8
Catch the most general InvalidAddressException in case it's thrown by a lower layer.
2017-07-20 00:58:07 +01:00
Mike Auty
d49e956546
Improve file URL handling.
2017-07-17 18:33:45 +01:00
Mike Auty
b099822ce2
Refactor requirement finding recursion since we use it a lot.
2017-07-16 18:04:22 +01:00
Mike Auty
9a2bfe7c92
Remove unused variable.
2017-06-03 17:44:59 +01:00
Mike Auty
fc325f8324
Ensure the pdb scanning heuristic works with 32-bit systems as well as 64-bit ones.
2017-06-01 23:52:30 +01:00
Mike Auty
bcfc40acfe
Fix egregious typo. 5:S
2017-06-01 00:56:40 +01:00
Mike Auty
7e1965715d
Ensure the pdbscanner can operate when not handed an appropriate intel layer.
2017-05-01 14:38:47 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
149e57afee
Change the requirement validation system to return all unsatisfied requirements, to provide more feedback.
2017-01-08 17:26:09 +00:00
Mike Auty
5fe078e487
Adapt Automagic to have requirements, and convert the Stacker's single_location parameter to make use of it.
2016-12-29 15:21:39 +00:00
Mike Auty
aee4349e3c
More documentation updates (and minor code cleanups).
2016-12-28 03:20:44 +00:00
Mike Auty
9399480f1a
Add a chunk of documentation alphabetically.
2016-12-26 23:50:51 +00:00
Mike Auty
9666e34603
Remove the filenames from the intermediate format prefix search, to improve the documentation.
2016-12-26 23:50:16 +00:00
Mike Auty
bab71d4358
Refactor the progress_callback so it can be used in automagics.
...
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.
The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty
4cd9b98211
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-12-26 22:53:29 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
ba7275f973
Allow relative file paths in the pdb scanner prefix variable, for the documentation.
2016-12-26 18:47:06 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
d51dd2a992
Add in TODOs for future heuristic enhancements.
2016-12-24 19:45:02 +00:00
Mike Auty
6a0b0d71c0
Remove debugging code that shouldn't have made it in the final code.
2016-12-24 19:41:58 +00:00
Mike Auty
d669b57546
Rewrite our fallback virtual kernel offset algorithm.
2016-12-21 16:54:35 +00:00
Mike Auty
9ca001df8b
Allow start/end positions on the pdb scanning.
2016-12-21 02:28:03 +00:00
Mike Auty
30fe381d00
Don't do work we don't have to.
2016-12-14 09:26:15 +00:00
Mike Auty
6b4e80f1e5
Take a tiny bit longer, but properly check all the kernels in case a match is hiding later in the list.
2016-12-14 01:54:50 +00:00
Mike Auty
90b024562f
Rule out kernels that couldn't find a suitable MZ header.
2016-12-14 01:42:40 +00:00
Mike Auty
046d1955b5
Ensure that only unfulfilled symbol requirements trigger the pdb scanner.
2016-12-12 02:04:20 +00:00
Mike Auty
5d15f810e1
Tidy up the config namespace around automagic a little.
2016-12-11 13:58:17 +00:00
Mike Auty
9bb0745b83
Clean up the debug messages for pdbscanning.
2016-12-08 16:29:36 +00:00
Mike Auty
2aebb99ee6
Slightly improve the output and get rid of pointless parameters.
2016-12-08 16:24:59 +00:00
Mike Auty
8a0609e800
Add in a secondary scan to determine the kernel base in randomized kernel base systems.
2016-12-08 16:24:03 +00:00
Mike Auty
482516d93d
Rework the kvo finding code to allow for Win10 kernel base randomization.
2016-12-08 14:56:32 +00:00
Mike Auty
631ae07a26
Insert a check to use valid kernels where a pdb signature is found in multiple locations.
2016-12-08 11:55:46 +00:00
Mike Auty
183ff67699
Attach the kernel virtual offset to intel spaces.
2016-12-07 16:00:31 +00:00
Mike Auty
6cb5d06d6d
Ensure all offsets are normalized to fall within their layer's address range.
2016-12-07 00:07:57 +00:00
Mike Auty
734b9a68b8
Ensure we use math.log correctly.
...
This is unlikely to ever happen (since we use python3)
but still just as well to implement in case something else
similar comes up.
https://www.willmcgugan.com/blog/tech/post/finding-the-first-bit-set-with-python/
2016-12-06 23:40:21 +00:00
Mike Auty
40694ff26c
Add a note about precedence to the pdb loader.
2016-12-06 09:08:51 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty