Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Mike Auty
3f37ab760c
Change inheritance to fix type checking.
2018-03-08 00:23:49 +00:00
Mike Auty
e8422f0774
Refactor to reduce duplication in swap support.
2018-03-05 23:53:34 +00:00
Mike Auty
994bd7c394
Fix up the finding of swap layers so swap actually works.
2018-02-11 21:41:39 +00:00
Mike Auty
b7c68f4e98
Rework LayerListRequirement from a ListRequirement to a MultiRequirement.
2018-02-11 18:35:18 +00:00
Mike Auty
cd8f6876ff
Add in LayerListRequirement type.
2018-02-10 22:42:59 +00:00
Mike Auty
24be045266
Minor fix ups with typing and exceptions.
2018-02-10 22:42:31 +00:00
Mike Auty
cbe75dadf7
Add in Intel32e and improve IntelPAE.
2018-02-10 00:03:13 +00:00
Mike Auty
8b75c458ba
Fix up the calculations and filtering for pagefile offsets.
2018-02-09 01:19:22 +00:00
Mike Auty
8344497e85
Merge branch 'master' into local/swap-support
2018-02-01 00:51:53 +00:00
Mike Auty
3e3a3a85ba
Slightly clean-up magic import errors.
2018-01-30 15:22:50 +00:00
Mike Auty
08531c5859
Gracefully handle non-addurlinfo classes from the opener.
2018-01-30 15:22:33 +00:00
Mike Auty
deb7da246b
Add in initial shot at PAE page entry handling.
2018-01-28 16:29:28 +00:00
Mike Auty
35be4c5a84
Add in more information to the paged exceptions.
2018-01-28 16:25:16 +00:00
Mike Auty
c203663f0b
Refactor requirements to support a list of swap layers.
2018-01-28 14:48:50 +00:00
Mike Auty
bf8173f9a9
Improve the loader in the face of the file/python-magic duplicate module naming.
2018-01-28 13:34:19 +00:00
Mike Auty
663cf3eff8
Just tidy up the multistring searchers slightly.
2018-01-25 11:27:59 +00:00
Mike Auty
ccd00afdb2
Add in new multistring scanner based on re
...
Unfortunately in tests it turned out re was faster than a python
implementation of Wu-Manber. The Wu-Manber code has been left (because
why not) but it's not really advantageous over the re builtin since
it's compiled in C.
2018-01-24 20:22:00 +00:00
Mike Auty
4bb1161490
Make WuManber a callable program.
2017-12-24 12:53:50 +00:00
Mike Auty
3cb48c19e8
Remove the errant urllib3 import in favour of native python.
2017-12-13 20:48:52 +00:00
Mike Auty
1dcad91126
Add in type annotations for scanners.
2017-12-13 20:48:52 +00:00
Mike Auty
ac12098317
Add type-annotations for reamining layer files.
2017-12-13 20:48:52 +00:00
Mike Auty
f40fae197d
Convert to python3.5 syntax (no local type-annotations).
2017-12-13 20:48:52 +00:00
Mike Auty
736cbff1b6
Start on the layers folder (with a few small fixes).
2017-12-13 20:48:52 +00:00
Mike Auty
0ad6294662
Reuse the cache if we're within the same ResourceAccessor.
...
This effectively means that the FileTranslationLayer will reuse the
cached file even with multiple opens, but rerunning python, or starting
a new context (with a new FileTranslationLayer but on the same URL) will
cause a redownload whether necessary or not. This ensures that running
volatility as an engine (inside a long lived python session) will not
prevent a file being checked again later.
Other caching mechanisms (such as last-modified) should be used to
determine if the cached file is still valid.
Note this may cause issues if plugins run concurrently.
2017-11-25 14:00:16 +00:00
Mike Auty
7a40d8128c
Add in support for the smb protocol when loading files.
2017-11-24 22:28:14 +00:00
Mike Auty
917829d87f
Reduce the number of times a ResourceAccessor is created, and use all handlers.
2017-11-24 22:27:36 +00:00
Mike Auty
30059766b6
Plug the WindowsMixin into the automagic.
2017-11-24 12:02:34 +00:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
3a591688a6
Add in a little more information about signatures.
2017-11-11 15:34:06 +00:00
Mike Auty
35d47b0fb0
Improve checks for invalid values
...
We determine address_masks using log/ln2, which cannot accept 0.
Therefore we don't support address spaces with a maximum_address of 0.
This can affect registry hives, so we've added a check in registry hives
to prevent creating layers with invalid maximum_addresses.
2017-11-11 15:15:14 +00:00
Mike Auty
527ef44800
Make sure the cell boundaries are checked correctly.
2017-11-09 23:13:38 +00:00
Mike Auty
497f0f4950
Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements.
2017-11-08 11:40:17 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
ba9ed5e3eb
Add minor comments about the jar uri scheme.
2017-11-08 00:13:26 +00:00
Mike Auty
adfc1f889a
Add a comment about caching files that have been unzipped.
2017-11-06 00:48:33 +00:00
Mike Auty
c0e2d7499a
Ensure that magic isn't a hard dependency.
...
We rely on file extensions, but if we throw an Exception on a bad file
extension then it's not really our fault.
2017-11-05 22:46:24 +00:00
Mike Auty
71d938d78b
Add in support for looking for symbols in zip files.
...
We use the jar scheme because that's actually registered with the right
bodies, even if the syntax is a bit weird. The contents is still
processed by the ResourceAccessor meaning it can be compressed with any
of the supported compression methods.
2017-11-05 22:29:46 +00:00
Mike Auty
a21d0c174a
Fix the magic detection and add logging to the ResourceAccessor.
2017-11-05 22:29:37 +00:00
Mike Auty
b6d932f4a5
Refactor the ResourceAccessor because it isn't an interface.
...
It's not strictly limited to layers either, but I don't really want to
create a whole extra generic file to put this in, so layers will do.
2017-11-05 21:27:56 +00:00
Mike Auty
a4b4a8eed3
Improve the error handling with automagics.
2017-11-04 18:45:08 +00:00
Mike Auty
d9d67efa3a
Add in the capability to stash linux_banners.
...
Since the stacker and Linux automagic will always be different objects
(even if they're the same class), and we don't want to add OS specific
code to the stacker, this is the simplest way of allowing the Linux
symbol automagic to get information from the dtb finding stacker.
2017-11-04 17:09:59 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
4b7543f2f4
Unify the resource opening.
2017-11-02 21:46:39 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
f085c9d2e3
Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX.
2017-10-09 01:41:08 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty