Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Mike Auty
ac12098317
Add type-annotations for reamining layer files.
2017-12-13 20:48:52 +00:00
Mike Auty
b075d8c31c
Standardize on nt_symbols for standard symboltable requirements.
...
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty
3a591688a6
Add in a little more information about signatures.
2017-11-11 15:34:06 +00:00
Mike Auty
35d47b0fb0
Improve checks for invalid values
...
We determine address_masks using log/ln2, which cannot accept 0.
Therefore we don't support address spaces with a maximum_address of 0.
This can affect registry hives, so we've added a check in registry hives
to prevent creating layers with invalid maximum_addresses.
2017-11-11 15:15:14 +00:00
Mike Auty
527ef44800
Make sure the cell boundaries are checked correctly.
2017-11-09 23:13:38 +00:00
Mike Auty
497f0f4950
Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements.
2017-11-08 11:40:17 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
f085c9d2e3
Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX.
2017-10-09 01:41:08 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
3f70ee92be
Improve the debugging output for unknown registry node signatures.
2017-10-09 00:54:02 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
fadb421331
Improve the support for signatures of cells.
2017-10-09 00:19:05 +01:00
Mike Auty
757837633f
Make sure we don't lose volatile bit for members.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty