Mike Auty
3f70ee92be
Improve the debugging output for unknown registry node signatures.
2017-10-09 00:54:02 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
fadb421331
Improve the support for signatures of cells.
2017-10-09 00:19:05 +01:00
Mike Auty
757837633f
Make sure we don't lose volatile bit for members.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
c6724a538a
Initial support for compressed files.
2017-08-11 01:12:50 +01:00
Mike Auty
807b5dcaf0
Ensure we throw an appropriate error if there's no patterns available.
2017-07-16 22:52:56 +01:00
Mike Auty
c4fbaf248e
Max the number of hash buckets needed precise, and explicitly linked to the hash function.
2017-07-16 01:27:20 +01:00
Mike Auty
f9375d0797
Reduce pointless memory usage, and remove old imports and debugging exception handlers.
2017-07-16 01:23:31 +01:00
Mike Auty
0ca78bc890
Add an efficient multi-string search module (based on Wu-Manber 1994).
...
Empirically this seems far quicker than either Aho-Corasick or
Commentz-Walter for our dataset (very many long search terms).
2017-07-16 01:13:49 +01:00
Mike Auty
2b718f104d
Remove imports that will break the code.
2017-07-14 01:15:52 +01:00
Mike Auty
dd7c9d777a
Refactor the scanners to allow for better organization.
2017-07-13 01:30:01 +01:00
Mike Auty
761777c8ef
Add commentary as to why we can't scan faster by ignoring surjective duplicates.
2017-06-03 20:57:19 +01:00
Mike Auty
c05599d78a
Minor clean-up of segmented layer.
2017-06-03 20:26:45 +01:00
Mike Auty
b72c3aaed5
Handle invalid translations lower than the top layer when scanning.
2017-06-03 20:26:21 +01:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
6da8076050
Add in Regular Expression scanner.
2017-05-06 14:02:09 +01:00
Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
687da20cbc
Fix up a typo @npetroni pointed out.
2017-04-20 23:11:42 +01:00
Mike Auty
d6728fc2b4
Add in attributes and appropriate validation of TranslationLayers based on those attributes.
2017-02-10 13:57:44 +00:00
Mike Auty
1437e24b53
Add a note about _maxphyaddr.
2017-01-02 22:17:35 +00:00
Mike Auty
3aec66333e
Allow the vmware stacker to ask the FileLayer it's on top of what filename it had.
2016-12-29 15:10:21 +00:00
Mike Auty
bab71d4358
Refactor the progress_callback so it can be used in automagics.
...
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.
The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
943c625d5a
Ensure VMware fails back to flat with zero region metadata files.
2016-12-26 22:48:29 +00:00
Mike Auty
a4f27e73f4
Refactor the scanners to allow multithreaded searching.
2016-12-25 17:01:05 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
60bf657895
Allow pickling of FileLayers by unsetting the file (it'll be reopened as soon as a read happens).
2016-12-25 00:02:42 +00:00
Mike Auty
aad6aa9b4d
Rewrite the intel scanning engine (and fix up the internal _translate function to include the mapped layer).
2016-12-21 16:53:52 +00:00
Mike Auty
cad0cf2d4f
Improve vmware segment calculations.
2016-12-14 01:31:22 +00:00
Mike Auty
eec68707bd
Improve the vmware layer (not sure it's finished yet though).
2016-12-14 00:28:05 +00:00
Mike Auty
fa427d2a2b
Add in the starts of a vmware layer and stacker.
2016-12-13 02:21:15 +00:00
Mike Auty
21c4e4bdef
Refactor the segmented layer out of lime for use with other layers.
2016-12-11 19:13:35 +00:00
Mike Auty
13b1126b90
Guard against no progress_callback in intel layer.
2016-12-08 16:03:22 +00:00
Mike Auty
183ff67699
Attach the kernel virtual offset to intel spaces.
2016-12-07 16:00:31 +00:00
Mike Auty
20d0e83e1d
Ensure we don't ever round down when log-ing.
2016-12-07 00:05:47 +00:00
Mike Auty
734b9a68b8
Ensure we use math.log correctly.
...
This is unlikely to ever happen (since we use python3)
but still just as well to implement in case something else
similar comes up.
https://www.willmcgugan.com/blog/tech/post/finding-the-first-bit-set-with-python/
2016-12-06 23:40:21 +00:00
Mike Auty
a0f7c81128
Reveal the register size in intel spaces.
2016-12-04 02:14:54 +00:00
Mike Auty
d2fcc1d4b0
Add in optimization technique to reduce the number of pages that are scanned more than once.
2016-11-19 23:34:08 +00:00
Mike Auty
c9abd290ec
Remove an unnecessary test from the intel scan loop.
2016-11-19 18:05:41 +00:00
Mike Auty
f707c0c4e9
Add in first shot at an 'efficient' virtual memory scanner. Uses page misses to calculate skipping distances.
2016-11-18 17:14:48 +00:00
Mike Auty
096e2f4610
Make the paged exceptions more useful at knowing how big an area is unavailable.
2016-11-18 11:40:48 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
824ad5b143
Add in the LimeStacker, and fix the lack of appropriate information on LimeLayer creation.
2016-08-26 08:35:09 +01:00
Mike Auty