Mike Auty
1a80dbf935
Change Unparsable to NotApplicable for situations we expect.
2018-03-10 21:43:46 +00:00
Mike Auty
1b067e7319
Convert recent merge request to use Unreadable/Unparsable/NotApplicable values.
2018-03-10 19:39:19 +00:00
Mike Auty
f8e87ede69
Convert merged changes from helper_ properties to get_ methods.
2018-03-10 19:33:29 +00:00
ikelos and GitHub
ca7405413b
Merge pull request #15 from volatilityfoundation/dave-pslist-columns
...
additional columns in windows.pslist
Just need to adapt it from `helper_` properties to `get_` methods...
2018-03-10 19:29:17 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Dave Lassalle
3c6121bc77
raise AttributeError in helper_wow_64_process()
2018-03-07 12:43:06 -06:00
Dave Lassalle
c0f62b4dd6
fix typo in property
2018-03-07 12:30:29 -06:00
Dave Lassalle
4b2c027b39
add __name__ to getLogger()
2018-03-07 11:32:10 -06:00
Dave Lassalle
349b2d1ada
add TODO to comments for followup on returning None
2018-03-07 11:31:43 -06:00
Dave Lassalle
8b6f88aa0c
additional columns in windows.pslist
2018-03-07 11:03:03 -06:00
Mike Auty
31b69671cb
Fix up inheritance and type-annotations (plus pylint/pycharm formatting).
2017-12-13 23:16:06 +00:00
Mike Auty
942de5f166
Finish adding type-annotations thoughout the code.
2017-12-13 20:48:52 +00:00
Mike Auty
ee12b81f4a
Add in type-annotations for renderers and start on symbols.
2017-12-13 20:48:52 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
0ecf68af0f
Support table remapping for referenced symbol names.
2017-11-27 14:39:46 +00:00
Mike Auty
9af49a49a9
Code improvement not to re-lookup the size of an unsigned int every turn of a loop.
2017-11-11 22:35:40 +00:00
Mike Auty
f58cdf73f1
Remove debugging print and use get_node rather than recasting.
2017-11-09 23:20:53 +00:00
Mike Auty
eb76cab749
Add in Big Data support.
2017-11-09 23:16:58 +00:00
Mike Auty
479848fde7
Improve subkey traversal by catering for various _CM_KEY_INDEX structures.
2017-11-08 11:41:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
bbae34f1d5
Attempt to resolve issues with <python-3.6 json module not loading bytes.
2017-11-06 10:09:44 +00:00
Mike Auty
71d938d78b
Add in support for looking for symbols in zip files.
...
We use the jar scheme because that's actually registered with the right
bodies, even if the syntax is a bit weird. The contents is still
processed by the ResourceAccessor meaning it can be compressed with any
of the supported compression methods.
2017-11-05 22:29:46 +00:00
Mike Auty
b6d932f4a5
Refactor the ResourceAccessor because it isn't an interface.
...
It's not strictly limited to layers either, but I don't really want to
create a whole extra generic file to put this in, so layers will do.
2017-11-05 21:27:56 +00:00
Mike Auty
f6ac9c8367
Remove a no longer used function, so it doesn't get stuck in the API forever.
2017-11-05 15:28:38 +00:00
Mike Auty
671f65ed56
Centralize the ISF locating code.
...
This might benefit from a recache of the linux banners, although it
should continue to work no recache is performed.
We're now in a position to add support for loading symbols directly from
zip files by altering the ResourceAccessor and adding code to the
symbol finder.
2017-11-05 15:18:20 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
4b7543f2f4
Unify the resource opening.
2017-11-02 21:46:39 +00:00
Mike Auty
dbc73df8f2
Make sure we support windows filenames
...
Consider refactoring out the various URL openning code into
one that just returns the open file handle. This would require changing
the config option of "filename" to "location" and rejigging a few other
bits elsewhere, but would centralize and make it more managable.
2017-11-02 11:56:03 +00:00
Mike Auty
5d2b0f9004
Add in support for determining if a key is volatile.
2017-10-23 17:09:25 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
587b6e9d9e
Add back in the deprecated helper for _CMHIVE.
2017-10-09 00:20:32 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
e90b4e2d02
Add and make use of free_table_name for symbol_spaces.
2017-09-03 22:54:42 +01:00
Mike Auty
aa87c87a22
Remove the additional import that was entirely my fault being there in the first place.
2017-08-16 21:40:58 +01:00
Nick L. Petroni, Jr
c4e6b07ee0
refactored constants.linux usage
2017-08-16 16:30:12 -04:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
eeeda60bfb
A couple more small documentation updates.
2017-08-11 19:30:39 +01:00
Mike Auty
e434909e50
Make SymbolTable.symbols consistent with enumerations and types.
2017-08-11 19:25:13 +01:00
Mike Auty
f7f1c1d5e0
Raise the right kind of exception in Intermediate Format SymbolTables.
2017-08-11 08:49:49 +01:00
Mike Auty
d32fc223e2
Fix up additional imports inconsistent with the coding style.
...
Note: also remove interfaces_configuration where ever possible
(this is not possible in the interfaces directory itself
because it would cause an import loop).
2017-08-09 22:32:44 +01:00
Mike Auty
bfb83f0c33
Fix up silly typo (and replace another hardcoded bang).
2017-08-09 21:34:26 +01:00
Mike Auty