Mike Auty
1a80dbf935
Change Unparsable to NotApplicable for situations we expect.
2018-03-10 21:43:46 +00:00
Mike Auty
1b067e7319
Convert recent merge request to use Unreadable/Unparsable/NotApplicable values.
2018-03-10 19:39:19 +00:00
Mike Auty
f8e87ede69
Convert merged changes from helper_ properties to get_ methods.
2018-03-10 19:33:29 +00:00
ikelos and GitHub
ca7405413b
Merge pull request #15 from volatilityfoundation/dave-pslist-columns
...
additional columns in windows.pslist
Just need to adapt it from `helper_` properties to `get_` methods...
2018-03-10 19:29:17 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Dave Lassalle
3c6121bc77
raise AttributeError in helper_wow_64_process()
2018-03-07 12:43:06 -06:00
Dave Lassalle
c0f62b4dd6
fix typo in property
2018-03-07 12:30:29 -06:00
Dave Lassalle
4b2c027b39
add __name__ to getLogger()
2018-03-07 11:32:10 -06:00
Dave Lassalle
349b2d1ada
add TODO to comments for followup on returning None
2018-03-07 11:31:43 -06:00
Dave Lassalle
8b6f88aa0c
additional columns in windows.pslist
2018-03-07 11:03:03 -06:00
Mike Auty
31b69671cb
Fix up inheritance and type-annotations (plus pylint/pycharm formatting).
2017-12-13 23:16:06 +00:00
Mike Auty
942de5f166
Finish adding type-annotations thoughout the code.
2017-12-13 20:48:52 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
9af49a49a9
Code improvement not to re-lookup the size of an unsigned int every turn of a loop.
2017-11-11 22:35:40 +00:00
Mike Auty
f58cdf73f1
Remove debugging print and use get_node rather than recasting.
2017-11-09 23:20:53 +00:00
Mike Auty
eb76cab749
Add in Big Data support.
2017-11-09 23:16:58 +00:00
Mike Auty
479848fde7
Improve subkey traversal by catering for various _CM_KEY_INDEX structures.
2017-11-08 11:41:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
5d2b0f9004
Add in support for determining if a key is volatile.
2017-10-23 17:09:25 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
587b6e9d9e
Add back in the deprecated helper for _CMHIVE.
2017-10-09 00:20:32 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
d32fc223e2
Fix up additional imports inconsistent with the coding style.
...
Note: also remove interfaces_configuration where ever possible
(this is not possible in the interfaces directory itself
because it would cause an import loop).
2017-08-09 22:32:44 +01:00
Mike Auty
bfb83f0c33
Fix up silly typo (and replace another hardcoded bang).
2017-08-09 21:34:26 +01:00
Mike Auty
fc0fa96ed8
Replace hardcoded exclamation marks for constants.BANG
2017-08-08 09:50:22 +01:00
Mike Auty
2caeeb275e
First stab at refactoring the add_process_layer code out of the Windows _EPROCESS structure.
2017-08-07 21:42:10 +01:00
iMHLv2
770dba1f0a
use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr
2017-07-19 18:12:50 +00:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
iMHLv2
7096f1853f
refer to self's symbol table when constructing objects inside an extension
2017-02-21 18:07:51 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
b4c36bcd15
Make the config_prefix parameter optional.
2017-01-04 22:29:47 +00:00
Mike Auty
3da5512fbd
Ensure we instantiate on the physical layer, not the existing kernel layer.
2017-01-02 22:21:39 +00:00
Mike Auty
24aecb49b7
Ensure we set the correct page_map_offset by masking it to the size of the physical register maximum.
2017-01-02 22:12:52 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
6f1a929f88
Refactor the location of windows extension classes.
2016-12-18 15:38:46 +00:00
Mike Auty
ed716ca12a
Convert SymbolTableInterfaces to descend from ConfigurableInterface
...
This allows SymbolTables to hold actual requirements (which
IntermedSymbolTable already did, but without pulling in the right
interface). It means that values like kernel_virtual_offset get saved.
We still need to figure out how to allow plugins to demand optional
configuration values in other places (such as the kvo) but for now the
plugin will barf if it doesn't get it.
2016-12-12 02:08:32 +00:00
Mike Auty
e2d5f51ad5
Remove old and rotten code.
2016-12-12 00:25:03 +00:00
Mike Auty