Mike Auty
942de5f166
Finish adding type-annotations thoughout the code.
2017-12-13 20:48:52 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
ed716ca12a
Convert SymbolTableInterfaces to descend from ConfigurableInterface
...
This allows SymbolTables to hold actual requirements (which
IntermedSymbolTable already did, but without pulling in the right
interface). It means that values like kernel_virtual_offset get saved.
We still need to figure out how to allow plugins to demand optional
configuration values in other places (such as the kvo) but for now the
plugin will barf if it doesn't get it.
2016-12-12 02:08:32 +00:00
Mike Auty
e2d5f51ad5
Remove old and rotten code.
2016-12-12 00:25:03 +00:00
Mike Auty
c52bf7cb6f
Pull out the appropriate natives based on the intermediate format data.
2016-12-04 23:50:13 +00:00
Mike Auty
0b447b6958
Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying.
2016-10-26 01:09:29 +01:00
Mike Auty
e02feed16e
Python 3 has a sane super() implementation (no arguments), so convert to using that.
2016-08-14 00:55:02 +01:00
Mike Auty
b92ccd771f
Fix up the DTB finder code and stick it all together.
2016-07-30 02:35:40 +01:00
Mike Auty
43aba96e3f
Minor pylint (alphabetical imports) and refactoring the construct class to work for symbols.
2016-07-30 01:58:29 +01:00
Mike Auty
a8d6fd5647
Refactor windows code to windows basic to avoid import loops.
2016-01-16 20:09:18 +00:00
Mike Auty
d258c56991
Rerun pylint with pycharm-5 and fix pep8 issues as well.
2015-11-21 13:12:00 +00:00
Mike Auty
65fcd5fbe5
Minor pylinting.
2015-09-28 01:34:52 +01:00
Mike Auty
f04122f640
Add in initial implementation of ContextFactories as classes. This is probably not the right way to do things, so I'll be trying out making them as objects with a function chain for applying modifications in a little while.
2015-01-16 11:29:12 +00:00
Mike Auty
87967853f7
Convert volinfo namespace to vol namespace.
2015-01-05 15:04:40 +00:00
Mike Auty
7c53ae31bb
Fix up all the necessary components in the _LIST_ENTRY code.
2015-01-05 00:00:16 +00:00
Mike Auty
f64b232f5a
Add in the iter function now that we finally have the member_name stored.
2015-01-04 23:10:48 +00:00
Mike Auty
446536d789
Remove the concept of template_info and revert to structure_name alone.
2015-01-04 04:27:52 +00:00
Mike Auty
09ee972e7e
Add in initial version of _LIST_ENTRY.
2015-01-02 00:12:28 +00:00
Mike Auty
5655548d3f
Allow owning_process to be called without parameters.
2014-12-31 03:46:34 +00:00
Mike Auty
bdb0c1488a
Update test_rig code to play around with code fragments.
2014-12-31 03:20:32 +00:00
Mike Auty