iMHLv2
770dba1f0a
use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr
2017-07-19 18:12:50 +00:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
Mike Auty
e2450a0458
Add in more debugging information.
2017-07-19 17:52:19 +01:00
Mike Auty
edcfda0688
Change the stacking order, to ensure Lime gets loaded before linux.
2017-07-17 22:51:42 +01:00
Mike Auty
d2eef99e37
Don't try making URIs into URIs.
2017-07-17 21:52:01 +01:00
Mike Auty
9f3470a8e9
Speed up linux caching by allowing lack of validation. This should NOT be enabled without knowing exactly what you're doing.
2017-07-17 21:47:31 +01:00
Mike Auty
d49e956546
Improve file URL handling.
2017-07-17 18:33:45 +01:00
Mike Auty
e152f929e0
Ensure we unquote the parse URL path when opening standard files.
2017-07-17 18:22:12 +01:00
Mike Auty
f2bfd39c57
Add in more debugging information.
2017-07-17 17:17:46 +01:00
Mike Auty
23ccb4d4c8
Fix the real root cause, files not containing a banner.
2017-07-17 17:11:05 +01:00
Mike Auty
9b9792f3e2
Ensure we save the results of checking for non-existant files.
2017-07-17 17:06:52 +01:00
Mike Auty
5ca4f8e788
Use a central bit of code to do the load and unload of cached linux banners.
2017-07-17 16:38:25 +01:00
Mike Auty
f6a55876d0
Add in check to avoid unsightly exceptions.
2017-07-17 16:19:36 +01:00
Mike Auty
8b95480e88
Write the cached linuxbanners after each one so that cancellations don't require re-runs.
2017-07-16 22:59:01 +01:00
Mike Auty
807b5dcaf0
Ensure we throw an appropriate error if there's no patterns available.
2017-07-16 22:52:56 +01:00
Mike Auty
b68932a7bc
Improve the linux DTB finding code.
2017-07-16 18:05:19 +01:00
Mike Auty
d0b1177c31
Add in the linux signature scanner.
2017-07-16 18:05:08 +01:00
Mike Auty
b099822ce2
Refactor requirement finding recursion since we use it a lot.
2017-07-16 18:04:22 +01:00
Mike Auty
c4fbaf248e
Max the number of hash buckets needed precise, and explicitly linked to the hash function.
2017-07-16 01:27:20 +01:00
Mike Auty
f9375d0797
Reduce pointless memory usage, and remove old imports and debugging exception handlers.
2017-07-16 01:23:31 +01:00
Mike Auty
0ca78bc890
Add an efficient multi-string search module (based on Wu-Manber 1994).
...
Empirically this seems far quicker than either Aho-Corasick or
Commentz-Walter for our dataset (very many long search terms).
2017-07-16 01:13:49 +01:00
Mike Auty
8c4bdc8c61
Change the behaviour of multithreaded scans to return results as soon as possible (at the cost of ordering).
2017-07-14 01:16:30 +01:00
Mike Auty
2b718f104d
Remove imports that will break the code.
2017-07-14 01:15:52 +01:00
Mike Auty
a4bb297db7
Improve the progress calculator for multithreaded progress.
2017-07-13 01:31:47 +01:00
Mike Auty
a5e8d98a9c
Refactor the location of the linux banner cache.
2017-07-13 01:31:19 +01:00
Mike Auty
dd7c9d777a
Refactor the scanners to allow for better organization.
2017-07-13 01:30:01 +01:00
Mike Auty
2453b7f180
Add a little information to the log to see when the cache is being built.
2017-07-10 01:24:52 +01:00
Mike Auty
d1cdf805df
Update the comments slightly.
2017-07-10 01:20:01 +01:00
Mike Auty
0811bdaa1a
Add in initial version of linux banner cache mechanism.
2017-07-10 01:17:09 +01:00
Mike Auty
9127f1827f
Carry out the base64 decoding when the symbol is constructed.
2017-07-10 00:06:17 +01:00
Mike Auty
d80fbf1a69
Fix validation typo preventing the newer symbols from properly working.
2017-07-10 00:04:29 +01:00
Mike Auty
f12ab2a460
Move the symbol paths into the constants package.
2017-07-10 00:02:31 +01:00
Mike Auty
5675942050
Add in symbol constant_data and bump the schema to 0.4.1.
...
Special thanks to @npetroni for having to suffer a very long discussion
with me about my need for things to have particular names because I
don't know the field very well. 5:S Sorry! 5:)
2017-07-08 21:50:25 +01:00
Mike Auty
2efbd3dd68
Ensure framework plugins are loaded just like non-framework plugins.
2017-07-01 22:22:43 +01:00
Mike Auty
8625343792
Add the ability to create 'hidden' classes.
...
These will not be returned as part of the subclasses of
their descendents when listed using the classes_subclasses function.
They can be inherited from and their descendents will be listed unless
they also specify the hidden property and mark it as True
(ideally, using the class decorator hide_from_subclasses).
2017-07-01 22:19:50 +01:00
Mike Auty
d79d428edc
Ensure we use the native dictionary for more recent IFF versions (and correct issues with pointers and chars).
2017-06-23 15:44:58 +01:00
Mike Auty
df527d2f00
Convert from abstractproperty which was deprecated in python-3.3.
2017-06-20 15:14:13 +01:00
Mike Auty
d0ebeab253
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-06-05 23:01:34 +01:00
Mike Auty
5dedf00f64
Update the linux automagic based on the VMCOREINFO structure.
2017-06-05 23:01:22 +01:00
Mike Auty
761777c8ef
Add commentary as to why we can't scan faster by ignoring surjective duplicates.
2017-06-03 20:57:19 +01:00
Mike Auty
c05599d78a
Minor clean-up of segmented layer.
2017-06-03 20:26:45 +01:00
Mike Auty
b72c3aaed5
Handle invalid translations lower than the top layer when scanning.
2017-06-03 20:26:21 +01:00
Mike Auty
0675350346
Fix up minor logical error in multithreaded scanning global flag.
2017-06-03 17:49:56 +01:00
Mike Auty
c862f38917
Add in flag to forcibly disable all multithreaded scanning.
2017-06-03 17:48:32 +01:00
Mike Auty
9a2bfe7c92
Remove unused variable.
2017-06-03 17:44:59 +01:00
Mike Auty
93a6efd666
Ensure we don't get name confusion when dealing with variables.
2017-06-03 17:44:13 +01:00
Mike Auty
bc4c386d6d
Fix a multiprocessing issue (and tidy away the kwargs).
...
By not passing the arguments from exceptions down to the
base class Exception, it causes an issue when they are
pickled to be passed between processes. For more information,
see http://bugs.python.org/issue1692335 .
2017-06-03 12:41:18 +01:00
Mike Auty
fc325f8324
Ensure the pdb scanning heuristic works with 32-bit systems as well as 64-bit ones.
2017-06-01 23:52:30 +01:00
Mike Auty
904a5b18a3
Try to bomb out of the NlpDtbFinder if the space already has a dtb.
2017-06-01 01:00:49 +01:00
Mike Auty
bcfc40acfe
Fix egregious typo. 5:S
2017-06-01 00:56:40 +01:00
iMHLv2