Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
17a3f1630c
Add back in the masking, since it is important if maxmium_address is ever not 1 less than a power of 2.
2017-05-10 17:37:38 +01:00
Mike Auty
a05a470347
Fix up some complete and utter daftness, tactfully pointed out by npetroni.
2017-05-10 17:30:45 +01:00
Mike Auty
4065cfa090
Add in first draft of Linux identification stacker.
2017-05-06 14:09:49 +01:00
Mike Auty
6da8076050
Add in Regular Expression scanner.
2017-05-06 14:02:09 +01:00
Mike Auty
16b1aca56b
Make the WintelHelper documentation accurate again.
2017-05-06 10:56:21 +01:00
Mike Auty
fe04c423ab
Remove left-over debugging features that slowed down the NLP dtb finder.
2017-05-02 14:51:50 +01:00
Mike Auty
d579f7f583
Add in a condensed version of Nick Petroni's DTB finder/stacker code.
2017-05-01 16:11:00 +01:00
Mike Auty
6e9791deb0
Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles.
2017-05-01 15:59:24 +01:00
Mike Auty
7e1965715d
Ensure the pdbscanner can operate when not handed an appropriate intel layer.
2017-05-01 14:38:47 +01:00
Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty
f520176b2b
Move the wrapper out to stop it seeming like a method.
2017-04-26 15:01:49 +01:00
Mike Auty
0c689de244
Fix up numerous silly mistakes.
2017-04-26 14:57:40 +01:00
Mike Auty
1d39c68799
All templates are equal (not just ObjectTemplates).
2017-04-26 14:51:56 +01:00
Mike Auty
6c4bd65b8a
Change my mind on accepting a full symbol rather than just the type.
2017-04-26 10:04:40 +01:00
Mike Auty
f97a5b4700
All the object constructor to accept a Symbol as well as a name.
2017-04-26 09:59:47 +01:00
Mike Auty
4a55d927c1
Fix up population of type attributes in ISF files.
2017-04-25 23:05:48 +01:00
Mike Auty
2523394118
Remove the deprecated utility adapters in favour of the initial Module implementation.
2017-04-23 17:19:22 +01:00
Mike Auty
7bf332617e
Remove non-determinism by favouring x64 (alphabetically lower). The bases detection requires improvement.
2017-04-23 02:43:08 +01:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
ff41d4e5b0
Improve config.json handling, making single_location optional but bypasses the stacker automagic.
2017-04-21 00:53:08 +01:00
Mike Auty
d37732e9b6
Add in array_to_string helper function.
2017-04-21 00:01:12 +01:00
Mike Auty
67015f3316
Fix up default logging levels.
2017-04-20 23:48:56 +01:00
Mike Auty
687da20cbc
Fix up a typo @npetroni pointed out.
2017-04-20 23:11:42 +01:00
Nick L. Petroni, Jr
f05df0c1cd
added Bin() to format_hints: print the value as a Python binary number
2017-04-17 14:05:50 -04:00
Mike Auty
0f9dbe3112
Fix up a small mistake in the interface version checking logic.
2017-03-29 20:29:19 +01:00
Mike Auty
dcc558717c
Shift around the object_factory and add the symbol rebaser.
...
The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
2017-03-24 01:50:16 +00:00
Mike Auty
1db4922033
Ensure we mimic python's errors as closely as possible.
2017-03-24 01:01:52 +00:00
Mike Auty
5d3677a0b9
Add an open method to IntermediateSymbolTable to load relative paths.
2017-03-24 00:47:26 +00:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
iMHLv2
7096f1853f
refer to self's symbol table when constructing objects inside an extension
2017-02-21 18:07:51 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
08eb2bce96
Add in schema 2.1.0 and supporting code changes.
2017-02-13 22:39:20 +00:00
Mike Auty
c0dfe48c05
Remove configurability of architecture, the translation layer should define the architecture internally.
2017-02-13 22:36:40 +00:00
Mike Auty
0d1dd2d2cd
Fix silly typo.
2017-02-13 21:30:23 +00:00
Mike Auty
d6728fc2b4
Add in attributes and appropriate validation of TranslationLayers based on those attributes.
2017-02-10 13:57:44 +00:00
Mike Auty
6603e503c5
Rework enumeration access in symbol tables.
2017-02-04 14:46:46 +00:00
Mike Auty
cd2eaeab06
Rename the imported context interface to match other examples in the code.
2017-01-23 01:12:44 +00:00
Mike Auty
96c414fb5f
Refactor TextRenderer to QuickTextRenderer to ensure we don't forget that the output is speedy not nicely formatted.
2017-01-22 14:17:19 +00:00
Mike Auty
a2eb60ed39
Add support for HexBytes to the text renderer.
2017-01-22 14:16:13 +00:00
Nick L. Petroni, Jr