Mike Auty
734b9a68b8
Ensure we use math.log correctly.
...
This is unlikely to ever happen (since we use python3)
but still just as well to implement in case something else
similar comes up.
https://www.willmcgugan.com/blog/tech/post/finding-the-first-bit-set-with-python/
2016-12-06 23:40:21 +00:00
Mike Auty
40694ff26c
Add a note about precedence to the pdb loader.
2016-12-06 09:08:51 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty
1c7de06bd0
Fix up issue with pointer sizes. Since cls is never used we're not losing information.
2016-12-06 02:44:11 +00:00
Mike Auty
c52bf7cb6f
Pull out the appropriate natives based on the intermediate format data.
2016-12-04 23:50:13 +00:00
Mike Auty
770a8ee42a
Improve error handling to prevent endless recursion in template.__call__
2016-12-04 11:17:48 +00:00
Mike Auty
05ae4aa64a
Fix up offset for PAE.
2016-12-04 10:24:33 +00:00
Mike Auty
d8b72cfc14
Add in checks and set the appropriate kernel location for all architectures.
2016-12-04 02:17:11 +00:00
Mike Auty
a0f7c81128
Reveal the register size in intel spaces.
2016-12-04 02:14:54 +00:00
Mike Auty
4121895d4d
Ensure the kernel virtual to physical offset mapping is correct.
2016-12-04 01:21:10 +00:00
Mike Auty
2d9992fb83
Quick patch the CLI to accept filenames for testing.
2016-12-04 01:03:26 +00:00
Mike Auty
9af583d22e
Completely rework how pslist operates using the kernel_virtual_offset requirement.
2016-12-04 01:02:53 +00:00
Mike Auty
e1cc55aeed
Add in wchar to our set of bases for x64 systems.
2016-12-04 01:02:17 +00:00
Mike Auty
e27a444068
Very minimally fix up the docstring for a function.
2016-12-04 01:01:46 +00:00
Mike Auty
88f1166c6d
Add in a helper function that will likely be useful in the future.
2016-12-04 01:01:13 +00:00
Mike Auty
23fd704027
Add in the kernel offset recursion code.
2016-12-04 01:00:37 +00:00
Mike Auty
9a3402ccff
Fix the incorrect signature offset returned.
2016-12-03 21:39:04 +00:00
Mike Auty
e4e563ead0
Fix up the array slicing code.
2016-12-03 00:23:00 +00:00
Mike Auty
70815b0837
Shift the location of the pdbscan prefix/suffix values.
2016-12-02 21:44:23 +00:00
Mike Auty
ed552d20e8
Add in support for lzma compressed json data.
2016-12-02 01:34:07 +00:00
Mike Auty
c86f0ddef4
Add in a very rudimentary kernel PDB finding plugin that identifies and automatically loads the appropriate kernel for the image.
2016-11-27 23:40:19 +00:00
Mike Auty
b2c3c76954
Don't forget the fixes that still need to happen.
2016-11-19 23:41:35 +00:00
Mike Auty
72259008f3
Use the physical layer and improve the output.
...
The physical layer will miss certain patterns, but is an order of
magnitude faster at scanning. The main amount of time spent in scanning
Intel spaces is counting through every page in the address space (32, 40
or 64 bits), not the actual scanning. There's no real way around this
if you want to ensure you get every chunk of virtual memory. Since the
scanner could be stopped after its first hit, this might still be
preferable, but should not be the default (particularly for an automagic
scan).
2016-11-19 23:36:48 +00:00
Mike Auty
d2fcc1d4b0
Add in optimization technique to reduce the number of pages that are scanned more than once.
2016-11-19 23:34:08 +00:00
Mike Auty
c9abd290ec
Remove an unnecessary test from the intel scan loop.
2016-11-19 18:05:41 +00:00
Mike Auty
38b1c61acc
Remove debugging values from the pdb scanner.
2016-11-18 17:18:50 +00:00
Mike Auty
3c181e940e
Tidy up to use a single method for reading from the context.
2016-11-18 17:18:30 +00:00
Mike Auty
f707c0c4e9
Add in first shot at an 'efficient' virtual memory scanner. Uses page misses to calculate skipping distances.
2016-11-18 17:14:48 +00:00
Mike Auty
096e2f4610
Make the paged exceptions more useful at knowing how big an area is unavailable.
2016-11-18 11:40:48 +00:00
Mike Auty
f688af529b
Initial commit of pdb kernel scanning automagic code.
2016-11-18 11:39:55 +00:00
Mike Auty
96800818af
Show exceptions as debugging information when failed to validate, and allow disabling of cache.
2016-11-07 12:36:53 +00:00
Mike Auty
399e63d344
Update the schema so that bitfields can only be built on a base type.
2016-11-07 12:35:11 +00:00
Mike Auty
2f91cf32b7
Make the schema a little more strict.
2016-11-07 12:26:34 +00:00
Mike Auty
282eaa7f00
Improve/remove unnecessary imports.
2016-11-07 12:26:06 +00:00
Mike Auty
62fb752c82
Add in validation caching for JSON schema use and only record success when actual validation occurs.
2016-11-07 01:17:08 +00:00
Mike Auty
96a7a56edd
Commit the initial JSON schema for the intermediate format.
2016-11-06 01:48:01 +00:00
Mike Auty
7b12483719
Change version to format and move the delegate function factory outside of the class.
2016-11-06 01:33:51 +00:00
Mike Auty
f0c6b0d1a4
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-11-04 18:09:04 +00:00
Mike Auty
2dba1bbddd
Update wording to clarify the different between package version and interface version.
2016-11-04 17:56:58 +00:00
Mike Auty
11d60b9f7f
Update the accepted format version.
2016-11-03 01:03:38 +00:00
Mike Auty
28fdbbe348
Refactor the pdb names, to make the class more generic.
2016-11-03 00:53:08 +00:00
Mike Auty
df2172754c
Refactor the pdbscanning code so it doesn't sneak into the library accidentally.
2016-11-01 23:32:12 +00:00
Mike Auty
d6039fb899
Initial port of npetroni's pdbscanner (with bugfix for multiple RDRS entries in a single scan chunk).
2016-11-01 02:06:08 +00:00
Mike Auty
d57733d530
Add in support for format versioning.
2016-11-01 01:33:44 +00:00
Mike Auty
dc375024b2
Set the version back, given we're early enough to do so.
2016-11-01 00:41:20 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
f771de3703
Tidy up error messages.
2016-10-30 17:07:48 +00:00
Mike Auty
d1b58143fe
Add in UnresolvedTemplate type.
...
This template type allows objects that have not been able to be resolved
to exist within the symbol system. It emits a debug message on creation
so that intermediate format developers can identify potential issues,
but does not raise an exception so as to allow partial tables to be
used.
If the UnresolvedTemplate is called (to create an object) before the
symbol has been added to the symbolspace, it will fail with a
SymbolError (as thrown by the individual SymbolTable). For this reason,
the class has been made private to the SymbolSpace class to prevent
unexpected use.
2016-10-30 16:54:12 +00:00
Mike Auty
287baeb03a
Add in rudimentary symbol support to the intermediate format.
2016-10-26 01:49:52 +01:00
Mike Auty
6f1bdcb6cb
Refactor symbol.offset to symbol.address.
2016-10-26 01:42:37 +01:00
Mike Auty