Mike Auty
943c625d5a
Ensure VMware fails back to flat with zero region metadata files.
2016-12-26 22:48:29 +00:00
Mike Auty
ba7275f973
Allow relative file paths in the pdb scanner prefix variable, for the documentation.
2016-12-26 18:47:06 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
3578768e2d
Correct odd/unnecessary typo.
2016-12-25 22:38:02 +00:00
Mike Auty
011b6dc3f4
Add in the object_factory capability and use it by example in pslist.
2016-12-25 19:02:48 +00:00
Mike Auty
8e334ca086
Remove fallthrough/default natives from symbol_spaces.
2016-12-25 18:37:54 +00:00
Mike Auty
fb8143f7f4
Ensure Intermediate natives include their table name during resolution.
2016-12-25 18:35:13 +00:00
Mike Auty
433f47c458
Allow casting to inherit the symbol table of its parent.
2016-12-25 18:34:14 +00:00
Mike Auty
1c3638d6c5
Allow native tables to accept and purpetuate table names.
2016-12-25 18:33:04 +00:00
Mike Auty
627bdd74a5
Allow developers to see when an exception has occurred with their scanner.
2016-12-25 17:43:10 +00:00
Mike Auty
34b3f75b99
Fix up the physical layer scanner appropriately.
2016-12-25 17:39:56 +00:00
Mike Auty
f03f99e64c
Ensure the non-multithreaded scanner works the same way as the multithreaded one.
2016-12-25 17:26:06 +00:00
Mike Auty
a4f27e73f4
Refactor the scanners to allow multithreaded searching.
2016-12-25 17:01:05 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
c5cd3595de
Fix up minor typo and hard depend on >= python 3.4.
2016-12-25 13:44:03 +00:00
Mike Auty
60bf657895
Allow pickling of FileLayers by unsetting the file (it'll be reopened as soon as a read happens).
2016-12-25 00:02:42 +00:00
Mike Auty
e230bbf6a8
Ensure we don't ever get in a loop looking up ._vol (could happen when pickling/unpickling).
2016-12-25 00:02:11 +00:00
Mike Auty
d51dd2a992
Add in TODOs for future heuristic enhancements.
2016-12-24 19:45:02 +00:00
Mike Auty
6a0b0d71c0
Remove debugging code that shouldn't have made it in the final code.
2016-12-24 19:41:58 +00:00
Mike Auty
3aa187e293
Fix minor lint with docstring.
2016-12-22 16:00:58 +00:00
Mike Auty
23e61d9756
Add in a little more information to the debug log.
2016-12-22 16:00:46 +00:00
Mike Auty
bbabf4db0e
Add in a heuristic for finding the correct DTB on recent Win10.
...
This removes again the single_page_map_offset configuration value,
and requires that a full/correct config be used to supply a manual DTB
value.
The expectation is that the single_page_map_offset feature be
re-introduced but override *all* scanning (so the scanning doesn't take
place even if the stacking does).
2016-12-22 15:44:07 +00:00
Mike Auty
70314386c8
Fix a rather critical issue with the end condition for a scanned range (and reduce the overlap if it's unnecessarily large).
2016-12-22 15:41:00 +00:00
Mike Auty
d669b57546
Rewrite our fallback virtual kernel offset algorithm.
2016-12-21 16:54:35 +00:00
Mike Auty
aad6aa9b4d
Rewrite the intel scanning engine (and fix up the internal _translate function to include the mapped layer).
2016-12-21 16:53:52 +00:00
Mike Auty
9ca001df8b
Allow start/end positions on the pdb scanning.
2016-12-21 02:28:03 +00:00
Mike Auty
591d9eba27
Add in better bounds checking for the scan call.
2016-12-21 02:20:47 +00:00
Mike Auty
56388fc903
Fix up the incorrect scanning boundaries.
2016-12-21 01:45:44 +00:00
Mike Auty
76f435e519
Update schemas to be more strict on providing all the required information.
2016-12-20 10:49:23 +00:00
Mike Auty
c6d5eef2f9
Fix up a documentation warning.
2016-12-20 09:00:17 +00:00
Mike Auty
7a1fcec1b5
Change subtype to base_type to match the __init__ parameter name.
2016-12-20 08:31:01 +00:00
Mike Auty
1e6911b753
Create appropriate VolTemplateProxy classes for BitField and Enumeration.
2016-12-20 08:29:41 +00:00
Mike Auty
a7d3a95ad0
Fix BitFields (and Enumerations) to accept only Integer basetypes and derive from them properly.
2016-12-20 08:25:55 +00:00
Mike Auty
60c3fbc5ce
Don't cache failures and add additional logging for the long schema validation pause.
2016-12-19 21:49:14 +00:00
Mike Auty
bbb07b49c0
Ensure we enforce requirements on the schemas (these should always have been in place, so no version bumps).
2016-12-18 22:10:01 +00:00
Mike Auty
0f548e864c
Add in comment in case of mutability trouble in the Struct TemplateProxy.
2016-12-18 20:52:38 +00:00
Mike Auty
2323e15ec3
Clarify in the documentation that these updates are transient.
2016-12-18 19:38:22 +00:00
Mike Auty
be075939d2
Remove flags as a fully-fledged object until it's been discussed
2016-12-18 19:38:05 +00:00
Mike Auty
a8b4db3ee3
Don't forget to also clone during intermediate format native creation.
2016-12-18 19:25:27 +00:00
Mike Auty
09ee0e6258
Fix fairly deep flaw where resolved templates could be modified by casting or creating an object.
2016-12-18 19:21:27 +00:00
Mike Auty
1754f3bc85
Attempt to fix up any possible re-encoding issues the str() call in the renderer might bring.
2016-12-18 16:58:58 +00:00
Mike Auty
190bcd7bf1
Include an initial flags object.
...
This might get removed, given it could be achieve with a wrapper rather
than a fully defined Object.
2016-12-18 16:29:19 +00:00
Mike Auty
54678823f8
Refactor BitField subtype to base_type to match enums (and fix a minor enum typo too).
2016-12-18 16:12:08 +00:00
Mike Auty
45d37bb961
Remove misleading TODO.
2016-12-18 15:52:03 +00:00
Mike Auty
efad3362db
Reset the string encoding changes, since we were doing it right the first time.
2016-12-18 15:51:27 +00:00
Mike Auty
6f1a929f88
Refactor the location of windows extension classes.
2016-12-18 15:38:46 +00:00
Mike Auty
e4905febf9
Ensure all objects can be inherited from.
2016-12-18 15:38:11 +00:00
Mike Auty
6102054bb6
Enable string encoding and emphasize that max_length applies to bytes in memory not to number of characters in the string.
2016-12-18 15:37:05 +00:00
Mike Auty
65ef2927a3
Refactor the enumeration_choices code into the existing weak_resolve code.
2016-12-18 02:53:07 +00:00
Mike Auty
b2701d7ba6
Update inaccurate error message.
2016-12-18 02:48:46 +00:00
Mike Auty