Mike Auty
4bf0a97703
Revert "Refactor the ordering of things in CrashDump initializer."
...
Allowed a configuration to be accessed before full initialization, so no
need for CrashDump changes.
This reverts commit ac57255b23
2019-04-27 22:06:58 +01:00
Mike Auty
9ce139d4e2
Allow configs to potentially be accessed before initialization has happened.
2019-04-27 22:06:39 +01:00
Mike Auty
ca46f090c2
Fix up pdbparse GUID parsing to use Bytes.
2019-04-27 22:02:02 +01:00
Mike Auty
ac57255b23
Refactor the ordering of things in CrashDump initializer.
2019-04-27 21:38:01 +01:00
Mike Auty
a7160dd6b6
Move the PDB downloading code and test for file writability.
2019-04-27 21:06:25 +01:00
Mike Auty
470d3906dc
Improve PDB parsing to include symbol undecoration.
2019-04-27 21:05:55 +01:00
Dave Lassalle and ikelos
61f9173bb6
initial hivescan plugin
2019-04-27 14:02:07 +01:00
Mike Auty
7c16c403d5
Ensure we delete the temorary file even if things go wrong.
2019-04-23 22:43:16 +01:00
Mike Auty
60144c44d3
Add in base-type generation for pdbconv.py.
2019-04-23 22:28:29 +01:00
Mike Auty
93ddb9596b
Add in base-type generator.
2019-04-23 21:37:51 +01:00
Mike Auty
9350f7b88a
Don't forget to cleanup.
2019-04-23 00:32:29 +01:00
Mike Auty
ac282d01fb
Add in initial support at automatic downloading.
2019-04-23 00:16:19 +01:00
Mike Auty
c229cf4db2
Fix schema issues with pdbconv and a couple small issues.
2019-04-23 00:15:49 +01:00
Mike Auty
a1f7d1a1de
Add in missing import.
2019-04-22 23:29:25 +01:00
Mike Auty
717f67fd1a
Clean up after downloading a PDB and support additional determining of size.
2019-04-22 21:09:17 +01:00
Mike Auty
d9d3a29b08
Remove llvm2json since pdbconv now exists.
2019-04-22 20:50:36 +01:00
Mike Auty
c07c4f5625
Add in pdb retreival and argparse support.
2019-04-22 20:49:30 +01:00
Mike Auty
75fb8aa301
Add in GUID production to pdbconv.
2019-04-22 14:41:08 +01:00
Mike Auty
81d5fdd58d
Add in some missing types.
2019-04-22 13:51:23 +01:00
Mike Auty
1f0947d7e1
Add in pdbconv script to completely generate the JSON from a PDB file using pdbparse.
2019-04-22 01:45:00 +01:00
Mike Auty
e468ab7f74
Setting loglevel to 0 doesn't work properly.
2019-04-21 13:22:22 +01:00
Mike Auty
5b0f99229c
Remove the VolTemplateProxy method proxying to fix the slowdown.
2019-04-18 01:48:56 +01:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
603512122d
Allow class_types to be specified as part of SymbolTable construction.
2019-04-18 01:03:59 +01:00
Mike Auty
8c76a25b2d
Allow VolTemplateProxies to include additional useful methods.
2019-04-17 23:53:36 +01:00
Mike Auty
e5d6cd3d16
Add in Enum ObjectTemplate lookup method.
2019-04-17 23:53:22 +01:00
Mike Auty
90ef8f363f
Have hivelist traverse in both directions in case of invalid addresses.
2019-04-11 00:38:46 +01:00
Mike Auty
45268245ca
Add in base __getattr__ to appease ObjectInterface vs Struct issues.
...
Consider revisiting this at some point, it immediately throws an
exception, so should cause significant slow downs (none detected on a
reasonably fast machine, although buildbot will give a better idea).
Without this a lot more specific typing will be required on the
expectation that Structs will be returned rather than any other type of
object.
2019-04-07 19:08:48 +01:00
Mike Auty
772a30403f
Add in renderer selection and a CSV renderer.
2019-04-07 19:07:32 +01:00
Mike Auty
5b8645bd1f
Revert IntFlag change until we drop python 3.5 support.
2019-04-05 22:56:36 +01:00
Mike Auty
db3c120aa7
Fix up typing for the import warning spec.
2019-04-05 14:53:41 +01:00
Mike Auty
af7d969ace
Fix up variable type assignment.
2019-04-05 14:51:23 +01:00
Mike Auty
87bf1da424
Don't use mutable defaults.
2019-04-05 14:50:39 +01:00
Mike Auty
cc3a9ea4d8
Fix locking type issue.
2019-04-05 14:50:22 +01:00
Mike Auty
fa94ef3271
Use the flag type for flags.
2019-04-05 14:49:44 +01:00
Mike Auty
c85430c28e
More typing fixes.
2019-04-05 14:24:08 +01:00
Mike Auty
f24fbe6f0f
Fix up alignment issue.
2019-04-05 12:43:13 +01:00
Mike Auty
223ad230cf
Fix up typing issues.
2019-04-05 12:37:57 +01:00
Mike Auty
301fac91ac
Add in initial renderer code for CLI table formatting.
2019-04-01 00:07:50 +01:00
Analyst
d44049121f
pefile APIs for accessing VS_FIXEDFILEINFO changed. this patch attempts to handle both older and newer versions
2019-03-30 16:06:09 -05:00
Mike Auty
9e727f6716
Attempt to fix windows OSError on certain datetimes.
2019-03-29 13:39:32 +00:00
Mike Auty
29aee0baff
Update TreeGrid documentation.
2019-03-29 11:49:10 +00:00
Analyst
5120860a60
fix two bugs that prevented poolscanners from working on 2012 samples
...
in 2012, cookie is None and will raise TypeError, so we need to catch that in addition to AttributeError. also, the Session pointer is always in the native layer
2019-03-25 09:51:55 -05:00
Analyst
93e66381ad
use an alignmemt based on the cpu arch, not the pool header size
...
this fixes an issue with pool scanning on win10 32-bit samples, because the size of a pool header increased to 16 bytes, but we still want 8 byte alignment on 32-bit machines
2019-03-20 11:53:26 -05:00
Michael Ligh
2138152b10
fix a bug in psscan on xp images
...
we need to get the kvo using the native_layer_name rather than the layer_name
2019-03-19 11:14:10 -05:00
Mike Auty
f1bbba1048
Make the comparison output quiet and ignore the volatility script name.
2019-03-15 14:43:15 +00:00
Mike Auty
372533b234
Improve registry subkey support (now recurses properly).
...
The old code didn't propertly recurse nodes beyond the first layer, and
also skipped entries in the top layer. Now we check the signature to
determine when/how to skip and we recurse down node lists that contain
further node lists.
2019-03-13 00:03:02 +00:00
Mike Auty
d15dd469b5
Add in a volatility3 vs volatility2 test-rig.
2019-03-10 12:35:33 +00:00
Mike Auty
0cb0150943
Add in optional dependency on schema validation.
2019-03-09 13:39:54 +00:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Mike Auty