Mike Auty
4e08d6e414
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-06-01 00:34:42 +01:00
Mike Auty
6e80303e0c
Update pdbscanner to match the latest API.
2017-06-01 00:34:33 +01:00
ikelos and GitHub
5a691f3d2b
Merge pull request #6 from npetroni/linux-pslist-2017-05-14
...
initial linux.pslist.PsList plugin
2017-05-15 14:51:22 +01:00
Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
17a3f1630c
Add back in the masking, since it is important if maxmium_address is ever not 1 less than a power of 2.
2017-05-10 17:37:38 +01:00
Mike Auty
a05a470347
Fix up some complete and utter daftness, tactfully pointed out by npetroni.
2017-05-10 17:30:45 +01:00
Mike Auty
4065cfa090
Add in first draft of Linux identification stacker.
2017-05-06 14:09:49 +01:00
Mike Auty
6da8076050
Add in Regular Expression scanner.
2017-05-06 14:02:09 +01:00
Mike Auty
16b1aca56b
Make the WintelHelper documentation accurate again.
2017-05-06 10:56:21 +01:00
Mike Auty
fe04c423ab
Remove left-over debugging features that slowed down the NLP dtb finder.
2017-05-02 14:51:50 +01:00
Mike Auty
d579f7f583
Add in a condensed version of Nick Petroni's DTB finder/stacker code.
2017-05-01 16:11:00 +01:00
Mike Auty
6e9791deb0
Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles.
2017-05-01 15:59:24 +01:00
Mike Auty
7e1965715d
Ensure the pdbscanner can operate when not handed an appropriate intel layer.
2017-05-01 14:38:47 +01:00
Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty
d0580236b1
Add in the schema version 3.0.0.
2017-04-26 20:51:03 +01:00
Mike Auty
f520176b2b
Move the wrapper out to stop it seeming like a method.
2017-04-26 15:01:49 +01:00
Mike Auty
0c689de244
Fix up numerous silly mistakes.
2017-04-26 14:57:40 +01:00
Mike Auty
1d39c68799
All templates are equal (not just ObjectTemplates).
2017-04-26 14:51:56 +01:00
Mike Auty
6c4bd65b8a
Change my mind on accepting a full symbol rather than just the type.
2017-04-26 10:04:40 +01:00
Mike Auty
f97a5b4700
All the object constructor to accept a Symbol as well as a name.
2017-04-26 09:59:47 +01:00
Mike Auty
4a55d927c1
Fix up population of type attributes in ISF files.
2017-04-25 23:05:48 +01:00
Mike Auty
2523394118
Remove the deprecated utility adapters in favour of the initial Module implementation.
2017-04-23 17:19:22 +01:00
Mike Auty
7bf332617e
Remove non-determinism by favouring x64 (alphabetically lower). The bases detection requires improvement.
2017-04-23 02:43:08 +01:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
ff41d4e5b0
Improve config.json handling, making single_location optional but bypasses the stacker automagic.
2017-04-21 00:53:08 +01:00
Mike Auty
b6b984503f
Fix up help messages for plugins.
2017-04-21 00:52:06 +01:00
Mike Auty
d37732e9b6
Add in array_to_string helper function.
2017-04-21 00:01:12 +01:00
Mike Auty
67015f3316
Fix up default logging levels.
2017-04-20 23:48:56 +01:00
Mike Auty
687da20cbc
Fix up a typo @npetroni pointed out.
2017-04-20 23:11:42 +01:00
ikelos and GitHub
11b0b36d90
Merge pull request #5 from npetroni/binary-format-hint
...
added Bin() to format_hints: print the value as a Python binary number
2017-04-20 14:15:19 +01:00
Nick L. Petroni, Jr
f05df0c1cd
added Bin() to format_hints: print the value as a Python binary number
2017-04-17 14:05:50 -04:00
Mike Auty
0f9dbe3112
Fix up a small mistake in the interface version checking logic.
2017-03-29 20:29:19 +01:00
Mike Auty
dcc558717c
Shift around the object_factory and add the symbol rebaser.
...
The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
2017-03-24 01:50:16 +00:00
Mike Auty
1db4922033
Ensure we mimic python's errors as closely as possible.
2017-03-24 01:01:52 +00:00
Mike Auty
5d3677a0b9
Add an open method to IntermediateSymbolTable to load relative paths.
2017-03-24 00:47:26 +00:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
ikelos and GitHub
5c9a77128d
Merge pull request #4 from volatilityfoundation/dlllist
...
Add windows dlllist plugin and accompanying extensions
2017-02-21 22:35:40 +00:00
iMHLv2
7096f1853f
refer to self's symbol table when constructing objects inside an extension
2017-02-21 18:07:51 +00:00
iMHLv2
efd2468639
import modules rather than classes
2017-02-21 18:06:52 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty