Commit Graph
225 Commits
Author SHA1 Message Date
Mike Auty f898dca296 Refactor SymbolRequirement to SymbolTableRequirement for clarity. 2019-02-06 21:26:32 +00:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty 0ee335237a Improve the protection of empty regular expressions (improves issue #61). 2019-01-18 11:27:24 +00:00
Mike Auty b13fcb186c Improve typing issues. 2019-01-03 01:13:53 +00:00
Mike Auty 6bb927ebfa Fix up terminology to ensure we only refer to layers not spaces. 2019-01-03 00:40:13 +00:00
Mike Auty 040da46deb Fix up the descriptions for non-simple requirements. 2019-01-03 00:39:53 +00:00
Mike Auty afdd8b657e Fix memory problems with banner_caches.
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required.  As the cache builders are separate at the
moment, we previously ran banner searches without any banners.  This was
bad.  It inflated memory hugely and killed the buildbot.

We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Mike Auty d676d29c8b Remove author lines with permission.
So that we don't get contributions that include author lines remove any
that exist currently in the code.  We need to figure out how we're going
to support attribution, probably through an AUTHORS file, but definitely
not peppering the code.
2018-12-20 09:16:35 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Mike Auty 7f973f9e3e Refactor the ResourceAccessor so it can be used by layers. 2018-12-17 19:38:18 +00:00
Mike Auty 0462c98f44 Fix up vmss/vmsn typo. 2018-12-17 18:10:17 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty 2c72439334 Add in protections for the crashdump layer. 2018-12-13 22:59:21 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 5e8ba16709 Remove the unimplemented hook. 2018-12-13 01:16:05 +00:00
Mike Auty 7c4cb0d291 Remove attempts to improve speed that may not help. 2018-12-13 01:16:05 +00:00
Mike Auty da2f3b38d3 Add in page-table repetition blocking code (helps with windows 10 virtual space). 2018-12-13 01:16:05 +00:00
Mike Auty 91b2c61803 Try to add some optimizations to intel scanning. 2018-12-13 01:16:05 +00:00
Mike Auty b148305f76 Add in protection for the Lime Layer being unable to read the header. 2018-12-12 23:42:31 +00:00
Mike Auty 4703f192e4 Add in a check to ensure mappings that ignore errors don't cause errors. 2018-12-01 21:33:09 +00:00
Mike Auty f1c5b3ca29 Improve the typing in places. 2018-10-11 11:14:29 +01:00
Mike Auty de3bfad135 Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError. 2018-09-28 12:44:19 +01:00
Mike Auty 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). 2018-09-20 16:14:57 +01:00
Mike Auty ac8401991c Convert all remaining plugins to use the new classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty ddeacd3524 Fix up my mistaken advice. 2018-06-16 09:56:10 +01:00
Dave Lassalleandikelos a0edd1e38e root_cell_offset changes seem to have fixed maxaddr problems 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos f2029d5657 add comment about registry key case sensitivity and re-work root_cell_offset 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos b85c143af9 yield UnreadableValues when key not found, and set default RootCell on exception 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 201fc5780a don't use BaseBlock.Length for maxaddr 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 0c3866ef77 make registry path comparison case insensitive 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos abfcdba524 add Windows 10 Registry process support 2018-06-04 20:17:28 +01:00
Mike Auty 9711793503 Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions. 2018-06-04 09:40:26 +01:00
Mike Auty 7a52ac9deb Fix a large number of typing issues.
There are several instances where mypy didn't detect

if blah is not None:
    blah = thing

and so were rewritten as:

blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty 8bc5a4e898 Ensure maxaddr is never includes the volatile bit. 2018-05-23 19:41:13 +01:00
Mike Auty 347b4854ff Comment out the HBIN size check for now
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty 689756dc9a Deal with NULL base blocks in the registry code. 2018-05-20 23:25:20 +01:00
Mike Auty 037ac28534 Move around the scanning functions and create an API for the iterators. 2018-05-14 01:03:43 +01:00
Mike Auty 04d609064a Remove TODO that's in the wrong place, and we've just to-done. 2018-05-13 21:32:05 +01:00
Mike Auty 63a1fb3690 Simplify intel scanning to ensure overlaps are handled correctly. 2018-05-13 20:57:11 +01:00
Mike Auty a07691b04f Ensure scanners don't return duplicates in the overlap. 2018-05-13 20:55:54 +01:00
Mike Auty 8b5c58fee9 Fix up slight intel scanner issue. 2018-05-13 15:46:02 +01:00
Mike Auty 5c0140ed74 Fix typo in intel scanning engine. 2018-05-10 02:40:08 +01:00
Mike Auty 83eb346ba5 Clarify logic and fix an issue in intel scanning. 2018-05-10 02:13:46 +01:00
Mike Auty 19b8a0f696 Improve scan chunking for intel layers
We now use mapping to skip unmapped pages when scanning.  This
should be slightly quicker and likely more accurate.  We also now
don't chunk over the size requested by the scanner.  We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty b791b6c1a1 Add an ignore_errors check for positive lengths. 2018-05-09 01:16:47 +01:00
Mike Auty 983eabac86 Fix an issue with IntelPAE's mapping domain size. 2018-05-08 00:02:14 +01:00
Mike Auty e53cb16485 Vastly speed-up intel memory traversals
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer.  This means large holes in the memory
can be skipped more quickly.  It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00