Commit Graph
49 Commits
Author SHA1 Message Date
Mike Auty f898dca296 Refactor SymbolRequirement to SymbolTableRequirement for clarity. 2019-02-06 21:26:32 +00:00
Mike Auty 6bb927ebfa Fix up terminology to ensure we only refer to layers not spaces. 2019-01-03 00:40:13 +00:00
Mike Auty 040da46deb Fix up the descriptions for non-simple requirements. 2019-01-03 00:39:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). 2018-09-20 16:14:57 +01:00
Mike Auty ac8401991c Convert all remaining plugins to use the new classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty ddeacd3524 Fix up my mistaken advice. 2018-06-16 09:56:10 +01:00
Dave Lassalleandikelos a0edd1e38e root_cell_offset changes seem to have fixed maxaddr problems 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos f2029d5657 add comment about registry key case sensitivity and re-work root_cell_offset 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos b85c143af9 yield UnreadableValues when key not found, and set default RootCell on exception 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 201fc5780a don't use BaseBlock.Length for maxaddr 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 0c3866ef77 make registry path comparison case insensitive 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos abfcdba524 add Windows 10 Registry process support 2018-06-04 20:17:28 +01:00
Mike Auty 7a52ac9deb Fix a large number of typing issues.
There are several instances where mypy didn't detect

if blah is not None:
    blah = thing

and so were rewritten as:

blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty 8bc5a4e898 Ensure maxaddr is never includes the volatile bit. 2018-05-23 19:41:13 +01:00
Mike Auty 347b4854ff Comment out the HBIN size check for now
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty 689756dc9a Deal with NULL base blocks in the registry code. 2018-05-20 23:25:20 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty 6402c94078 Rework IntermediateSymbolFile loading to a classmethod. 2018-04-12 15:15:25 +01:00
Mike Auty 6482059521 Fix up typing issues identified by mypy. 2018-03-22 00:44:49 +00:00
Mike Auty dd41ea1cd1 Improve registry docstrings. 2018-03-11 21:40:54 +00:00
Mike Auty 18fa9e74d7 Add in the capability for get_key to return full node_paths.
Also resolves issue #18.
2018-03-11 21:25:58 +00:00
Mike Auty d4ea03f51d Add in hive offsets to printkey output. 2018-03-09 01:00:48 +00:00
Mike Auty bc8429a2b0 Convert all helper_ properties to get_ methods. 2018-03-09 00:47:00 +00:00
Mike Auty ac12098317 Add type-annotations for reamining layer files. 2017-12-13 20:48:52 +00:00
Mike Auty b075d8c31c Standardize on nt_symbols for standard symboltable requirements.
It's longer to type, but people shouldn't be typing it directly.
They should be pulling the value from the config and using that, which
can default to 'nt' if necessary.
2017-11-13 01:27:22 +00:00
Mike Auty 3a591688a6 Add in a little more information about signatures. 2017-11-11 15:34:06 +00:00
Mike Auty 35d47b0fb0 Improve checks for invalid values
We determine address_masks using log/ln2, which cannot accept 0.
Therefore we don't support address spaces with a maximum_address of 0.
This can affect registry hives, so we've added a check in registry hives
to prevent creating layers with invalid maximum_addresses.
2017-11-11 15:15:14 +00:00
Mike Auty 527ef44800 Make sure the cell boundaries are checked correctly. 2017-11-09 23:13:38 +00:00
Mike Auty 497f0f4950 Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements. 2017-11-08 11:40:17 +00:00
Mike Auty 2db214e2f8 Ensure we appropriately truncate unicode strings. 2017-11-08 01:00:53 +00:00
Mike Auty 01043b9f3e Rework isf_filename to isf_url since we can load it from a remote location if required. 2017-11-04 15:47:52 +00:00
Mike Auty 5ef65d6d38 Remove the ntkrnlmp name and use ntsymbols instead. 2017-11-01 21:23:44 +00:00
Mike Auty f085c9d2e3 Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX. 2017-10-09 01:41:08 +01:00
Mike Auty c09ce60f73 Support the new HMAP_ENTRY structure for Win10. 2017-10-09 01:40:37 +01:00
Mike Auty 3f70ee92be Improve the debugging output for unknown registry node signatures. 2017-10-09 00:54:02 +01:00
Mike Auty b8f545633d Ensure we do logging rather than printing. 2017-10-09 00:19:05 +01:00
Mike Auty 6c0d98ba1b Improve registry value handling. 2017-10-09 00:19:05 +01:00
Mike Auty 4fb24985eb Add in standard registry walking to the regtest plugin. 2017-10-09 00:19:05 +01:00
Mike Auty 023598a582 Additional improvements to the registry layer and cell/node handling. 2017-10-09 00:19:05 +01:00
Mike Auty fadb421331 Improve the support for signatures of cells. 2017-10-09 00:19:05 +01:00
Mike Auty 757837633f Make sure we don't lose volatile bit for members. 2017-10-09 00:19:05 +01:00
Mike Auty 19d66bd063 Add in current work in progress. 2017-10-09 00:18:15 +01:00
Mike Auty f538319d7c Add a little more code to the registry layer.
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures.  The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty 5a30ef3708 Start adding in some code for reading the registry. 2017-10-09 00:18:15 +01:00