Mike Auty
df41a0cf50
Fix up Vad extensions now that Chars are ints rather than bytes.
2019-02-06 21:08:52 +00:00
Mike Auty
0a13942cd7
Add a missing property keyword for the metadata method.
2019-02-06 17:46:07 +00:00
Mike Auty
71fb77f624
Remove the mis-committed print statements. 5;)
2019-02-06 09:14:03 +00:00
Michael Ligh
f61fba8e00
the vad end should be the last byte in the last page (i.e. ending in 0xfff)
2019-02-05 21:05:17 -06:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
b13fcb186c
Improve typing issues.
2019-01-03 01:13:53 +00:00
Andrew Case and ikelos
984615ebba
fix plugins for new API
2018-12-27 22:41:03 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
70e8204113
Fix up linux version of mmap_iter property to get_mmap_iter.
2018-12-19 22:38:43 +00:00
Mike Auty
af8719d299
Keep a separate list of resolve symbols, in case they share the name of a type.
2018-12-19 19:43:27 +00:00
Mike Auty
2a3b7348be
Add in minor changes and remove the duplicate plugins for mac.
2018-12-19 01:01:53 +00:00
Andrew Case and ikelos
6d582a8a68
remove while 1 and broad exception catching
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
19d39e53ff
add docstrings for malfind
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
a98995aa4e
remove unnecesary calls to int()
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
1dba08c005
remove try/except block that should have been removed originally
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
8f213a95d7
vol_class -> CPPObject
2018-12-19 00:54:51 +00:00
Mike Auty
857c970125
Update typing to match master.
2018-12-19 00:54:51 +00:00
Mike Auty
3a2d3c604f
Tidying. Renaming variables to avoid shadowing of classes, etc.
2018-12-19 00:54:51 +00:00
Mike Auty
c5ebf91915
Yapf reformat of the patches.
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
6aac0571e6
add support for objective C classes in OSX and json format
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
12e470ab55
add malfind plugin part 2 (extension update)
2018-12-19 00:54:51 +00:00
Mike Auty
f4544fec05
Yapf reformat and change map_iter property to get_map_iter function.
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
c0581eeeea
newest updates
2018-12-19 00:54:51 +00:00
Mike Auty
7f973f9e3e
Refactor the ResourceAccessor so it can be used by layers.
2018-12-17 19:38:18 +00:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
b61ac3bd47
Many more typing fixes.
2018-12-17 01:17:06 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
9824538bd9
Numerous pycharm warnings resolved
...
This includes:
* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
0abaa3af2f
Don't load all symbols when we ask to import symbols.
2018-12-14 00:27:46 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
f41e3e0453
Completely rework the primitive data format system.
2018-12-13 18:33:42 +00:00
Mike Auty
6b480eed56
Fix up PE data construction code.
2018-12-13 18:33:42 +00:00
Mike Auty
b533d19f83
Refactor the data extraction for primitive types.
2018-12-13 18:33:42 +00:00
Mike Auty
a78452e361
Fix up ugly int128 hack with a slightly nicer hack.
2018-12-13 15:56:24 +00:00
Mike Auty
1341925160
Remove unnecessary requirements method.
2018-12-13 15:56:24 +00:00
Andrew Case and ikelos
622c86f9ed
Add initial mac backend code, with broken DTB finding, along with the pslist plugin
2018-12-13 15:56:24 +00:00
Mike Auty
c9a08603c7
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
2018-12-13 01:39:26 +00:00
Mike Auty
dfaaf1e455
Fix up some things missed in the master refactor.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
736a1c6e50
add is_valid() for _FILE_OBJECT and _EPROCESS
2018-12-13 01:16:05 +00:00
Mike Auty
76264cee34
Catch invalid _OBJECT_HEADER objects.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
650a188d51
updates for win8/win10 poolscanning
2018-12-13 01:16:05 +00:00
Mike Auty
fa033b8ab7
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
2018-12-13 01:16:05 +00:00
Mike Auty
eacc45dab6
Ensure POOL_HEADER finds the right object in the right symbol table.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d653839359
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d667a68f97
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
a76d71a7dc
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Mike Auty
8acbe8bba3
Refactor conversion code from objects.utility to a conversion module in renderers.
2018-12-12 23:39:10 +00:00
Mike Auty
1a5c9d3af8
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
2018-12-12 23:38:01 +00:00
Mike Auty
b5d532555c
Convert the adhoc scanner into a layer scanner using sections.
2018-12-08 18:21:39 +00:00
Mike Auty