Mike Auty
df41a0cf50
Fix up Vad extensions now that Chars are ints rather than bytes.
2019-02-06 21:08:52 +00:00
Mike Auty
71fb77f624
Remove the mis-committed print statements. 5;)
2019-02-06 09:14:03 +00:00
Michael Ligh
f61fba8e00
the vad end should be the last byte in the last page (i.e. ending in 0xfff)
2019-02-05 21:05:17 -06:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
b61ac3bd47
Many more typing fixes.
2018-12-17 01:17:06 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
f41e3e0453
Completely rework the primitive data format system.
2018-12-13 18:33:42 +00:00
Mike Auty
6b480eed56
Fix up PE data construction code.
2018-12-13 18:33:42 +00:00
Mike Auty
c9a08603c7
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
2018-12-13 01:39:26 +00:00
Mike Auty
dfaaf1e455
Fix up some things missed in the master refactor.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
736a1c6e50
add is_valid() for _FILE_OBJECT and _EPROCESS
2018-12-13 01:16:05 +00:00
Mike Auty
76264cee34
Catch invalid _OBJECT_HEADER objects.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
650a188d51
updates for win8/win10 poolscanning
2018-12-13 01:16:05 +00:00
Mike Auty
fa033b8ab7
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
2018-12-13 01:16:05 +00:00
Mike Auty
eacc45dab6
Ensure POOL_HEADER finds the right object in the right symbol table.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d653839359
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d667a68f97
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
a76d71a7dc
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Mike Auty
8acbe8bba3
Refactor conversion code from objects.utility to a conversion module in renderers.
2018-12-12 23:39:10 +00:00
Mike Auty
1a5c9d3af8
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
2018-12-12 23:38:01 +00:00
Mike Auty
5dea1968bb
Fix up _MMVAD_SHORT context typo.
2018-12-01 16:27:52 +00:00
Mike Auty
e27ba8d089
Fix up naming for objects/symbols_utility imports.
2018-11-08 00:48:38 +00:00
Mike Auty
e6711f580d
Add required poolheader types and change the PoolHeaderSymbolTable to match the inheritted constructor signature.
2018-10-24 19:31:22 +01:00
Mike Auty
d799d4edd8
Add additional typing information.
2018-10-11 16:41:59 +01:00
Mike Auty
d829028a36
Apply various type annotation/bug fixes.
2018-10-05 00:16:42 +01:00
Mike Auty
f044569613
Fix up catching the wrong exception type (and the lack of context).
2018-10-04 02:07:33 +01:00
Mike Auty
77a894b224
Convert 64bit checks to a symbol utility function.
2018-10-03 23:36:28 +01:00
Michael Ligh
97ae236fcc
add the pool header json files to be used when kernels fail to define their own _POOL_HEADER
2018-10-03 17:07:07 -05:00
Mike Auty
da6d211a40
The isf_url parameter is never populated, so this can go away.
2018-10-03 21:32:31 +01:00
Mike Auty
c0b7376226
Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist.
2018-09-30 17:00:25 +01:00
Mike Auty
de3bfad135
Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError.
2018-09-28 12:44:19 +01:00
Mike Auty
222b5f14a7
There is no need to cast as ord.
2018-09-16 16:24:34 +01:00
Mike Auty
90d13be9a9
Ensure we pass the native_layer_name whenever constructing a subobject.
2018-09-16 15:59:30 +01:00
Mike Auty
569bc97bc2
Fix up the use of native_layer_name in the poolscanning code.
2018-09-16 15:31:50 +01:00
Michael Ligh and ikelos
ac60d36e04
pass in native_layer_name to _POOL_HEADER.get_object() and remove FIXME
2018-09-15 15:22:38 +01:00
Michael Ligh and ikelos
88f73365ee
remove vol magic comment
2018-09-15 15:22:38 +01:00
Michael Ligh and ikelos
668f8ad037
add pydocs to windows extension classes
2018-09-15 15:22:38 +01:00
Michael Ligh and ikelos
5d20faa0a7
work on _POOL_HEADER.get_object()
2018-09-15 15:22:38 +01:00
Michael Ligh and ikelos
be6a351a11
start adding the _POOL_HEADER extension. expand the pool constraints to include processes
2018-09-15 15:22:38 +01:00
superponible and ikelos
26a4eb66d9
move import to the top
2018-08-30 10:57:18 +01:00
superponible and ikelos
f5e075ab72
change comment to docstring
2018-08-30 10:57:18 +01:00
superponible and ikelos
eb9a426760
switch enum.Enum to enum.IntEnum
2018-08-30 10:57:18 +01:00
Dave Lassalle and ikelos
c676f17fc8
refs #39 - update _CM_KEY_BODY.get_full_key_name()
2018-08-30 10:57:18 +01:00
Mike Auty
3a6b4ad35c
Add in the has_member method for objects and templates.
2018-08-29 22:54:56 +01:00
Dave Lassalle and ikelos
c7e0ff9fa0
docstring and comment about get() vs _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
0d12a6dbf3
alternative to RegValueTypes enum in lieu of _missing_()
2018-08-29 21:51:52 +01:00
Mike Auty