Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Andrew Case and ikelos
984615ebba
fix plugins for new API
2018-12-27 22:41:03 +00:00
Andrew Case and ikelos
2a0aec8104
switch linux_lsmod to absolute_symbol_addresses interface
2018-12-27 22:41:03 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e3ab3b1c8f
Make certain methods protected, otherwise they should be classmethods.
2018-12-19 22:48:16 +00:00
Mike Auty
189c8786f1
Rename filt to filter_func (because we value clarity over brevity) and another small fix.
2018-12-19 22:46:33 +00:00
Mike Auty
70e8204113
Fix up linux version of mmap_iter property to get_mmap_iter.
2018-12-19 22:38:43 +00:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
9b951d5fbe
More typing additions and fixes.
2018-12-16 15:21:41 +00:00
Mike Auty
35ad2325a8
Move all core plugins over to framework/plugins.
...
This should have no impact functionality-wise.
The statistics plugin was left out a) as an example and b) because it
was committed by mistake in the first place and was never meant to be a
real plugin.
2018-12-16 13:40:15 +00:00
Mike Auty
f57bfa5738
Prepare core plugins for moving into the framework namespace.
2018-12-09 13:32:32 +00:00
Mike Auty