superponible and ikelos
57166fa549
change method for detecting win7
2018-08-29 21:51:52 +01:00
superponible and ikelos
93e05f4def
longer loop variable names
2018-08-29 21:51:52 +01:00
superponible and ikelos
dcb4ae08e3
change check for valid node path
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
c7e0ff9fa0
docstring and comment about get() vs _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
0d12a6dbf3
alternative to RegValueTypes enum in lieu of _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
4b500b66e9
fix variable name mismatch
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
d6a1e9acfc
add an optional filter to hivelist to return only matching names
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
32bcdf2ebc
add userassist types to registry.json
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
823cbddef5
fix an off by one error in printing hex
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
ebd528610d
initial userassist plugin
2018-08-29 21:51:52 +01:00
Michael Ligh and ikelos
6862573734
only ask for the requirements that we need
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
617510f6d6
change how we iterate through the symbol_generator results
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
ea63c7e80e
define a find_address() method for consistent behavior for 32 and 64-bit systems
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
45ea3437f1
explicitly list the nt_symbols requirement
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
13e5145e46
use from ... import ... statements
2018-08-29 15:10:46 +01:00
Michael Ligh and ikelos
34bb059cfe
add the ssdt plugin for windows
2018-08-29 15:10:46 +01:00
Mike Auty
b84a7abd37
Ensure we only offer the configuration options we use.
2018-08-28 22:39:40 +01:00
Mike Auty
244af47a2a
Swap inheritted config options for explicit config options.
2018-08-28 22:32:52 +01:00
Mike Auty
ee38c9c4fe
Add in caching for the lengthy symbol sorting.
2018-08-23 17:29:16 +01:00
Mike Auty
b74eb68c04
Pull the check on layer names out so that DataLayerInterface types get it as well.
2018-08-22 09:33:47 +01:00
Mike Auty
ec3c6f34b8
Convert malfind to classmethod convention (and fix a broken protect_values call).
2018-08-17 11:03:49 +01:00
Mike Auty
981d333195
Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError.
2018-08-17 10:52:48 +01:00
Mike Auty
218567c228
Allow Context.module to create a SizedModule if a size is provided.
2018-08-09 14:53:21 +01:00
Mike Auty
0a55a7c3f2
Introduced SizedModules to simplify when we just don't care about the size.
2018-08-09 14:42:18 +01:00
Mike Auty
0f08432aa5
Refactor Symbol interface to SymbolInterface.
2018-08-09 14:28:08 +01:00
Mike Auty
366269deb2
Refactor Module in interfaces to ModuleInterface.
2018-08-09 13:55:16 +01:00
Mike Auty
9e4875009d
Move the horrendously slow no-module-size calculation to an on-demand calculation.
2018-08-09 13:39:07 +01:00
Mike Auty
99f8859549
It turns out that cloning native_templates was unnecessary or slow. Fix and document why clearly.
2018-08-09 12:49:51 +01:00
Mike Auty
19bdc367bf
Add in a new exception for when expected data structures cannot be found.
2018-08-08 21:26:25 +01:00
Mike Auty
60f31852b9
Add in basic documentation covering an example plugin.
2018-08-08 00:41:08 +01:00
Mike Auty
d092a0614d
Add in volatility 3 basics documentation.
2018-08-06 14:21:33 +01:00
Mike Auty
e19ac82480
Improve generator documentation.
2018-08-05 16:26:27 +01:00
Mike Auty
d08c29ffab
Improve style to use default iterators rather than explicit ones.
2018-08-05 16:18:53 +01:00
Mike Auty
b1d46f843b
Convert documentation to napoleon/Google format docstrings.
2018-08-05 15:52:12 +01:00
Mike Auty
7fc19ef110
Updating typing information.
2018-08-05 15:02:11 +01:00
Mike Auty
eb08fb9e96
Convert the pdb scanner to use the kernel module names constants.
2018-08-04 12:34:18 +01:00
Mike Auty
105816beeb
Add in Windows specific constants for kernel modules (whose symbol tables are loaded by automagic).
2018-08-02 10:59:14 +01:00
Mike Auty
bca972f28a
Remove the python implementation of __getattribute__ for speed.
...
The __getattribute__ method is called for *all* attribute lookups, and
the python implementation is likely slow. The only function the python
implementation provided was to check that properties started with
helper_. Since this only provided a log message, we could add it back
in only if the log level is high enough? Either way, it's not
significant enough to warrant costing extra time in every attribute
lookup on every object.
2018-07-30 23:58:02 +01:00
Mike Auty
552101b593
Attempt to reduce the amount of time taken in calling templates.
2018-07-30 23:53:00 +01:00
Mike Auty
79d2bab44d
A few additional typing fixes.
2018-07-22 13:29:43 +01:00
Mike Auty
4897b7ab81
Fix up some typing errors.
2018-07-22 13:19:20 +01:00
Mike Auty
717aabf190
Mask off more symbols files and IDEs.
2018-07-22 12:00:31 +01:00
Mike Auty
b6b4c44300
Ensure cross-platform support for linux_cache.
2018-07-22 11:55:10 +01:00
Michael Ligh and ikelos
3d7c10dd32
add the cmdline plugin for windows
2018-07-19 21:26:32 +01:00
Mike Auty
2f3f291e53
Fix up missing parameter in symbol_space.
2018-07-19 09:54:56 +01:00
Mike Auty
2f28dfa6c9
Support finding symbols by ranges.
2018-07-19 09:51:51 +01:00
Mike Auty
083fd43890
Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset.
2018-07-19 09:22:57 +01:00
Mike Auty
3ba628da7a
Add in NotAvailableValue for specific uses.
2018-07-18 22:44:27 +01:00
Mike Auty
106a0cb6fd
Rework the array_of_pointers utility function.
...
It now makes use of the original array's symbol table to get the pointer
template, such that the size of the pointer is correct according to the
original table. Resolves "pointer.size" attribute errors (firing inside
a property and thus throwing off unusual exceptions).
2018-07-18 22:35:13 +01:00
Mike Auty
5c41e05876
Improve Module construction.
...
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.
We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
2018-07-18 21:46:56 +01:00
