Dave Lassalle and ikelos
c7e0ff9fa0
docstring and comment about get() vs _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
0d12a6dbf3
alternative to RegValueTypes enum in lieu of _missing_()
2018-08-29 21:51:52 +01:00
Dave Lassalle and ikelos
32bcdf2ebc
add userassist types to registry.json
2018-08-29 21:51:52 +01:00
Mike Auty
ee38c9c4fe
Add in caching for the lengthy symbol sorting.
2018-08-23 17:29:16 +01:00
Mike Auty
b74eb68c04
Pull the check on layer names out so that DataLayerInterface types get it as well.
2018-08-22 09:33:47 +01:00
Mike Auty
981d333195
Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError.
2018-08-17 10:52:48 +01:00
Mike Auty
218567c228
Allow Context.module to create a SizedModule if a size is provided.
2018-08-09 14:53:21 +01:00
Mike Auty
0a55a7c3f2
Introduced SizedModules to simplify when we just don't care about the size.
2018-08-09 14:42:18 +01:00
Mike Auty
0f08432aa5
Refactor Symbol interface to SymbolInterface.
2018-08-09 14:28:08 +01:00
Mike Auty
366269deb2
Refactor Module in interfaces to ModuleInterface.
2018-08-09 13:55:16 +01:00
Mike Auty
9e4875009d
Move the horrendously slow no-module-size calculation to an on-demand calculation.
2018-08-09 13:39:07 +01:00
Mike Auty
99f8859549
It turns out that cloning native_templates was unnecessary or slow. Fix and document why clearly.
2018-08-09 12:49:51 +01:00
Mike Auty
19bdc367bf
Add in a new exception for when expected data structures cannot be found.
2018-08-08 21:26:25 +01:00
Mike Auty
e19ac82480
Improve generator documentation.
2018-08-05 16:26:27 +01:00
Mike Auty
d08c29ffab
Improve style to use default iterators rather than explicit ones.
2018-08-05 16:18:53 +01:00
Mike Auty
b1d46f843b
Convert documentation to napoleon/Google format docstrings.
2018-08-05 15:52:12 +01:00
Mike Auty
7fc19ef110
Updating typing information.
2018-08-05 15:02:11 +01:00
Mike Auty
eb08fb9e96
Convert the pdb scanner to use the kernel module names constants.
2018-08-04 12:34:18 +01:00
Mike Auty
105816beeb
Add in Windows specific constants for kernel modules (whose symbol tables are loaded by automagic).
2018-08-02 10:59:14 +01:00
Mike Auty
bca972f28a
Remove the python implementation of __getattribute__ for speed.
...
The __getattribute__ method is called for *all* attribute lookups, and
the python implementation is likely slow. The only function the python
implementation provided was to check that properties started with
helper_. Since this only provided a log message, we could add it back
in only if the log level is high enough? Either way, it's not
significant enough to warrant costing extra time in every attribute
lookup on every object.
2018-07-30 23:58:02 +01:00
Mike Auty
552101b593
Attempt to reduce the amount of time taken in calling templates.
2018-07-30 23:53:00 +01:00
Mike Auty
79d2bab44d
A few additional typing fixes.
2018-07-22 13:29:43 +01:00
Mike Auty
4897b7ab81
Fix up some typing errors.
2018-07-22 13:19:20 +01:00
Mike Auty
b6b4c44300
Ensure cross-platform support for linux_cache.
2018-07-22 11:55:10 +01:00
Mike Auty
2f3f291e53
Fix up missing parameter in symbol_space.
2018-07-19 09:54:56 +01:00
Mike Auty
2f28dfa6c9
Support finding symbols by ranges.
2018-07-19 09:51:51 +01:00
Mike Auty
083fd43890
Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset.
2018-07-19 09:22:57 +01:00
Mike Auty
3ba628da7a
Add in NotAvailableValue for specific uses.
2018-07-18 22:44:27 +01:00
Mike Auty
106a0cb6fd
Rework the array_of_pointers utility function.
...
It now makes use of the original array's symbol table to get the pointer
template, such that the size of the pointer is correct according to the
original table. Resolves "pointer.size" attribute errors (firing inside
a property and thus throwing off unusual exceptions).
2018-07-18 22:35:13 +01:00
Mike Auty
5c41e05876
Improve Module construction.
...
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.
We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
2018-07-18 21:46:56 +01:00
Mike Auty
cc5b470602
Remove the caching to see if it's causing the exceptions.
2018-07-18 21:08:50 +01:00
Mike Auty
ce05510413
Additional fixes for module collections.
2018-07-18 14:35:54 +01:00
Mike Auty
91e94440fe
Add in hashing for module differentiation and additional collection features.
2018-07-18 00:42:48 +01:00
Mike Auty
5fbf923186
Fix documentation and try to guess the size where possible.
2018-07-17 21:15:09 +01:00
Mike Auty
8fd1196de7
Fix minor typo.
2018-06-25 00:22:00 +01:00
Mike Auty
9c06c25fae
Add in support for module sizes.
2018-06-25 00:16:17 +01:00
Mike Auty
c012842bd6
Refactor the name to be more accurate.
2018-06-21 00:27:38 +01:00
Mike Auty
aedcf40fc2
Add support for separate symbol_tables and name in Modules.
2018-06-21 00:25:55 +01:00
Mike Auty
ffa54c45eb
Fix linux invalid keyword argument bug.
2018-06-20 22:15:42 +01:00
Mike Auty
70abef1f46
Rework how we handle import errors.
2018-06-19 09:58:09 +01:00
Mike Auty
d9ed86bcc5
Ensure we return the correct values for dir().
2018-06-16 14:29:51 +01:00
Mike Auty
c0ec52822b
Add some typing fixes.
2018-06-16 14:19:36 +01:00
Mike Auty
ac8401991c
Convert all remaining plugins to use the new classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
86c5302c99
_missing_ was a python-3.6 feature.
2018-06-16 12:36:00 +01:00
Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
