 Mike Auty
|
5add8ea078
|
Remove the obsolete FIXME.
|
2018-09-15 15:23:43 +01:00 |
|
|
Michael Lighandikelos
|
fffdd253ae
|
use renderers.NotApplicableValue() for the poolscanner plugin's name field
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
ac60d36e04
|
pass in native_layer_name to _POOL_HEADER.get_object() and remove FIXME
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
88f73365ee
|
remove vol magic comment
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
668f8ad037
|
add pydocs to windows extension classes
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
0baa0ecdf5
|
Update the poolscanner to take care of multiple constraints with the same tag.
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
9d6055d2ba
|
add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
f02df7a92e
|
reduce the extra tag_type_map lookup by yielding the constraint from the pool scanner
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
5d20faa0a7
|
work on _POOL_HEADER.get_object()
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
be6a351a11
|
start adding the _POOL_HEADER extension. expand the pool constraints to include processes
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
ce4ed9fea8
|
Add in the start of actual output from the poolscanner.
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
56a5012a46
|
fix alignment, should offset be optional to context.module()? refactor pool type checks
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
8a5d3b0c1e
|
Initial poolscanning code.
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
00a7f9ce2d
|
Rework the way verinfo works.
|
2018-09-13 00:24:57 +01:00 |
|
|
Mike Auty
|
6dc8b4d517
|
Create a windows.registry category.
|
2018-09-12 22:55:41 +01:00 |
|
|
Mike Auty
|
fa552aa3b0
|
Add in the native_layer_name concept to ObjectInformation.
|
2018-09-12 22:45:34 +01:00 |
|
|
Mike Auty
|
dd5edc395a
|
Add in commented code for keeping the zip file in sync if we decide it's needed.
|
2018-09-03 22:14:48 +01:00 |
|
|
Mike Auty
|
abee0f8de7
|
Change the ASLR finding code to return no shift values (and log when it's found none).
|
2018-09-03 21:48:16 +01:00 |
|
|
Mike Auty
|
f584be8d18
|
Fix up the linux symbol caching code.
|
2018-09-03 21:39:48 +01:00 |
|
|
Mike Auty
|
0c46da22c3
|
Readd the check to ensure we don't stack on top of an existing Intel layer.
|
2018-09-02 19:03:39 +01:00 |
|
|
Mike Auty
|
7f966901cf
|
Ensure the dtb can't get specified from an earlier run around the loop.
|
2018-09-02 18:28:59 +01:00 |
|
|
Mike Auty
|
c1dc36a327
|
Fix up the breakage from the preivous commit.
|
2018-09-02 18:27:28 +01:00 |
|
|
Mike Auty
|
29f1a0f216
|
Change the default state for stacking to ensure layer isn't set unless successful.
|
2018-09-02 17:42:55 +01:00 |
|
|
Mike Auty
|
e665ec7505
|
Minor fix in Volshell.
|
2018-09-02 16:59:03 +01:00 |
|
|
Mike Auty
|
2d2b3c27dc
|
Fix up the symbols import in volshell.
|
2018-09-02 00:58:27 +01:00 |
|
|
Mike Auty
|
1299fa4a36
|
Fix up volshell failing on missing modules (eg, yara) and tart up the setup file.
|
2018-09-02 00:52:17 +01:00 |
|
|
Mike Auty
|
5668f271df
|
Fix issue when handling zip files on windows.
|
2018-09-02 00:13:33 +01:00 |
|
|
Mike Auty
|
3713e9484c
|
Add in a setup.py and fix up the documentation so setuptools can build it.
|
2018-09-01 22:28:03 +01:00 |
|
|
Mike Auty
|
312e74cd08
|
Improve typing information for verinfo.
|
2018-09-01 22:14:34 +01:00 |
|
|
Mike Auty
|
0550186ed2
|
Fix a couple bugs in moddump.
|
2018-09-01 22:04:51 +01:00 |
|
|
Mike Auty
|
dff7e6d6df
|
Add in support for specific symbol directories.
|
2018-09-01 21:57:49 +01:00 |
|
|
Mike Auty
|
9d05482e50
|
Make sure we appropriately use classmethods now they're in place.
|
2018-08-30 16:40:39 +01:00 |
|
|
Mike Auty
|
ce63ee2e83
|
Conver the verinfo plugin to using the classmethod moddump.
|
2018-08-30 12:03:17 +01:00 |
|
|
Mike Auty
|
edac0bee6f
|
Update moddump to use classmethods.
|
2018-08-30 12:03:17 +01:00 |
|
|
Mike Auty
|
5791cfaab7
|
Stop overriding the builtin filter method, and ensure suitable parameter names.
|
2018-08-30 11:41:19 +01:00 |
|
|
superponibleandikelos
|
26a4eb66d9
|
move import to the top
|
2018-08-30 10:57:18 +01:00 |
|
|
superponibleandikelos
|
f5e075ab72
|
change comment to docstring
|
2018-08-30 10:57:18 +01:00 |
|
|
superponibleandikelos
|
eb9a426760
|
switch enum.Enum to enum.IntEnum
|
2018-08-30 10:57:18 +01:00 |
|
|
Dave Lassalleandikelos
|
c676f17fc8
|
refs #39 - update _CM_KEY_BODY.get_full_key_name()
|
2018-08-30 10:57:18 +01:00 |
|
|
Mike Auty
|
f4dd40ba0b
|
Ensure we're catching the appropriate expcetions rather than all of them.
|
2018-08-30 09:41:39 +01:00 |
|
|
superponible
|
19dcb80de6
|
catch os detection exception, change loop break to continue
|
2018-08-29 20:59:42 -05:00 |
|
|
Mike Auty
|
cc99d08c88
|
Move userassist keys over to a JSON data file.
|
2018-08-30 00:52:02 +01:00 |
|
|
Mike Auty
|
93607b2586
|
Fix up exception catching with no exception specified.
|
2018-08-30 00:36:32 +01:00 |
|
|
Mike Auty
|
fe9a1617c9
|
Include printkey in the hivelist conversion.
|
2018-08-29 23:31:39 +01:00 |
|
|
Mike Auty
|
0aa6ba0fe0
|
Convert hivelist to classmethod style.
|
2018-08-29 23:29:51 +01:00 |
|
|
Mike Auty
|
059be517fc
|
Fix up minor typing issues.
|
2018-08-29 23:29:00 +01:00 |
|
|
Mike Auty
|
303c63da68
|
Revert userassist to creating a new layer for each userassist data.
|
2018-08-29 23:14:28 +01:00 |
|
|
Mike Auty
|
62451ecef6
|
Reformat code and use has_member instead of RelativeChildOffset.
|
2018-08-29 23:01:02 +01:00 |
|
|
Mike Auty
|
3a6b4ad35c
|
Add in the has_member method for objects and templates.
|
2018-08-29 22:54:56 +01:00 |
|
|
superponible
|
40b83c505a
|
refactor userassist, stop creating registry tables for each entry
|
2018-08-29 16:10:53 -05:00 |
|