Mike Auty
5db6ade2ea
Change object_type parameter for object_from_symbol.
2019-08-14 20:50:42 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
991b30e056
Typing fix-ups.
2019-08-14 20:50:42 +01:00
Mike Auty
65f561be31
Limit modules to only accepting strings not templates.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
superponible and ikelos
95ac651f7e
make get_maxaddr private and rename maxaddr variables for clarity
2019-08-13 20:37:46 +01:00
superponible and ikelos
0a5861350a
use UnreadableValue
2019-08-13 20:37:46 +01:00
superponible and ikelos
3361d77d17
remove redundant log message
2019-08-13 20:37:46 +01:00
superponible and ikelos
ef7e7fd905
only catch InvalidAddressException
2019-08-13 20:37:46 +01:00
superponible and ikelos
317c1cdb7b
store cmhive name instead of _cmhive
2019-08-13 20:37:46 +01:00
Dave Lassalle and ikelos
60193b2a3f
remove HBIN bounds check
2019-08-13 20:37:46 +01:00
Dave Lassalle and ikelos
0e22eea58d
improved exception handling in registry and printkey
2019-08-13 20:37:46 +01:00
Mike Auty
8e4fd03190
Improve the help for the renderer global CLI option.
2019-08-12 00:35:17 +01:00
Mike Auty
fb68e22767
Expose the context for a module, so we don't have to ship both around.
2019-08-12 00:17:09 +01:00
Mike Auty
39fa9057ff
Remove errant scan_kernel from svcscan for rekall.
2019-08-11 23:32:34 +01:00
Mike Auty
bbac649a62
Remove the dependency on pdbparse since pdbparse-to-json is no longer necessary.
2019-08-11 17:39:34 +01:00
Mike Auty
75f386784a
Clean up development directory.
2019-08-11 17:33:53 +01:00
Mike Auty
0b71c1130f
Add in the image-hash to make results easier to match up.
2019-08-11 17:19:59 +01:00
Mike Auty
196da74fdb
Fix up a manual typo (and remove trailing spaces).
2019-08-11 17:16:57 +01:00
Mike Auty
40d04ed1ff
Improve comparison titles, store stderr and output up until timeout.
2019-08-11 11:33:42 +01:00
Mike Auty
cdc19ad5fa
Add in 5 minute timeout for comparison tests.
2019-08-10 18:58:47 +01:00
Mike Auty
4cde0da8a9
Support passing through functions from specific to generic template.
2019-08-10 00:25:21 +01:00
Mike Auty
b2da35c05a
Revert "Apply relative offsets to type_name as well as symbol_names for modules."
...
This reverts commit d67fcc9a6a
2019-08-10 00:23:18 +01:00
Mike Auty
d67fcc9a6a
Apply relative offsets to type_name as well as symbol_names for modules.
2019-08-09 20:08:05 +01:00
Mike Auty
8ddfe8ce16
Update plugins using the old PESymbolTable method
2019-08-09 00:49:05 +01:00
Mike Auty
6f7dc1a75e
Add in the scan_kernel parameter for rekall to offer a fair comparison.
2019-08-08 23:20:59 +01:00
Mike Auty
a412d3ef2f
Guard against list size returns.
2019-08-08 20:30:33 +01:00
Mike Auty
1120854350
Ensure we descend LF_MODIFIERs when finding forward referenced array sizes.
2019-08-08 17:15:25 +01:00
Mike Auty
fbeab3608c
Make we raise if the _POOL_HEADER type doesn't exist.
2019-08-08 01:09:56 +01:00
Mike Auty
253ce69fc9
Refactor poolscanner layer to move more into the parallel scanner.
2019-08-07 18:37:56 +01:00
Mike Auty
9ed1a5a5b6
The header is not dependent on the constraint, so only construct it once.
2019-08-07 16:33:13 +01:00
Mike Auty
e3057e305d
Support parallelism on CLI.
2019-08-07 11:44:29 +01:00
Mike Auty
6c23968a11
Add in support for choosing specific frameworks to test.
2019-08-06 13:32:03 +01:00
Mike Auty
f8587a08f2
Refactor and add support for testing rekall.
2019-08-05 01:20:24 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty
f9e22d02de
Further typing discrepancy fixes.
2019-07-30 22:14:19 +01:00
Mike Auty
282ddc2f07
Fix up more little math typos and try to clarify what counter is where.
2019-07-30 22:14:19 +01:00
Mike Auty
4a7151a23f
Ensure the 'stream not present' indicator is adhered to.
2019-07-30 22:14:19 +01:00
Mike Auty
f3d7de4558
Fix up consumption of padding.
2019-07-30 22:14:19 +01:00
Mike Auty
0302f4b96a
Change calculations to not alter original values for clarity.
2019-07-30 22:14:19 +01:00
Mike Auty
bd2e948d9e
Fix up size for Unions but also ensure total sizes aren't used in calculations.
2019-07-30 22:14:19 +01:00
Mike Auty
6bcb23ea87
Consumed length of enums and FieldLists was slightly off.
2019-07-30 22:14:19 +01:00
Mike Auty
7a0b71f7ae
Fix an issue we hit 1 in 1000 times.
...
Turns out, that because the name consumption is fairly lax (often lots
of excess space after the name, etc) we were reading 2 too many bytes
(because we weren't taken the length of the leaf off the available
length). This would error when it so happened that a structure was at
the end of the type list and we'd read past the end of the tpi stream.
2019-07-30 22:14:19 +01:00
Mike Auty
e729877d38
Better error handling in the MSF layer.
2019-07-30 22:14:19 +01:00
Mike Auty
848fe7391a
Add in further pointer fixes.
2019-07-30 22:14:19 +01:00
Mike Auty
927bcd3318
Only use different pointers when necessary.
2019-07-30 22:14:19 +01:00
Mike Auty
72b78fb94d
Initially attempt at sorting out pointer issues.
2019-07-30 22:14:19 +01:00
Mike Auty
f8ce286894
Add downloading progress when retrieving PDBs.
2019-07-30 22:14:19 +01:00
Mike Auty
a788856fd3
Ensure the CLI version of mspdb provides progress.
2019-07-30 22:14:19 +01:00
Mike Auty