Commit Graph
5288 Commits
Author SHA1 Message Date
Mike Auty 213eeda268 Core: Add module collection support 2021-07-22 22:37:58 +01:00
Mike Auty d2420899c5 Layers: Fix minor pointless typo 2021-07-22 22:37:45 +01:00
Mike Auty c993c35152 Core: Further python 3.6 fixes 2021-07-22 22:23:32 +01:00
Mike Auty 66c96644ac Core: Minor flynt and typing fixes 2021-07-22 21:36:37 +01:00
Mike Auty 787f61d5a7 Documentation: Update minimum python version. 2021-07-22 21:30:08 +01:00
Mike Auty 767eea614b Windows: Add extra checks to pdbscan 2021-07-19 12:31:13 +01:00
Mike Auty 59ab92e99d Development: Update development scripts with f-strings 2021-07-18 23:20:27 +01:00
Mike Auty 0d48261201 Core: Change all 3.5 type hints to variable annotations 2021-07-18 16:49:37 +01:00
Mike Auty 9f52a15734 Core: Convert to format strings across the whole base 2021-07-18 15:53:58 +01:00
ikelosandGitHub 99e959a15a Merge pull request #535 from gohar94/patch-2
Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
2021-07-14 16:54:17 +01:00
ikelosandGitHub d4c20648e0 Merge pull request #534 from volatilityfoundation/issues/issue_528_regvaluetypes
issue #528 - change how registry enum members are accessed
2021-07-14 16:52:07 +01:00
ikelosandGitHub df48d3a8d3 Merge pull request #533 from volatilityfoundation/issues/issue_457_registry_mapping_sids
Issues/issue 457 registry mapping sids
2021-07-14 16:51:12 +01:00
ikelosandGitHub f65199845d Merge pull request #523 from gcmoreira/issue-522-private-attr-name-mangled
Fix issue #522: private attribute names mangle
2021-07-14 16:25:01 +01:00
Mike Auty 3ca5461f95 Windows: Ensure suitable progress callback 2021-07-14 15:47:28 +01:00
Gustavo Moreira a795a7e2d5 Using double underscore in the find() will also include edge cases like when the calling class contains an underscore i.e. THE_CLASS 2021-07-14 20:45:43 +10:00
Gohar Irfan ChaudhryandGitHub e0f08cdead Windows: Fix up pdb.json for LF_UDT_MOD_SRC_LINE
The module field in `LF_UDT_MOD_SRC_LINE` should be `unsigned short` instead of `string` as per:
```
typedef struct lfUdtModSrcLine {
    unsigned short leaf;        // LF_UDT_MOD_SRC_LINE
    CV_typ_t       type;        // UDT's type index
    CV_ItemId      src;         // index into string table where source file name is saved
    unsigned long  line;        // line number
    unsigned short imod;        // module that contributes this UDT definition 
} lfUdtModSrcLine;
```
([source](https://github.com/microsoft/microsoft-pdb/blob/082c5290e5aff028ae84e43affa8be717aa7af73/include/cvinfo.h#L1707))

This also changes the size of the struct from 16 to 14.
2021-07-13 10:00:32 -07:00
superponible d613b384d2 #457 - raise log level and use f-strings 2021-07-12 21:55:30 -05:00
superponible 446510ab5f issue 528 - change how registry enum members are accessed 2021-07-12 11:40:30 -05:00
superponible a7cc978ac6 #457 - filter hives for getsids and getservicesids 2021-07-12 11:24:14 -05:00
superponible 8c7b6b29d1 #457 - include hive name in debug message 2021-07-12 11:24:14 -05:00
superponible 88a8cde9ac #457 - add debugging for registry mapping 2021-07-12 11:24:14 -05:00
Mike Auty 7f6378fd5d Automagic: Changing stacking order for linux/mac
The linux/mac stackers are more accurate (based on banners) than the
windows stacker (based on offsets).  As such in cases where both would
match, we should go for the more accurate match first (linux/mac) over
windows.  In most cases this will make no difference because of the
exclusion lists, so only one stacker will run, but in cases such as
volshell where all stackers are run, this may help with certain edge
cases.
2021-07-12 12:27:53 +01:00
Mike Auty e28910f670 Windows: Ensure we set the kernel_virtual_offset before other reqs
It appears in issue #524 that the step to fulfil symbol requirements
can throw an exception (which then prevents the kernel_virtual_offset
(which is optional) from being set appropriately.

This sets the kvo first and adds a check to where it's set.  It doesn't
get to the root of why an exception is thrown, but should ensure it's
easier to spot if it goes wrong.

Fixes #524.
2021-07-12 12:09:07 +01:00
Mike Auty c2b290dc42 Windows: Fix up pdb.json for LF_UDT_SRC_LINE
It looks like some copypasta snuck in the manual pdb.json.
The offsets for the LF_UDT_SRC_LINE as was the total structure size for
LF_UDT_MOD_SRC_LINE.

Fixes #527
2021-07-12 10:48:43 +01:00
Mike Auty 42ef21fd29 Documentation: Clarify linux ISF generation 2021-07-11 22:37:41 +01:00
ikelosandGitHub 4d9b2517c6 Merge pull request #498 from volatilityfoundation/windows_crashdump_fixes_jxwenger
complete windows crash dump support
2021-07-11 00:07:27 +01:00
iMHLv2 f1079e7e9b fix up required framework version for crashinfo 2021-07-10 08:32:40 -05:00
Gustavo Moreira e441742a83 Moving the if down after the concrete members are checked. 2021-07-01 08:21:18 +10:00
Gustavo Moreira ec04dc9caa Fix issue #522: private attribute names mangle
As per https://docs.python.org/3/tutorial/classes.html#private-variables
Python will mangle private attribute names from `__attrname` to `_classname__attrname` to avoid name clashes of names with names defined by subclasses.
This will happen even if subclasses are not involved i.e.: calling `type_member.__foo` from a plugin classmethod.
Note that `__foo` is not meant to be a Python private attribute, but the actual name of the type member.
Like sock.__sk_common here: https://github.com/torvalds/linux/blob/62fb9874f5da54fdb243003b386128037319b219/include/net/sock.h#L354

We need to strip the '_classname' prefix from the attribute's name before continuing with the member attribute lookup.
2021-06-30 13:25:07 +10:00
Gustavo Moreira 3d5df75377 Replacing 'while True' for 'while (condition)' 2021-06-29 16:03:45 +10:00
Gustavo Moreira 4ab0528a27 symtab_checks needs to be abstract. Added a doc string. 2021-06-29 15:19:37 +10:00
ikelosandGitHub af090bf29e Merge pull request #519 from fgomulka/tty-check-pointer-issue
Create a list_head to fix tty_check bug
2021-06-23 20:22:27 +01:00
Frank Gomulka dbae5d353d Create a list_head to fix tty_check bug
This commit casts `tty_driver` to a `list_head` to fix an
AttributeError in the linux tty_check plugin
2021-06-22 10:43:31 -04:00
Mike Auty b6165b439f Mac: Fix minor typo in previous fix 2021-06-07 01:44:21 +01:00
Mike Auty 772083ac75 Mac: Fix unguarded read in automagic #515 2021-06-06 11:50:23 +01:00
Mike Auty ed1320491c Poolscan: Further python 3.6 efficiencies 2021-06-04 22:19:12 +01:00
ikelosandGitHub 7aff6f6d8b Merge pull request #513 from bonafont/develop
Fixed CM_KEY_VALUE get_decode method
2021-06-04 22:16:16 +01:00
Anthony Fey a11c94a82b Fixed CM_KEY_VALUE get_decode method 2021-06-04 18:52:00 +02:00
ikelosandGitHub c3107986fc Merge pull request #401 from volatilityfoundation/issues/issue400
Objects: Avoid reconstructing pointed objects
2021-06-02 20:30:42 +01:00
iMHLv2 7d9c66c407 run yapf on the newly added files 2021-06-01 14:27:20 -05:00
iMHLv2 7b73f8d545 fix the copyright date for extensions/crash.py 2021-06-01 14:21:11 -05:00
iMHLv2 d2db22c310 use typing for the layer variable passed to _generator 2021-06-01 14:20:59 -05:00
iMHLv2 d285519ecb don't assume primary.memory_layer is a crash layer...instead, cycle through the layers until finding the crash layer 2021-06-01 14:17:31 -05:00
iMHLv2 a0adbde994 eliminate confusing single letter variable 2021-06-01 13:55:37 -05:00
iMHLv2 b15e69e11d ensure the crashinfo plugin gets a crash layer 2021-06-01 13:55:21 -05:00
ikelosandGitHub 7ef7dd88f0 Merge pull request #510 from volatilityfoundation/revert-507-issues/issue505
Revert "Windows: Increase self-referential check"
2021-05-26 23:45:00 +01:00
ikelosandGitHub 3bb23b29e3 Revert "Windows: Increase self-referential check" 2021-05-26 23:43:35 +01:00
Mike Auty 0214fa35a1 Core: Increment minimum python version to 3.6 2021-05-26 23:23:27 +01:00
Mike Auty 9e7e82f026 Development: Minor mac extract_kernel updates 2021-05-26 22:14:00 +01:00
ikelosandGitHub 77d0debdac Merge pull request #507 from volatilityfoundation/issues/issue505
Windows: Increase self-referential check
2021-05-26 22:12:33 +01:00