Mike Auty
e5d6cd3d16
Add in Enum ObjectTemplate lookup method.
2019-04-17 23:53:22 +01:00
Mike Auty
90ef8f363f
Have hivelist traverse in both directions in case of invalid addresses.
2019-04-11 00:38:46 +01:00
Mike Auty
45268245ca
Add in base __getattr__ to appease ObjectInterface vs Struct issues.
...
Consider revisiting this at some point, it immediately throws an
exception, so should cause significant slow downs (none detected on a
reasonably fast machine, although buildbot will give a better idea).
Without this a lot more specific typing will be required on the
expectation that Structs will be returned rather than any other type of
object.
2019-04-07 19:08:48 +01:00
Mike Auty
772a30403f
Add in renderer selection and a CSV renderer.
2019-04-07 19:07:32 +01:00
Mike Auty
5b8645bd1f
Revert IntFlag change until we drop python 3.5 support.
2019-04-05 22:56:36 +01:00
Mike Auty
db3c120aa7
Fix up typing for the import warning spec.
2019-04-05 14:53:41 +01:00
Mike Auty
af7d969ace
Fix up variable type assignment.
2019-04-05 14:51:23 +01:00
Mike Auty
87bf1da424
Don't use mutable defaults.
2019-04-05 14:50:39 +01:00
Mike Auty
cc3a9ea4d8
Fix locking type issue.
2019-04-05 14:50:22 +01:00
Mike Auty
fa94ef3271
Use the flag type for flags.
2019-04-05 14:49:44 +01:00
Mike Auty
c85430c28e
More typing fixes.
2019-04-05 14:24:08 +01:00
Mike Auty
f24fbe6f0f
Fix up alignment issue.
2019-04-05 12:43:13 +01:00
Mike Auty
223ad230cf
Fix up typing issues.
2019-04-05 12:37:57 +01:00
Mike Auty
301fac91ac
Add in initial renderer code for CLI table formatting.
2019-04-01 00:07:50 +01:00
Analyst
d44049121f
pefile APIs for accessing VS_FIXEDFILEINFO changed. this patch attempts to handle both older and newer versions
2019-03-30 16:06:09 -05:00
Mike Auty
9e727f6716
Attempt to fix windows OSError on certain datetimes.
2019-03-29 13:39:32 +00:00
Mike Auty
29aee0baff
Update TreeGrid documentation.
2019-03-29 11:49:10 +00:00
Analyst
5120860a60
fix two bugs that prevented poolscanners from working on 2012 samples
...
in 2012, cookie is None and will raise TypeError, so we need to catch that in addition to AttributeError. also, the Session pointer is always in the native layer
2019-03-25 09:51:55 -05:00
Analyst
93e66381ad
use an alignmemt based on the cpu arch, not the pool header size
...
this fixes an issue with pool scanning on win10 32-bit samples, because the size of a pool header increased to 16 bytes, but we still want 8 byte alignment on 32-bit machines
2019-03-20 11:53:26 -05:00
Michael Ligh
2138152b10
fix a bug in psscan on xp images
...
we need to get the kvo using the native_layer_name rather than the layer_name
2019-03-19 11:14:10 -05:00
Mike Auty
f1bbba1048
Make the comparison output quiet and ignore the volatility script name.
2019-03-15 14:43:15 +00:00
Mike Auty
372533b234
Improve registry subkey support (now recurses properly).
...
The old code didn't propertly recurse nodes beyond the first layer, and
also skipped entries in the top layer. Now we check the signature to
determine when/how to skip and we recurse down node lists that contain
further node lists.
2019-03-13 00:03:02 +00:00
Mike Auty
d15dd469b5
Add in a volatility3 vs volatility2 test-rig.
2019-03-10 12:35:33 +00:00
Mike Auty
0cb0150943
Add in optional dependency on schema validation.
2019-03-09 13:39:54 +00:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Mike Auty
7904be3fd2
Yapf reformat all files.
2019-03-04 22:11:44 +00:00
Mike Auty
6613c7db19
Improve the documentation around the volatility.framework.plugins error.
2019-03-04 22:07:36 +00:00
Mike Auty
01a9e63f09
Fix up an additional import in driverirp.
2019-03-04 21:51:31 +00:00
Mike Auty
be0d010f1a
Add in warning if anyone tries to import from volatility.framework.plugins rather than voltility.plugins.
2019-03-04 21:47:26 +00:00
Analyst
801ba5840f
add the driverirp plugin
2019-03-04 12:59:18 -06:00
Analyst
0b07fc33ec
fix the imports in driverscan and modscan
2019-03-04 11:58:36 -06:00
Analyst
31d17fa19e
Revert "fix psscan and mutantscan imports now that core plugins are under framework"
...
This reverts commit 99f9a989cb
2019-03-04 11:57:23 -06:00
Analyst
6e66b3e702
update ssdt with a build_module_collection classmethod, so it can be shared with other plugins
2019-03-04 11:57:07 -06:00
Analyst
fb36db098e
add the modscan plugin
2019-03-04 11:02:53 -06:00
Analyst
901a38d40b
pool scanner update: we only ask for specific object types, so no need to filter the results anymore
2019-03-04 11:00:42 -06:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
99f9a989cb
fix psscan and mutantscan imports now that core plugins are under framework
2019-03-04 10:30:26 -06:00
Mike Auty
cdbe0306f0
Fix the nullfilter for mac process lists.
2019-03-03 14:57:34 +00:00
Mike Auty
ebadd4fbd6
Remove redundant load of segments by the lime layer.
2019-03-03 13:09:49 +00:00
Mike Auty
784336bb6e
Add in mac KDK generate_json script.
2019-03-03 01:12:07 +00:00
Mike Auty
7cc54ba23a
Add in LayerWriter plugin.
2019-03-02 23:09:12 +00:00
Mike Auty
7c9696def9
Minor fixes for typing and imports.
2019-03-02 22:45:39 +00:00
Mike Auty
d4045c9c13
Significant fix for reading from the start of SegmentedLayers (including Lime) when ignoring errors.
2019-03-02 22:44:51 +00:00
Mike Auty
14a9788802
Fix a typo in the parallelism code.
2019-03-02 19:34:31 +00:00
Mike Auty
0e1f491335
Turn off parallelism by default (seems to be faster?).
2019-03-02 19:02:34 +00:00
Mike Auty
33a9db6b9f
Make parallelism options more well defined.
2019-03-02 18:52:02 +00:00
Mike Auty
9fadee1a17
Add locking for threaded operation.
2019-03-02 18:07:48 +00:00
Mike Auty
1e9205a75f
Add in mac KDK dmg kernel extraction script.
2019-03-01 01:40:19 +00:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty