Mike Auty
88e9786967
Improve the requirements documentation.
2016-12-28 22:33:17 +00:00
Mike Auty
3bdb4f4c99
Ensure that inherited members are documented (and that attributes come after methods for clarity.
2016-12-28 22:32:04 +00:00
Mike Auty
aee4349e3c
More documentation updates (and minor code cleanups).
2016-12-28 03:20:44 +00:00
Mike Auty
390ccd330d
Remove property from _unresolved, since we manually make it a property when necessary.
2016-12-27 22:32:25 +00:00
Mike Auty
e56e61eac5
Remove the need for ctypes by using a single-letter code instead.
2016-12-27 22:32:06 +00:00
Mike Auty
9399480f1a
Add a chunk of documentation alphabetically.
2016-12-26 23:50:51 +00:00
Mike Auty
9666e34603
Remove the filenames from the intermediate format prefix search, to improve the documentation.
2016-12-26 23:50:16 +00:00
Mike Auty
bab71d4358
Refactor the progress_callback so it can be used in automagics.
...
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.
The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty
2680bba785
Fix up lack of logging object in layers interface.
2016-12-26 23:24:14 +00:00
Mike Auty
4cd9b98211
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-12-26 22:53:29 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
943c625d5a
Ensure VMware fails back to flat with zero region metadata files.
2016-12-26 22:48:29 +00:00
Mike Auty
ba7275f973
Allow relative file paths in the pdb scanner prefix variable, for the documentation.
2016-12-26 18:47:06 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
3578768e2d
Correct odd/unnecessary typo.
2016-12-25 22:38:02 +00:00
Mike Auty
011b6dc3f4
Add in the object_factory capability and use it by example in pslist.
2016-12-25 19:02:48 +00:00
Mike Auty
8e334ca086
Remove fallthrough/default natives from symbol_spaces.
2016-12-25 18:37:54 +00:00
Mike Auty
fb8143f7f4
Ensure Intermediate natives include their table name during resolution.
2016-12-25 18:35:13 +00:00
Mike Auty
433f47c458
Allow casting to inherit the symbol table of its parent.
2016-12-25 18:34:14 +00:00
Mike Auty
1c3638d6c5
Allow native tables to accept and purpetuate table names.
2016-12-25 18:33:04 +00:00
Mike Auty
627bdd74a5
Allow developers to see when an exception has occurred with their scanner.
2016-12-25 17:43:10 +00:00
Mike Auty
34b3f75b99
Fix up the physical layer scanner appropriately.
2016-12-25 17:39:56 +00:00
Mike Auty
f03f99e64c
Ensure the non-multithreaded scanner works the same way as the multithreaded one.
2016-12-25 17:26:06 +00:00
Mike Auty
a4f27e73f4
Refactor the scanners to allow multithreaded searching.
2016-12-25 17:01:05 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
c5cd3595de
Fix up minor typo and hard depend on >= python 3.4.
2016-12-25 13:44:03 +00:00
Mike Auty
60bf657895
Allow pickling of FileLayers by unsetting the file (it'll be reopened as soon as a read happens).
2016-12-25 00:02:42 +00:00
Mike Auty
e230bbf6a8
Ensure we don't ever get in a loop looking up ._vol (could happen when pickling/unpickling).
2016-12-25 00:02:11 +00:00
Mike Auty
d51dd2a992
Add in TODOs for future heuristic enhancements.
2016-12-24 19:45:02 +00:00
Mike Auty
6a0b0d71c0
Remove debugging code that shouldn't have made it in the final code.
2016-12-24 19:41:58 +00:00
ikelos and GitHub
bea0a57942
Merge pull request #3 from npetroni/fix-pdbscan-utility
...
fix pdbscanner standalone utility -- scan() API changed
2016-12-23 18:35:21 +00:00
Nick L. Petroni, Jr
1b532a0b47
fix pdbscanner standalone utility -- scan() API changed
2016-12-23 11:26:41 -05:00
Mike Auty
3aa187e293
Fix minor lint with docstring.
2016-12-22 16:00:58 +00:00
Mike Auty
23e61d9756
Add in a little more information to the debug log.
2016-12-22 16:00:46 +00:00
Mike Auty
bbabf4db0e
Add in a heuristic for finding the correct DTB on recent Win10.
...
This removes again the single_page_map_offset configuration value,
and requires that a full/correct config be used to supply a manual DTB
value.
The expectation is that the single_page_map_offset feature be
re-introduced but override *all* scanning (so the scanning doesn't take
place even if the stacking does).
2016-12-22 15:44:07 +00:00
Mike Auty
70314386c8
Fix a rather critical issue with the end condition for a scanned range (and reduce the overlap if it's unnecessarily large).
2016-12-22 15:41:00 +00:00
Mike Auty
d669b57546
Rewrite our fallback virtual kernel offset algorithm.
2016-12-21 16:54:35 +00:00
Mike Auty
aad6aa9b4d
Rewrite the intel scanning engine (and fix up the internal _translate function to include the mapped layer).
2016-12-21 16:53:52 +00:00
Mike Auty
9ca001df8b
Allow start/end positions on the pdb scanning.
2016-12-21 02:28:03 +00:00
Mike Auty
591d9eba27
Add in better bounds checking for the scan call.
2016-12-21 02:20:47 +00:00
Mike Auty
56388fc903
Fix up the incorrect scanning boundaries.
2016-12-21 01:45:44 +00:00
Mike Auty
76f435e519
Update schemas to be more strict on providing all the required information.
2016-12-20 10:49:23 +00:00
Mike Auty
c6d5eef2f9
Fix up a documentation warning.
2016-12-20 09:00:17 +00:00
Mike Auty
7a1fcec1b5
Change subtype to base_type to match the __init__ parameter name.
2016-12-20 08:31:01 +00:00
Mike Auty
1e6911b753
Create appropriate VolTemplateProxy classes for BitField and Enumeration.
2016-12-20 08:29:41 +00:00
Mike Auty
a7d3a95ad0
Fix BitFields (and Enumerations) to accept only Integer basetypes and derive from them properly.
2016-12-20 08:25:55 +00:00
Mike Auty
60c3fbc5ce
Don't cache failures and add additional logging for the long schema validation pause.
2016-12-19 21:49:14 +00:00
ikelos and GitHub
bb00ac03a0
Merge pull request #2 from ikelos/python3-doc-theme
...
Python3 doc theme
2016-12-19 09:29:39 +00:00
Mike Auty
bbb07b49c0
Ensure we enforce requirements on the schemas (these should always have been in place, so no version bumps).
2016-12-18 22:10:01 +00:00
Mike Auty
0f548e864c
Add in comment in case of mutability trouble in the Struct TemplateProxy.
2016-12-18 20:52:38 +00:00
Mike Auty