Mike Auty
96a7a56edd
Commit the initial JSON schema for the intermediate format.
2016-11-06 01:48:01 +00:00
Mike Auty
7b12483719
Change version to format and move the delegate function factory outside of the class.
2016-11-06 01:33:51 +00:00
Mike Auty
f0c6b0d1a4
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-11-04 18:09:04 +00:00
Mike Auty
2dba1bbddd
Update wording to clarify the different between package version and interface version.
2016-11-04 17:56:58 +00:00
Mike Auty
11d60b9f7f
Update the accepted format version.
2016-11-03 01:03:38 +00:00
Mike Auty
28fdbbe348
Refactor the pdb names, to make the class more generic.
2016-11-03 00:53:08 +00:00
Mike Auty
df2172754c
Refactor the pdbscanning code so it doesn't sneak into the library accidentally.
2016-11-01 23:32:12 +00:00
Mike Auty
d6039fb899
Initial port of npetroni's pdbscanner (with bugfix for multiple RDRS entries in a single scan chunk).
2016-11-01 02:06:08 +00:00
Mike Auty
d57733d530
Add in support for format versioning.
2016-11-01 01:33:44 +00:00
Mike Auty
dc375024b2
Set the version back, given we're early enough to do so.
2016-11-01 00:41:20 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
f771de3703
Tidy up error messages.
2016-10-30 17:07:48 +00:00
Mike Auty
d1b58143fe
Add in UnresolvedTemplate type.
...
This template type allows objects that have not been able to be resolved
to exist within the symbol system. It emits a debug message on creation
so that intermediate format developers can identify potential issues,
but does not raise an exception so as to allow partial tables to be
used.
If the UnresolvedTemplate is called (to create an object) before the
symbol has been added to the symbolspace, it will fail with a
SymbolError (as thrown by the individual SymbolTable). For this reason,
the class has been made private to the SymbolSpace class to prevent
unexpected use.
2016-10-30 16:54:12 +00:00
Mike Auty
287baeb03a
Add in rudimentary symbol support to the intermediate format.
2016-10-26 01:49:52 +01:00
Mike Auty
6f1bdcb6cb
Refactor symbol.offset to symbol.address.
2016-10-26 01:42:37 +01:00
Mike Auty
6b405383c4
Refactor targets to subtypes.
2016-10-26 01:24:58 +01:00
Mike Auty
50f5a5ddb7
Fix up broken vtypes that looks like it might never have worked.
2016-10-26 01:16:25 +01:00
Mike Auty
5f0ceff4d2
Fix up the broken vtypes conversion by translating between the names.
2016-10-26 01:16:07 +01:00
Mike Auty
0b447b6958
Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying.
2016-10-26 01:09:29 +01:00
Mike Auty
ea9ff20ca0
The sorted function requires a keyword argument for the key.
2016-10-04 09:43:55 +01:00
Mike Auty
bfcc6661c7
Sort by largest pointer size found during self-referential searches.
2016-10-01 23:04:21 +01:00
Mike Auty
d232be2f6e
Try to update the generic dtb finder to rule out false positives.
2016-10-01 22:13:42 +01:00
Mike Auty
1a83470993
Convert dtbfinder to a standalone app.
...
This is in development so that it's clearly not production code
(and should not expect to be supported as such).
2016-09-25 19:33:04 +01:00
Mike Auty
824ad5b143
Add in the LimeStacker, and fix the lack of appropriate information on LimeLayer creation.
2016-08-26 08:35:09 +01:00
Mike Auty
37dcbb88b0
Rework lime to use the new layer constructor, and factor out the header check.
2016-08-26 08:30:22 +01:00
Mike Auty
fbe3682592
Allow stack functions to return None as a failure response.
2016-08-26 08:29:45 +01:00
Mike Auty
eb9b2dcb79
Reduce the number of input variables need for the vol test CLI still to run.
2016-08-24 01:32:06 +01:00
Mike Auty
32bdeafa8a
Improve the stacker to append the generated stack configuration into the original context.
2016-08-24 01:31:45 +01:00
Mike Auty
721d5ade3f
Give the LowestLayer a proper name in the interim configs, and ensure it's in the stack.
2016-08-24 01:30:32 +01:00
Mike Auty
04b760ee3e
Increase the priority so this is always run first, and we're going to use the requirement variable.
2016-08-24 01:29:53 +01:00
Mike Auty
9959697ba5
Move where the rescursion into TranslationLayers happens.
2016-08-24 01:29:11 +01:00
Mike Auty
f3bc1d30b3
Refactor the build_configuration in Layers so that even data layers get their requirements populated.
2016-08-24 01:14:34 +01:00
Mike Auty
4d7701be66
Fix the config printer to sort the values.
2016-08-24 01:13:38 +01:00
Mike Auty
6b47b992a7
Ensure splice requirement perpetuates down the HierarchicalDict.
2016-08-24 01:13:20 +01:00
Mike Auty
341ae950b8
Ensure configurations do not include any generated values (ie TranslationLayer/SymbolLayer names)
2016-08-24 01:12:43 +01:00
Mike Auty
01616af655
Remove comment, it's already been converted.
2016-08-24 01:11:46 +01:00
Mike Auty
ab1ebeafc4
Update the test rig with the signficant changes that were just made.
2016-08-22 02:38:25 +01:00
Mike Auty
546bca1893
Rename the IntelHelper to make it a little more accurate.
2016-08-22 02:28:20 +01:00
Mike Auty
3a07d6810b
Add in a reminder for additional work required.
2016-08-22 02:27:13 +01:00
Mike Auty
3dc161f9b4
Rework Translation Layers to tie more closely to configurations
...
This change is quite signficant, and requires that TranslationLayers
get all additional parameters that they need through their requirements.
These are now automatically enumerated and populated on object
construction based on the requirements, so should not require lots of
repetitive filling out of fields.
It does come with the downside that TranslationLayers can only be
contructed with a context (and appropiate config), but TLs in particular
always require a context (to contain the base layer) and blank configs
can be constructed relatively easily (convenience functions can be added
if necessary).
This allows configuration trees to be built up, and their configs
spliced into an existing config (as if it were being loaded from a
file).
Not all ConstructableRequirements use this method, since SymbolTables
(for example) do not have access to the context or config_path in order
to get to any parameters stored in the context's config. They therefore
are still passed their requirement values as __init__ parameters
instead.
2016-08-22 02:20:10 +01:00
Mike Auty
d3e63fbc1a
Rename update_configuration to build_configuration and return a standalone config.
2016-08-22 02:18:23 +01:00
Mike Auty
a1b9be74c7
Refactor several configuration/requirement structures to avoid import loops.
2016-08-22 02:15:54 +01:00
Mike Auty
eb5e3f69de
Ensure we're not importing sub-imports from something else.
2016-08-22 02:01:31 +01:00
Mike Auty
c5139ba568
Stop exposing the config_path for now, and fix the version that's passed in the construction phase.
2016-08-22 00:36:58 +01:00
Mike Auty
f48ee5ff33
Add in the actual stacking automagic.
2016-08-22 00:06:04 +01:00
Mike Auty
05d3da602f
Remove splice as too dangerous (and hopefully unnecessary).
2016-08-22 00:05:05 +01:00
Mike Auty
7648c94083
Add in the intial works at a stacking plugin to emulate volatility 2 address space stacking.
2016-08-22 00:00:21 +01:00
Mike Auty
dc16d93b77
Alter the config.path_join function to remove empty sections.
2016-08-21 21:47:45 +01:00
Mike Auty
e54505701f
Refactor Memory into an interface.
2016-08-21 21:26:21 +01:00
Mike Auty
386e8a34c7
Minor clean-up.
2016-08-21 21:23:29 +01:00
Mike Auty