Matt Tressler and ikelos
747fe8609f
update copywrite to 2020
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
17e629a4c4
converted process_file_object into a classmethod
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
e9f870ff05
revert self.context change back to self._context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
9f977080c5
changed self._context to self.context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
d98337cc09
added debug statements to dump_file_producer when none is returned
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
4f37a28185
dump_file_producer is now a classmethod and returns a FileInterface Object
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
49acf44302
dumpfiles.py is now consistent with master and runs correctly
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
8e1a599203
changed PluginRequirement to VersionRequirement
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0a9e663c41
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0c09b98318
use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
25b56b5ca4
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Mike Auty
56ff75a74b
Layers: Add internal intel debugging flag
2020-12-10 12:18:14 +00:00
Mike Auty
e28016e45b
Pdbutility: Improve usability of symbol_table_from_offset
2020-12-08 16:34:59 +00:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
Mike Auty
f88ce55199
Automagic: Improve debugging output for linux/mac
2020-12-02 09:51:42 +00:00
Mike Auty
8fb53a32a8
PdbUtility: Support multiple debug directories
2020-12-01 01:21:36 +00:00
Mike Auty
4d0a07194a
PDBUtility: Update to use only pefile
2020-12-01 01:21:36 +00:00
Mike Auty
d77399b82b
Pdbconv: Use both pefile and volatility to get the guid
2020-12-01 01:21:36 +00:00
Mike Auty
65310eb841
Pdbconv: Slight tweaks to database_name finding
2020-11-29 23:05:21 +00:00
Mike Auty
dd0f690988
Pdbconv: Extract appropriate database name if possible
...
Fixes #381
2020-11-29 22:56:01 +00:00
AsafEitani and ikelos
4ec006e606
Fix 'maxsize variable doing nothing' bug
...
In one of the earlier commits the varible was erased from being passed to vaddump - that corrects it.
2020-11-18 19:56:30 +00:00
Mike Auty
9150cd971b
Core: Change base class for FileHandlerInterface
...
Python 3.6 doesn't appear to support IO[bytes] (and this is also from
the typing library), so we instead now inherit from RawIOBase. This
provides read, but does not come with a constructor (like FileIO) so
is suitable for our needs.
Fixes issue #376 .
2020-11-17 22:04:55 +00:00
Mike Auty
30de81795c
Windows: Update requirements to pslist 2.0.0
2020-11-16 09:41:42 +00:00
Mike Auty
745fce2281
Symbols: Fix pool error handling
...
Fixes #375
2020-11-15 23:56:07 +00:00
Mike Auty
4a8b4d1706
Plugins: Bump remaining plugins to framework require 2.0.0
2020-11-15 16:53:03 +00:00
Mike Auty
44c37d9761
Objects: Fix the comparison of enumerations
2020-11-12 17:32:56 +00:00
Mike Auty
60a70d06ca
PDB: Fix issue #374
2020-11-12 17:02:40 +00:00
Mike Auty
49aeaf2a49
Plugins: Resolve remaining LGTM recommendations
2020-11-09 00:03:07 +00:00
Mike Auty
0a655d76a8
Core: Fix LGTM recommendations
...
This is mostly unused imports and unused variables.
2020-11-04 22:41:39 +00:00
Mike Auty
7c75018fc4
Core: Fix Warnings from LGTM
2020-11-04 21:02:36 +00:00
Mike Auty
ae3a97e2c7
Core: Fix errors found by LGTM
2020-11-04 20:05:12 +00:00
Mike Auty
a9c742b3a2
Codebase: Fix == None (from lgtm audit)
2020-11-04 14:32:42 +00:00
Mike Auty
1d8081e409
Plugins: Fix exception thrown in handles
...
Fixes #368
2020-11-01 14:50:48 +00:00
Mike Auty
e9c753cfc7
Automagic: Optimize windows layer construction
2020-11-01 00:11:34 +00:00
Mike Auty
46f6ee2eae
Automagic: Ensure progress percentages complete
2020-10-31 23:32:17 +00:00
Mike Auty
47ff37b07b
Plugins: Make layerwiter more configurable
...
This adds support for dumping multiple layers at once, listing available
layers and selects the highest non-mapped layer. Mapping is specified
in the metadata and currently is only applied to intel layers.
2020-10-31 23:30:22 +00:00
Mike Auty
dbd00b9759
Plugins: Fix paths read by isfinfo
2020-10-31 21:26:26 +00:00
Mike Auty
7a36628e48
Extensions: Meaningful error for failed inet_ntop
2020-10-31 11:47:38 +00:00
Mike Auty
31ff6ce482
Plugins: Bump isfinfo framework version
2020-10-30 16:11:35 +00:00
Mike Auty
c622ee4897
Plugins: Bump framework version for banners
2020-10-30 14:59:01 +00:00
Mike Auty
ea629591ef
Plugins: Make open method clearer to use
...
This highlights that the FileHandler class can also be seen as a method
similar to open, and it removes unnecessary context managers, allowing
plugins to close files as they wish (they must, however, remember to
close the file for it to be committed).
2020-10-29 09:43:16 +00:00
Mike Auty
0e596c2112
Windows: Minor additions based on the framework bump
2020-10-29 09:43:16 +00:00
