Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
Mike Auty
f88ce55199
Automagic: Improve debugging output for linux/mac
2020-12-02 09:51:42 +00:00
Mike Auty
dd0f690988
Pdbconv: Extract appropriate database name if possible
...
Fixes #381
2020-11-29 22:56:01 +00:00
Mike Auty
0a655d76a8
Core: Fix LGTM recommendations
...
This is mostly unused imports and unused variables.
2020-11-04 22:41:39 +00:00
Mike Auty
7c75018fc4
Core: Fix Warnings from LGTM
2020-11-04 21:02:36 +00:00
Mike Auty
e9c753cfc7
Automagic: Optimize windows layer construction
2020-11-01 00:11:34 +00:00
Mike Auty
46f6ee2eae
Automagic: Ensure progress percentages complete
2020-10-31 23:32:17 +00:00
Mike Auty
29cb430a72
Codebase: Apply yapf clean-up across the codebase
2020-10-29 09:43:16 +00:00
Mike Auty
e8fb8c929c
Plugins: Introduce FileHandlerInterface
2020-10-29 09:43:16 +00:00
Mike Auty
4400c43903
Codebase: Yapf across the whole codebase
2020-10-27 01:06:24 +00:00
Mike Auty
7ea2340d31
Automagic: Refactor valid kernels to valid kernel
2020-09-01 09:02:13 +01:00
Mike Auty
4610be52f0
Automagic: PDBscan use one codepath for kvo setting
2020-09-01 09:02:13 +01:00
Mike Auty
1fc0a9d8d5
Automagic: PDBscan condensing of methods
2020-09-01 09:02:13 +01:00
Mike Auty
88214527ab
PdbUtility: Fixes from npetroni (and restore progress)
2020-09-01 09:02:13 +01:00
Mike Auty
b9e0670e90
PDBUtility: Refactor this to a more central place
2020-09-01 09:02:13 +01:00
Mike Auty
c61edb54fb
PDBUtility: Minor fixes
2020-09-01 09:02:13 +01:00
Mike Auty
613ae30893
Automagic: Heavily refactor pdbscan
...
This separates out a new PDBUtility class that can take a (contiguous) layer and MZ
offset, and produce identify, download if necessary and load the
appropriate symbol table (if any).
2020-09-01 09:02:13 +01:00
AsafEitani and ikelos
7ab72a1066
yapf and some corrections
2020-08-31 17:05:20 +01:00
Mike Auty
288a017178
CLI: fix up the previous broken commit
2020-08-22 11:55:23 +01:00
Mike Auty
8e420cbe62
Core: Multiple typing fixes across the tree
2020-08-16 22:22:24 +01:00
Mike Auty
03d69204f3
Documentation: Add in using volatility as a library
2020-08-10 22:17:40 +01:00
Mike Auty
556c880c90
Codebase: Ensure all conversions to bytes handle unicode
...
All conversions using `latin-1` have been converted to
`raw_unicode_escape` which is like `latin-1`, but handles unicode
characters appropriately (with a `\u` prefix).
Since this is like `latin-1` it should have no impact on things that ran
previously, but those that would fail with a unicode error now will
present an encoded unicode string. There may be situations where the
binary representation of unicode would be better (timeliner file
output?), but those can be changed when/if it's determined necessary.
Fixes #274 .
2020-08-03 16:53:48 +01:00
Mike Auty
ff32383f82
Yapf: Minor reformats for recent plugins
2020-08-03 16:33:10 +01:00
mtressler and ikelos
2e6dc851d3
removed extra whitespace
2020-08-03 16:30:09 +01:00
Matt Tressler and ikelos
0452f69f82
created keyboard_notifiers
2020-08-03 16:30:09 +01:00
Mike Auty
f5f9ee7292
Linux: Fix plugin case and re-run yapf
2020-07-31 00:28:21 +01:00
Matt Tressler and ikelos
34ff856a79
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
355c25fefb
added parameter type to generate_kernel_handler_info
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ddec0d482d
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
b9f5450ac3
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
44911bf54a
Fixed tty_check not finding the ttyhook module
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ec8e9161bf
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
2020-07-30 23:24:23 +01:00
Andrew Case
dec13f5082
Linux - stash the Linux kernel virtual address
2020-07-28 13:16:40 -05:00
Andrew Case and ikelos
75d4390255
Remove extra debug prints
2020-07-28 17:00:20 +01:00
Mike Auty
8481406488
Linux: Support stashing the KASLR
2020-07-28 17:00:20 +01:00
Mike Auty
a4b50d183d
Mac: Stash the verified ASLR shift and improve logging
2020-07-28 17:00:20 +01:00
Andrew Case and ikelos
f6a1b28424
First attempt and better DTB and ASLR validation. Debugging statements left in.
2020-07-28 17:00:20 +01:00
Mike Auty
a980374eb8
Automagic: Fix issue in recent refactor
2020-07-28 11:15:16 +01:00
Mike Auty
61563350b3
Linux/Mac: Refactor *nix Utilities classes
2020-07-28 11:15:16 +01:00
Mike Auty
79d44edd37
Automagic: Don't hide errors from manual stacker setting
2020-07-16 11:17:29 +01:00
Mike Auty
4cccbc2f69
Automagic: Fix os_chooser method
...
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
2020-07-02 19:33:32 +01:00
Mike Auty
55dd1c6c2c
Automagic: Fix bad default parameter
2020-07-02 19:33:32 +01:00
Mike Auty
16c2ddb837
Automagic: Change stackers to including an exclusion list
2020-07-02 19:33:32 +01:00
Mike Auty
33d1c696e5
Automagic: Allow stackers to be configurable
2020-07-02 19:33:32 +01:00
Mike Auty
944bf2174f
Automagic: Split out the stacker code
2020-07-01 20:30:31 +01:00
Mike Auty
cf988944b9
Linux: Correct the ASLR for pre-masking (KASLR is still incorrect)
2020-06-23 16:56:40 +01:00
Hanno Heinrichs and ikelos
deb2b78312
Clear symbol cache after ASLR computation on Linux.
2020-06-23 16:45:22 +01:00
Hanno Heinrichs and ikelos
30226d2bdd
Fix find_aslr() function invocation for Linux.
2020-06-23 16:10:05 +01:00
Mike Auty
ede5ba07aa
Symbols: Apply symbol_masking option to IntermediateSymbolTables
2020-06-10 19:39:20 +01:00
Mike Auty
085ccc47e0
SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic
2020-06-10 19:39:20 +01:00
Mike Auty