Mike Auty
be1faa91a5
Initial attempt at resolving anonymoous fields.
2020-03-26 13:32:30 +00:00
Mike Auty
bd2a382d88
CLI & windows.handles: Improve exception handling
2020-03-16 22:34:03 +00:00
Mike Auty
b8bc0f0ed6
mac.netstat: Fix up typing and interface imports
2020-03-12 19:53:51 +00:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
640afdda2c
Layers: Add in NonLinear Segmented layers
2020-03-04 20:29:42 +00:00
Mike Auty
a745503b72
Layers: Make the linear/non-linear changes minimal
2020-03-04 20:29:42 +00:00
Mike Auty
df804928b5
Layers: Alter the decode method to take data directly
2020-03-04 20:29:42 +00:00
Mike Auty
87dc98655b
Layers: Fix up an intel inaccuracy in mapping sizes
2020-03-04 20:29:42 +00:00
Mike Auty
e089314898
Layers: Add pad option to the decode/encode steps
2020-03-04 20:29:42 +00:00
Mike Auty
ca9d7075d3
Layers: Refactor the decode/encode methods
2020-03-04 20:29:42 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
7c260ce4bd
Crashdump: Ensure the number of runs is reflected in the array length
2020-02-29 18:47:34 +00:00
Tamas K Lengyel and ikelos
6a6cf37b02
pdbconv: save _imp functions in JSON
2020-02-14 09:20:15 +00:00
Andrew Case and ikelos
a60bef3283
Mac - update queue walking code
2020-02-12 21:04:23 +00:00
Andrew Case and ikelos
5a99d35a9e
update timer code
2020-02-12 19:56:37 +00:00
Michael Ligh and ikelos
4c7f2a3762
catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes)
2020-02-12 19:19:27 +00:00
Andrew Case and ikelos
ab42f0941c
Add sysctl docstrings and return types
2020-02-12 19:17:19 +00:00
Andrew Case and ikelos
29cc435b5e
update sysctl v2
2020-02-12 19:17:19 +00:00
Mike Auty
7873a65999
Procdump: Don't loop through twice without good reason.
2020-02-12 19:07:24 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
c4829ccca3
Caching: Add clear-cache option (except hashcaches)
2020-01-30 01:57:48 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
6e38727ffe
Mac: Refactor/optimize repeated code.
2020-01-28 01:37:21 +00:00
Mike Auty
f111e9e051
Mac: Ensure queues error check all entries, not just the first.
2020-01-28 01:37:21 +00:00
comet and ikelos
beed68b8bf
update
2020-01-27 23:31:05 +00:00
Mike Auty
f00453e366
Procdump: Remove redundant line as caught by @iMHLv2
2020-01-22 19:49:11 +00:00
Michael Ligh and ikelos
1d7da6402b
svcscan cleanup: win10 before 15063 uses win8 types
2020-01-22 19:23:30 +00:00
Mike Auty
b664e38c66
Resources: Add a comment about removing the old python code.
2020-01-22 19:22:02 +00:00
Michael Ligh and ikelos
d6c8ac87d7
try unverified retrieval if ssl.SSLCertVerificationError or ssl.SSLError with CERTIFICATE_VERIFY_FAILED
2020-01-22 19:19:48 +00:00
Mike Auty
ddfd5ec2d2
Framework: Refactor where the python version check happens.
...
Fixes issue #181 .
2020-01-22 19:05:06 +00:00
Mike Auty
9fe6e6ba37
registry: Add the hivedump plugin
2020-01-17 17:22:04 +00:00
Mike Auty
fe999aa9e2
registry: Fix up previous naive mapping method
2020-01-17 17:14:16 +00:00
Mike Auty
81653dba6d
Registry: Ignore errors if ignore_errors is set.
2020-01-17 01:14:09 +00:00
Mike Auty
8f71c61440
layerwriter: Fix mistaken hardcoded layer name.
2020-01-16 23:07:27 +00:00
Mike Auty
99af98f639
layerwiter: Refactor to classmethod.
2020-01-16 22:57:47 +00:00
Mike Auty
572313cc34
Objects: Make sure bytes provide a template size.
2020-01-16 11:06:16 +00:00
Mike Auty
a3def09a13
Registry: Optimize calls to DataLength and improve documentation.
2020-01-15 22:59:58 +00:00
Mike Auty
cedca0bb84
Objects: Document void size a little more.
2020-01-15 21:55:30 +00:00
Mike Auty
2d408491bd
Printkey: Slightly improve subkey name determination.
2020-01-15 02:19:12 +00:00
Mike Auty
3f5b96f3c7
Yapf: Clean-up the whole codebase.
2020-01-14 15:44:07 +00:00
Mike Auty
b7ba877727
procdump: Enure proc_id is defined.
2020-01-14 15:36:54 +00:00
doomedraven and ikelos
07b94abc1e
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
cdc0835863
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
e4d7b7975f
expose process_dump to other plugins
2020-01-14 10:52:05 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
Mike Auty
8a03cf53f0
Objects: Ensure templates objects aren't ReferenceTemplates.
2020-01-13 13:58:35 +00:00
Mike Auty
b4a9937da7
Objects: Void has no size, and BitFields don't inherit from Integer.
2020-01-13 02:16:35 +00:00
Mike Auty