Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
037ac28534
Move around the scanning functions and create an API for the iterators.
2018-05-14 01:03:43 +01:00
Mike Auty
04d609064a
Remove TODO that's in the wrong place, and we've just to-done.
2018-05-13 21:32:05 +01:00
Mike Auty
63a1fb3690
Simplify intel scanning to ensure overlaps are handled correctly.
2018-05-13 20:57:11 +01:00
Mike Auty
a07691b04f
Ensure scanners don't return duplicates in the overlap.
2018-05-13 20:55:54 +01:00
Mike Auty
8b5c58fee9
Fix up slight intel scanner issue.
2018-05-13 15:46:02 +01:00
Mike Auty
5c0140ed74
Fix typo in intel scanning engine.
2018-05-10 02:40:08 +01:00
Mike Auty
83eb346ba5
Clarify logic and fix an issue in intel scanning.
2018-05-10 02:13:46 +01:00
Mike Auty
19b8a0f696
Improve scan chunking for intel layers
...
We now use mapping to skip unmapped pages when scanning. This
should be slightly quicker and likely more accurate. We also now
don't chunk over the size requested by the scanner. We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty
b791b6c1a1
Add an ignore_errors check for positive lengths.
2018-05-09 01:16:47 +01:00
Mike Auty
983eabac86
Fix an issue with IntelPAE's mapping domain size.
2018-05-08 00:02:14 +01:00
Mike Auty
e53cb16485
Vastly speed-up intel memory traversals
...
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer. This means large holes in the memory
can be skipped more quickly. It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty
093b354f7e
Pylint and fix the _check_header return type.
2018-05-02 20:20:24 +01:00
Mike Auty
8cf92051d5
Put back in the comments we wanted to keep.
2018-05-02 20:14:06 +01:00
awalters and ikelos
848d55a59a
Updated to use new create convenience function for IntermediateSymbolTable.
2018-05-02 20:10:14 +01:00
awalters and ikelos
e8f64664a8
Initial changes based on @ikelos review. Also updated crash structs.
2018-05-02 20:10:14 +01:00
awalters and ikelos
6eeafbc391
Windows Crash Layer
2018-05-02 20:10:14 +01:00
Mike Auty
9512cbe9eb
Commit metadata changeset.
...
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers). Metadata can only be set at construction
time, and the metadata dictionary is readonly. The hope is this will
make enumerating metadata keys across the codebase simpler.
The current metadata items that layers hold is:
architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)
This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty
556fa29ada
Deprecate/remove 'provides' attribute.
2018-04-26 12:31:33 +01:00
Mike Auty
623180ddbd
Make many typing fixes, based on mypy-0.590.
2018-04-22 20:45:59 +01:00
Mike Auty
6402c94078
Rework IntermediateSymbolFile loading to a classmethod.
2018-04-12 15:15:25 +01:00
Mike Auty
470c139e81
Throw swap exceptions if the page is supposed to be swapped out, but the swap layer can't be found.
2018-03-23 00:48:28 +00:00
Mike Auty
6482059521
Fix up typing issues identified by mypy.
2018-03-22 00:44:49 +00:00
Mike Auty
dd41ea1cd1
Improve registry docstrings.
2018-03-11 21:40:54 +00:00
Mike Auty
18fa9e74d7
Add in the capability for get_key to return full node_paths.
...
Also resolves issue #18 .
2018-03-11 21:25:58 +00:00
Mike Auty
d4ea03f51d
Add in hive offsets to printkey output.
2018-03-09 01:00:48 +00:00
Mike Auty
bc8429a2b0
Convert all helper_ properties to get_ methods.
2018-03-09 00:47:00 +00:00
Mike Auty
3f37ab760c
Change inheritance to fix type checking.
2018-03-08 00:23:49 +00:00
Mike Auty
e8422f0774
Refactor to reduce duplication in swap support.
2018-03-05 23:53:34 +00:00
Mike Auty
994bd7c394
Fix up the finding of swap layers so swap actually works.
2018-02-11 21:41:39 +00:00
Mike Auty
b7c68f4e98
Rework LayerListRequirement from a ListRequirement to a MultiRequirement.
2018-02-11 18:35:18 +00:00
Mike Auty
cd8f6876ff
Add in LayerListRequirement type.
2018-02-10 22:42:59 +00:00
Mike Auty
24be045266
Minor fix ups with typing and exceptions.
2018-02-10 22:42:31 +00:00
Mike Auty
cbe75dadf7
Add in Intel32e and improve IntelPAE.
2018-02-10 00:03:13 +00:00
Mike Auty
8b75c458ba
Fix up the calculations and filtering for pagefile offsets.
2018-02-09 01:19:22 +00:00
Mike Auty
8344497e85
Merge branch 'master' into local/swap-support
2018-02-01 00:51:53 +00:00
Mike Auty
3e3a3a85ba
Slightly clean-up magic import errors.
2018-01-30 15:22:50 +00:00
Mike Auty
08531c5859
Gracefully handle non-addurlinfo classes from the opener.
2018-01-30 15:22:33 +00:00
Mike Auty
deb7da246b
Add in initial shot at PAE page entry handling.
2018-01-28 16:29:28 +00:00
Mike Auty
35be4c5a84
Add in more information to the paged exceptions.
2018-01-28 16:25:16 +00:00
Mike Auty
c203663f0b
Refactor requirements to support a list of swap layers.
2018-01-28 14:48:50 +00:00
Mike Auty
bf8173f9a9
Improve the loader in the face of the file/python-magic duplicate module naming.
2018-01-28 13:34:19 +00:00
Mike Auty
663cf3eff8
Just tidy up the multistring searchers slightly.
2018-01-25 11:27:59 +00:00
Mike Auty
ccd00afdb2
Add in new multistring scanner based on re
...
Unfortunately in tests it turned out re was faster than a python
implementation of Wu-Manber. The Wu-Manber code has been left (because
why not) but it's not really advantageous over the re builtin since
it's compiled in C.
2018-01-24 20:22:00 +00:00
Mike Auty
4bb1161490
Make WuManber a callable program.
2017-12-24 12:53:50 +00:00
Mike Auty
3cb48c19e8
Remove the errant urllib3 import in favour of native python.
2017-12-13 20:48:52 +00:00
Mike Auty
1dcad91126
Add in type annotations for scanners.
2017-12-13 20:48:52 +00:00
Mike Auty
ac12098317
Add type-annotations for reamining layer files.
2017-12-13 20:48:52 +00:00
Mike Auty