xabiugarte and ikelos
949a2a2ddc
Change unsigned long long by pointer
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
8da9d90c19
Small fix on EPROCESS is_valid
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
1123ed074d
Tiny fix in EPROCESS.is_valid
2019-12-02 13:07:04 +00:00
Mike Auty
b6d807ff51
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
2019-11-27 11:30:14 +00:00
Mike Auty
1f4498be37
MultiRegExScanner: Results are always bytes and never strings
2019-11-27 11:30:14 +00:00
Mike Auty
af43e506fb
Elf64Layer: Fix typo in exception message.
2019-11-27 11:30:14 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
d29cd776ec
Layers: Fixing multiprocessing typing issue.
2019-11-27 11:30:14 +00:00
Mike Auty
0e016797bb
Typing: Change signatures to co-variant Mapping from Dict
2019-11-27 11:30:14 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
06c4a6dcc7
pdbconv: Swap the suffix ordering to make the less common option second.
2019-11-20 20:04:14 +00:00
Mike Auty
9928b40afb
pdbconv: ResourceAccessor now logs the written file
2019-11-20 20:04:14 +00:00
Mike Auty
2d3cceda46
ResourceAccessor: Warn and retry without validation on certificate failure
2019-11-20 20:04:14 +00:00
Mike Auty
cb41c5e960
Pdbconv: Switch pdb downloading to resource accessing
2019-11-20 20:04:14 +00:00
Mike Auty
9334add1fc
ResourceAccessor: Fix downloading progress indicator.
2019-11-20 20:04:14 +00:00
Mike Auty
22fd48516e
ResourceAccessor: Improve typing information
2019-11-20 20:04:14 +00:00
Mike Auty
d7b996ff85
ResourceAccessor: Only list the handlers once.
2019-11-20 20:04:14 +00:00
Mike Auty
249c3ec223
Svcscan: Ensure or later checks are done in order.
...
Relates to issue 139.
2019-11-18 20:57:34 +00:00
Mike Auty
dc5420df55
Stackers: Give the vmware stacker an ordering.
2019-11-16 12:58:38 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
1f0e81a898
layers: Stackers are sorted by stack_order not layer priorities.
2019-11-16 12:53:56 +00:00
Mike Auty
19d46563ae
layers: Fix up the maths around scanning chunks
2019-11-13 21:44:13 +00:00
Mike Auty
ca8099e7d7
layers: Improve scanning of layered chunks
...
Previously, for segmented layers, no chunk larger than a full segment
was scanned. Now, we combine contiguous segments up to
scanner.chunk_size (or until a non-present segment) in order to scan it.
This may be slightly slower (by concatting the data together) but gives
results of hits across page boundaries (the point of the scanning
capability), whereas previously each page was scanned individually.
2019-11-13 21:44:13 +00:00
Mike Auty
0f9c6a7362
vmware layer: Fix up a typo.
2019-11-13 19:58:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
40fcdf9469
exceptions: SymbolErrors now contain specific information
2019-11-13 19:27:00 +00:00
Mike Auty
ce3f4fb134
CLI: Initial attempt to standardize exception output
2019-11-13 19:27:00 +00:00
doomedraven and ikelos
4543b0af33
Update vaddump.py
2019-11-13 18:54:19 +00:00
doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
648cded5e1
Objects: Fix incorrect Bitfield maths
...
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit. We should mask then shift, not the
other way around.
May well fix issue #135 (pdb generation will have been affected by
this).
2019-11-13 16:48:14 +00:00
Mike Auty
d0a5d4ba3f
layers: Ensure the new registry check doesn't throw an exception.
2019-11-12 09:09:51 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
xabiugarte and ikelos
5b04492463
Fix on 'end_bit' computation
2019-11-11 17:03:04 +00:00
Mike Auty
989f08eff2
Revert "EPROCESS: Fix is_valid check missing cast."
...
This reverts commit 60eda0a52b#110 , only done worse.
2019-11-09 16:06:30 +00:00
Mike Auty
60eda0a52b
EPROCESS: Fix is_valid check missing cast.
2019-11-09 15:56:19 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
Mike Auty
ee31ece006
Fix a logging on add_process_layer exceptions.
...
There were a number of issues with commit 3df5e995
2019-11-03 23:15:38 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
Mike Auty
9d453ff916
Elf64: Ensure volatility objects aren't stored as part of the layer.
2019-11-03 20:37:12 +00:00
Mike Auty
bb04c3b882
Improvements to logging and support for virtualbox.
2019-11-03 20:37:12 +00:00
Mike Auty
6f73310d88
Add in initial Elf64 support.
2019-11-03 20:37:12 +00:00
Mike Auty
dd3e09f1e2
frameworkinfo: Make this a core plugin, not an optional extra.
2019-10-31 22:14:43 +00:00
Mike Auty
4457bcaee0
vadyarascan: Ensure we scan the right layer
...
This patch ensures we scan the vad segments within the correct layer
(the process layer, not the kernel layer) and lists the pid in the
output.
2019-10-31 19:15:02 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
ce2b83fc34
Add in support for sizing LF_ARGLISTs. Fixes issue #99 .
2019-10-23 00:09:45 +01:00
Mike Auty
27a291cf61
Remove the erronious print statement, which should be a vollog message if needed.
2019-10-18 08:39:56 -04:00
Mike Auty
0be9061989
Tidy up commit e0097ac.
2019-10-18 08:38:17 -04:00
