Mike Auty
31b69671cb
Fix up inheritance and type-annotations (plus pylint/pycharm formatting).
2017-12-13 23:16:06 +00:00
Mike Auty
942de5f166
Finish adding type-annotations thoughout the code.
2017-12-13 20:48:52 +00:00
Mike Auty
ee12b81f4a
Add in type-annotations for renderers and start on symbols.
2017-12-13 20:48:52 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
0ecf68af0f
Support table remapping for referenced symbol names.
2017-11-27 14:39:46 +00:00
Mike Auty
9af49a49a9
Code improvement not to re-lookup the size of an unsigned int every turn of a loop.
2017-11-11 22:35:40 +00:00
Mike Auty
f58cdf73f1
Remove debugging print and use get_node rather than recasting.
2017-11-09 23:20:53 +00:00
Mike Auty
eb76cab749
Add in Big Data support.
2017-11-09 23:16:58 +00:00
Mike Auty
479848fde7
Improve subkey traversal by catering for various _CM_KEY_INDEX structures.
2017-11-08 11:41:06 +00:00
Mike Auty
918452f067
Remove deprecated volatile property in favour of the helper-prefixed property namespace.
2017-11-08 11:40:45 +00:00
Mike Auty
2db214e2f8
Ensure we appropriately truncate unicode strings.
2017-11-08 01:00:53 +00:00
Mike Auty
bbae34f1d5
Attempt to resolve issues with <python-3.6 json module not loading bytes.
2017-11-06 10:09:44 +00:00
Mike Auty
71d938d78b
Add in support for looking for symbols in zip files.
...
We use the jar scheme because that's actually registered with the right
bodies, even if the syntax is a bit weird. The contents is still
processed by the ResourceAccessor meaning it can be compressed with any
of the supported compression methods.
2017-11-05 22:29:46 +00:00
Mike Auty
b6d932f4a5
Refactor the ResourceAccessor because it isn't an interface.
...
It's not strictly limited to layers either, but I don't really want to
create a whole extra generic file to put this in, so layers will do.
2017-11-05 21:27:56 +00:00
Mike Auty
f6ac9c8367
Remove a no longer used function, so it doesn't get stuck in the API forever.
2017-11-05 15:28:38 +00:00
Mike Auty
671f65ed56
Centralize the ISF locating code.
...
This might benefit from a recache of the linux banners, although it
should continue to work no recache is performed.
We're now in a position to add support for loading symbols directly from
zip files by altering the ResourceAccessor and adding code to the
symbol finder.
2017-11-05 15:18:20 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
4b7543f2f4
Unify the resource opening.
2017-11-02 21:46:39 +00:00
Mike Auty
dbc73df8f2
Make sure we support windows filenames
...
Consider refactoring out the various URL openning code into
one that just returns the open file handle. This would require changing
the config option of "filename" to "location" and rejigging a few other
bits elsewhere, but would centralize and make it more managable.
2017-11-02 11:56:03 +00:00
Mike Auty
5d2b0f9004
Add in support for determining if a key is volatile.
2017-10-23 17:09:25 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
587b6e9d9e
Add back in the deprecated helper for _CMHIVE.
2017-10-09 00:20:32 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
e90b4e2d02
Add and make use of free_table_name for symbol_spaces.
2017-09-03 22:54:42 +01:00
Mike Auty
aa87c87a22
Remove the additional import that was entirely my fault being there in the first place.
2017-08-16 21:40:58 +01:00
Nick L. Petroni, Jr
c4e6b07ee0
refactored constants.linux usage
2017-08-16 16:30:12 -04:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
eeeda60bfb
A couple more small documentation updates.
2017-08-11 19:30:39 +01:00
Mike Auty
e434909e50
Make SymbolTable.symbols consistent with enumerations and types.
2017-08-11 19:25:13 +01:00
Mike Auty
f7f1c1d5e0
Raise the right kind of exception in Intermediate Format SymbolTables.
2017-08-11 08:49:49 +01:00
Mike Auty
d32fc223e2
Fix up additional imports inconsistent with the coding style.
...
Note: also remove interfaces_configuration where ever possible
(this is not possible in the interfaces directory itself
because it would cause an import loop).
2017-08-09 22:32:44 +01:00
Mike Auty
bfb83f0c33
Fix up silly typo (and replace another hardcoded bang).
2017-08-09 21:34:26 +01:00
Mike Auty
fc0fa96ed8
Replace hardcoded exclamation marks for constants.BANG
2017-08-08 09:50:22 +01:00
Mike Auty
2caeeb275e
First stab at refactoring the add_process_layer code out of the Windows _EPROCESS structure.
2017-08-07 21:42:10 +01:00
iMHLv2
770dba1f0a
use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr
2017-07-19 18:12:50 +00:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
Mike Auty
9f3470a8e9
Speed up linux caching by allowing lack of validation. This should NOT be enabled without knowing exactly what you're doing.
2017-07-17 21:47:31 +01:00
Mike Auty
e152f929e0
Ensure we unquote the parse URL path when opening standard files.
2017-07-17 18:22:12 +01:00
Mike Auty
9127f1827f
Carry out the base64 decoding when the symbol is constructed.
2017-07-10 00:06:17 +01:00
Mike Auty
f12ab2a460
Move the symbol paths into the constants package.
2017-07-10 00:02:31 +01:00
Mike Auty
5675942050
Add in symbol constant_data and bump the schema to 0.4.1.
...
Special thanks to @npetroni for having to suffer a very long discussion
with me about my need for things to have particular names because I
don't know the field very well. 5:S Sorry! 5:)
2017-07-08 21:50:25 +01:00
Mike Auty
d79d428edc
Ensure we use the native dictionary for more recent IFF versions (and correct issues with pointers and chars).
2017-06-23 15:44:58 +01:00
Mike Auty