Mike Auty
9824538bd9
Numerous pycharm warnings resolved
...
This includes:
* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
0abaa3af2f
Don't load all symbols when we ask to import symbols.
2018-12-14 00:27:46 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
8c7cab163b
Minor fixes from the monkeytype run.
2018-12-13 23:49:24 +00:00
Mike Auty
dfe2f86fe2
Lots and lots of typing additions found by an initial monkeytype run.
2018-12-13 23:46:37 +00:00
Mike Auty
2c72439334
Add in protections for the crashdump layer.
2018-12-13 22:59:21 +00:00
Mike Auty
04c5007fbb
Fix minor issue with the conversion change.
2018-12-13 21:38:20 +00:00
Mike Auty
d9369001d4
Ensure we can cache the linux/mac banners.
2018-12-13 21:23:59 +00:00
Mike Auty
c0fcd15d4f
Minor changes to various checks to be more pythonic.
2018-12-13 21:07:25 +00:00
Mike Auty
a534ef216e
Pycharm reformatting.
2018-12-13 21:07:25 +00:00
Andrew Case and ikelos
03d41c3f79
Add mac psaux plugin
2018-12-13 21:07:25 +00:00
Mike Auty
f41e3e0453
Completely rework the primitive data format system.
2018-12-13 18:33:42 +00:00
Mike Auty
6b480eed56
Fix up PE data construction code.
2018-12-13 18:33:42 +00:00
Mike Auty
9949809198
Fix a minor typo.
2018-12-13 18:33:42 +00:00
Mike Auty
b533d19f83
Refactor the data extraction for primitive types.
2018-12-13 18:33:42 +00:00
Mike Auty
a78452e361
Fix up ugly int128 hack with a slightly nicer hack.
2018-12-13 15:56:24 +00:00
Mike Auty
6e43d0bab4
Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it).
2018-12-13 15:56:24 +00:00
Mike Auty
1341925160
Remove unnecessary requirements method.
2018-12-13 15:56:24 +00:00
Mike Auty
cd7296d64e
Fix up based on the recent master refactoring.
2018-12-13 15:56:24 +00:00
Mike Auty
3a2c2b30a9
Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things.
2018-12-13 15:56:24 +00:00
Mike Auty
d72534747e
Ignore the mac symbols as well as linux and windows.
2018-12-13 15:56:24 +00:00
Mike Auty
25fb05c9bf
Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address.
2018-12-13 15:56:24 +00:00
Mike Auty
57b2a5bab7
Fix up a rogue classmethod, and ensure we have a separate variable for the new layer.
2018-12-13 15:56:24 +00:00
Mike Auty
5135215c62
Do some tidying and renaming.
2018-12-13 15:56:24 +00:00
Mike Auty
7a462d5f85
Refactor out the shared symbol cache/finder code from linux and mac.
2018-12-13 15:56:24 +00:00
Mike Auty
55286f04cb
Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat.
2018-12-13 15:56:24 +00:00
Andrew Case and ikelos
622c86f9ed
Add initial mac backend code, with broken DTB finding, along with the pslist plugin
2018-12-13 15:56:24 +00:00
Mike Auty
c9a08603c7
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
2018-12-13 01:39:26 +00:00
Mike Auty
5e8ba16709
Remove the unimplemented hook.
2018-12-13 01:16:05 +00:00
Mike Auty
dfaaf1e455
Fix up some things missed in the master refactor.
2018-12-13 01:16:05 +00:00
Mike Auty
7c4cb0d291
Remove attempts to improve speed that may not help.
2018-12-13 01:16:05 +00:00
Mike Auty
da2f3b38d3
Add in page-table repetition blocking code (helps with windows 10 virtual space).
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
736a1c6e50
add is_valid() for _FILE_OBJECT and _EPROCESS
2018-12-13 01:16:05 +00:00
Mike Auty
91b2c61803
Try to add some optimizations to intel scanning.
2018-12-13 01:16:05 +00:00
Mike Auty
a16fb3bf7d
Don't break on validity tests.
2018-12-13 01:16:05 +00:00
Mike Auty
76264cee34
Catch invalid _OBJECT_HEADER objects.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
650a188d51
updates for win8/win10 poolscanning
2018-12-13 01:16:05 +00:00
Mike Auty
fa033b8ab7
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
2018-12-13 01:16:05 +00:00
Mike Auty
eacc45dab6
Ensure POOL_HEADER finds the right object in the right symbol table.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
4c68da8b06
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
4b0e7e5309
remove the Path column from poolscanner. add File scanning
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d653839359
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d667a68f97
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
a76d71a7dc
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Mike Auty
b148305f76
Add in protection for the Lime Layer being unable to read the header.
2018-12-12 23:42:31 +00:00
Mike Auty
8acbe8bba3
Refactor conversion code from objects.utility to a conversion module in renderers.
2018-12-12 23:39:10 +00:00
Mike Auty
1a5c9d3af8
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
2018-12-12 23:38:01 +00:00
Mike Auty
67f5230d77
Ensure the plugins are appropriately sorted when listing them.
2018-12-09 13:32:51 +00:00
Mike Auty
f57bfa5738
Prepare core plugins for moving into the framework namespace.
2018-12-09 13:32:32 +00:00
Mike Auty