Mike Auty
9824538bd9
Numerous pycharm warnings resolved
...
This includes:
* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
0abaa3af2f
Don't load all symbols when we ask to import symbols.
2018-12-14 00:27:46 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
dfe2f86fe2
Lots and lots of typing additions found by an initial monkeytype run.
2018-12-13 23:46:37 +00:00
Mike Auty
2c72439334
Add in protections for the crashdump layer.
2018-12-13 22:59:21 +00:00
Mike Auty
d9369001d4
Ensure we can cache the linux/mac banners.
2018-12-13 21:23:59 +00:00
Mike Auty
f41e3e0453
Completely rework the primitive data format system.
2018-12-13 18:33:42 +00:00
Mike Auty
6b480eed56
Fix up PE data construction code.
2018-12-13 18:33:42 +00:00
Mike Auty
9949809198
Fix a minor typo.
2018-12-13 18:33:42 +00:00
Mike Auty
b533d19f83
Refactor the data extraction for primitive types.
2018-12-13 18:33:42 +00:00
Mike Auty
a78452e361
Fix up ugly int128 hack with a slightly nicer hack.
2018-12-13 15:56:24 +00:00
Mike Auty
6e43d0bab4
Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it).
2018-12-13 15:56:24 +00:00
Mike Auty
1341925160
Remove unnecessary requirements method.
2018-12-13 15:56:24 +00:00
Mike Auty
cd7296d64e
Fix up based on the recent master refactoring.
2018-12-13 15:56:24 +00:00
Mike Auty
3a2c2b30a9
Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things.
2018-12-13 15:56:24 +00:00
Mike Auty
25fb05c9bf
Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address.
2018-12-13 15:56:24 +00:00
Mike Auty
57b2a5bab7
Fix up a rogue classmethod, and ensure we have a separate variable for the new layer.
2018-12-13 15:56:24 +00:00
Mike Auty
5135215c62
Do some tidying and renaming.
2018-12-13 15:56:24 +00:00
Mike Auty
7a462d5f85
Refactor out the shared symbol cache/finder code from linux and mac.
2018-12-13 15:56:24 +00:00
Mike Auty
55286f04cb
Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat.
2018-12-13 15:56:24 +00:00
Andrew Case and ikelos
622c86f9ed
Add initial mac backend code, with broken DTB finding, along with the pslist plugin
2018-12-13 15:56:24 +00:00
Mike Auty
c9a08603c7
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
2018-12-13 01:39:26 +00:00
Mike Auty
5e8ba16709
Remove the unimplemented hook.
2018-12-13 01:16:05 +00:00
Mike Auty
dfaaf1e455
Fix up some things missed in the master refactor.
2018-12-13 01:16:05 +00:00
Mike Auty
7c4cb0d291
Remove attempts to improve speed that may not help.
2018-12-13 01:16:05 +00:00
Mike Auty
da2f3b38d3
Add in page-table repetition blocking code (helps with windows 10 virtual space).
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
736a1c6e50
add is_valid() for _FILE_OBJECT and _EPROCESS
2018-12-13 01:16:05 +00:00
Mike Auty
91b2c61803
Try to add some optimizations to intel scanning.
2018-12-13 01:16:05 +00:00
Mike Auty
76264cee34
Catch invalid _OBJECT_HEADER objects.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
650a188d51
updates for win8/win10 poolscanning
2018-12-13 01:16:05 +00:00
Mike Auty
fa033b8ab7
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
2018-12-13 01:16:05 +00:00
Mike Auty
eacc45dab6
Ensure POOL_HEADER finds the right object in the right symbol table.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d653839359
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d667a68f97
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
a76d71a7dc
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Mike Auty
b148305f76
Add in protection for the Lime Layer being unable to read the header.
2018-12-12 23:42:31 +00:00
Mike Auty
8acbe8bba3
Refactor conversion code from objects.utility to a conversion module in renderers.
2018-12-12 23:39:10 +00:00
Mike Auty
1a5c9d3af8
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
2018-12-12 23:38:01 +00:00
Mike Auty
f57bfa5738
Prepare core plugins for moving into the framework namespace.
2018-12-09 13:32:32 +00:00
Mike Auty
cf95f6e73e
Minor typing fix.
2018-12-08 18:41:13 +00:00
Mike Auty
b5d532555c
Convert the adhoc scanner into a layer scanner using sections.
2018-12-08 18:21:39 +00:00
Mike Auty
649a39a13d
Change time_as_integer from a property to get_time_as_integer method.
2018-12-08 18:00:44 +00:00
Mike Auty
918653e398
Convert aslr_mask_symbol_table to more parameterized form.
2018-12-08 17:55:13 +00:00
Andrew Case and ikelos
8705fb3047
update time_object to get_time_object
2018-12-08 17:34:48 +00:00
Andrew Case and ikelos
0e7b6b6702
Updated hist_entry type and references, add bash plugin
2018-12-08 17:34:48 +00:00
Andrew Case and ikelos
3ab654847e
Change NotApplicableValue -> UnparsableValue
2018-12-08 17:34:48 +00:00
Andrew Case and ikelos
c6e9763e5a
Linux - add bash plugin
2018-12-08 17:34:48 +00:00
Mike Auty
34ed11bfc0
Fix up issue with coalescing sections.
2018-12-07 01:47:16 +00:00
Mike Auty
aaeb349a70
Remove debugging call.
2018-12-07 01:47:16 +00:00
Mike Auty