Commit Graph
212 Commits
Author SHA1 Message Date
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty 2c72439334 Add in protections for the crashdump layer. 2018-12-13 22:59:21 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 5e8ba16709 Remove the unimplemented hook. 2018-12-13 01:16:05 +00:00
Mike Auty 7c4cb0d291 Remove attempts to improve speed that may not help. 2018-12-13 01:16:05 +00:00
Mike Auty da2f3b38d3 Add in page-table repetition blocking code (helps with windows 10 virtual space). 2018-12-13 01:16:05 +00:00
Mike Auty 91b2c61803 Try to add some optimizations to intel scanning. 2018-12-13 01:16:05 +00:00
Mike Auty b148305f76 Add in protection for the Lime Layer being unable to read the header. 2018-12-12 23:42:31 +00:00
Mike Auty 4703f192e4 Add in a check to ensure mappings that ignore errors don't cause errors. 2018-12-01 21:33:09 +00:00
Mike Auty f1c5b3ca29 Improve the typing in places. 2018-10-11 11:14:29 +01:00
Mike Auty de3bfad135 Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError. 2018-09-28 12:44:19 +01:00
Mike Auty 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). 2018-09-20 16:14:57 +01:00
Mike Auty ac8401991c Convert all remaining plugins to use the new classmethod pslist. 2018-06-16 13:38:48 +01:00
Mike Auty ddeacd3524 Fix up my mistaken advice. 2018-06-16 09:56:10 +01:00
Dave Lassalleandikelos a0edd1e38e root_cell_offset changes seem to have fixed maxaddr problems 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos f2029d5657 add comment about registry key case sensitivity and re-work root_cell_offset 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos b85c143af9 yield UnreadableValues when key not found, and set default RootCell on exception 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 201fc5780a don't use BaseBlock.Length for maxaddr 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos 0c3866ef77 make registry path comparison case insensitive 2018-06-16 09:54:45 +01:00
Dave Lassalleandikelos abfcdba524 add Windows 10 Registry process support 2018-06-04 20:17:28 +01:00
Mike Auty 9711793503 Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions. 2018-06-04 09:40:26 +01:00
Mike Auty 7a52ac9deb Fix a large number of typing issues.
There are several instances where mypy didn't detect

if blah is not None:
    blah = thing

and so were rewritten as:

blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty 8bc5a4e898 Ensure maxaddr is never includes the volatile bit. 2018-05-23 19:41:13 +01:00
Mike Auty 347b4854ff Comment out the HBIN size check for now
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty 689756dc9a Deal with NULL base blocks in the registry code. 2018-05-20 23:25:20 +01:00
Mike Auty 037ac28534 Move around the scanning functions and create an API for the iterators. 2018-05-14 01:03:43 +01:00
Mike Auty 04d609064a Remove TODO that's in the wrong place, and we've just to-done. 2018-05-13 21:32:05 +01:00
Mike Auty 63a1fb3690 Simplify intel scanning to ensure overlaps are handled correctly. 2018-05-13 20:57:11 +01:00
Mike Auty a07691b04f Ensure scanners don't return duplicates in the overlap. 2018-05-13 20:55:54 +01:00
Mike Auty 8b5c58fee9 Fix up slight intel scanner issue. 2018-05-13 15:46:02 +01:00
Mike Auty 5c0140ed74 Fix typo in intel scanning engine. 2018-05-10 02:40:08 +01:00
Mike Auty 83eb346ba5 Clarify logic and fix an issue in intel scanning. 2018-05-10 02:13:46 +01:00
Mike Auty 19b8a0f696 Improve scan chunking for intel layers
We now use mapping to skip unmapped pages when scanning.  This
should be slightly quicker and likely more accurate.  We also now
don't chunk over the size requested by the scanner.  We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty b791b6c1a1 Add an ignore_errors check for positive lengths. 2018-05-09 01:16:47 +01:00
Mike Auty 983eabac86 Fix an issue with IntelPAE's mapping domain size. 2018-05-08 00:02:14 +01:00
Mike Auty e53cb16485 Vastly speed-up intel memory traversals
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer.  This means large holes in the memory
can be skipped more quickly.  It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty 093b354f7e Pylint and fix the _check_header return type. 2018-05-02 20:20:24 +01:00
Mike Auty 8cf92051d5 Put back in the comments we wanted to keep. 2018-05-02 20:14:06 +01:00
awaltersandikelos 848d55a59a Updated to use new create convenience function for IntermediateSymbolTable. 2018-05-02 20:10:14 +01:00
awaltersandikelos e8f64664a8 Initial changes based on @ikelos review. Also updated crash structs. 2018-05-02 20:10:14 +01:00
awaltersandikelos 6eeafbc391 Windows Crash Layer 2018-05-02 20:10:14 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty 556fa29ada Deprecate/remove 'provides' attribute. 2018-04-26 12:31:33 +01:00
Mike Auty 623180ddbd Make many typing fixes, based on mypy-0.590. 2018-04-22 20:45:59 +01:00
Mike Auty 6402c94078 Rework IntermediateSymbolFile loading to a classmethod. 2018-04-12 15:15:25 +01:00
Mike Auty 470c139e81 Throw swap exceptions if the page is supposed to be swapped out, but the swap layer can't be found. 2018-03-23 00:48:28 +00:00
Mike Auty 6482059521 Fix up typing issues identified by mypy. 2018-03-22 00:44:49 +00:00
Mike Auty dd41ea1cd1 Improve registry docstrings. 2018-03-11 21:40:54 +00:00
Mike Auty 18fa9e74d7 Add in the capability for get_key to return full node_paths.
Also resolves issue #18.
2018-03-11 21:25:58 +00:00