Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
b1c3ecfa17
add mutantscan
2019-02-27 12:49:50 -06:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
c9a08603c7
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
2018-12-13 01:39:26 +00:00
Mike Auty
c0b7376226
Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist.
2018-09-30 17:00:25 +01:00
Michael Ligh and ikelos
be6a351a11
start adding the _POOL_HEADER extension. expand the pool constraints to include processes
2018-09-15 15:22:38 +01:00
Michael Ligh and Mike Auty
fb57e2c5f2
wininfo, procdump, dlldump, and json for pe & kdbg
2018-06-12 08:40:21 +01:00
Mike Auty
556fa29ada
Deprecate/remove 'provides' attribute.
2018-04-26 12:31:33 +01:00
Michael Ligh and ikelos
205af99a3e
Rev2 after rev1 comments
2018-03-19 22:35:00 +00:00
Michael Ligh and ikelos
8282df5893
Initial versions of vadinfo and vaddump
2018-03-19 22:35:00 +00:00
Mike Auty
942de5f166
Finish adding type-annotations thoughout the code.
2017-12-13 20:48:52 +00:00
iMHLv2
fad5a238d5
add the windows handles plugin
2017-12-13 20:43:17 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
ed716ca12a
Convert SymbolTableInterfaces to descend from ConfigurableInterface
...
This allows SymbolTables to hold actual requirements (which
IntermedSymbolTable already did, but without pulling in the right
interface). It means that values like kernel_virtual_offset get saved.
We still need to figure out how to allow plugins to demand optional
configuration values in other places (such as the kvo) but for now the
plugin will barf if it doesn't get it.
2016-12-12 02:08:32 +00:00
Mike Auty
e2d5f51ad5
Remove old and rotten code.
2016-12-12 00:25:03 +00:00
Mike Auty
c52bf7cb6f
Pull out the appropriate natives based on the intermediate format data.
2016-12-04 23:50:13 +00:00
Mike Auty
0b447b6958
Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying.
2016-10-26 01:09:29 +01:00
Mike Auty
e02feed16e
Python 3 has a sane super() implementation (no arguments), so convert to using that.
2016-08-14 00:55:02 +01:00
Mike Auty
b92ccd771f
Fix up the DTB finder code and stick it all together.
2016-07-30 02:35:40 +01:00
Mike Auty
43aba96e3f
Minor pylint (alphabetical imports) and refactoring the construct class to work for symbols.
2016-07-30 01:58:29 +01:00
Mike Auty
a8d6fd5647
Refactor windows code to windows basic to avoid import loops.
2016-01-16 20:09:18 +00:00
Mike Auty
d258c56991
Rerun pylint with pycharm-5 and fix pep8 issues as well.
2015-11-21 13:12:00 +00:00
Mike Auty
65fcd5fbe5
Minor pylinting.
2015-09-28 01:34:52 +01:00
Mike Auty
f04122f640
Add in initial implementation of ContextFactories as classes. This is probably not the right way to do things, so I'll be trying out making them as objects with a function chain for applying modifications in a little while.
2015-01-16 11:29:12 +00:00
Mike Auty
87967853f7
Convert volinfo namespace to vol namespace.
2015-01-05 15:04:40 +00:00
Mike Auty
7c53ae31bb
Fix up all the necessary components in the _LIST_ENTRY code.
2015-01-05 00:00:16 +00:00
Mike Auty
f64b232f5a
Add in the iter function now that we finally have the member_name stored.
2015-01-04 23:10:48 +00:00
Mike Auty
446536d789
Remove the concept of template_info and revert to structure_name alone.
2015-01-04 04:27:52 +00:00
Mike Auty
09ee972e7e
Add in initial version of _LIST_ENTRY.
2015-01-02 00:12:28 +00:00
Mike Auty
5655548d3f
Allow owning_process to be called without parameters.
2014-12-31 03:46:34 +00:00
Mike Auty
bdb0c1488a
Update test_rig code to play around with code fragments.
2014-12-31 03:20:32 +00:00
Mike Auty