Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
066a4e64f2
Minor fix for construct_layers.
2019-09-26 21:16:46 +01:00
Mike Auty
ae010a2390
Improve log levels and distribution of messages.
2019-09-26 21:16:12 +01:00
Mike Auty
211ad0d524
Remove useless calls to validate.
2019-09-26 15:58:22 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
dad88692b8
Minor improvements for pyinstaller packages.
2019-09-21 21:06:05 +01:00
Mike Auty
fc2ee7e401
Improve plugin category detection for systems such as volshell.
2019-09-16 11:36:43 +01:00
Mike Auty
421af88c29
Classmethod make_subconfig so other classmethods can use it.
2019-09-08 14:50:48 +01:00
Mike Auty
10ea65a236
Remove unnecessary imports.
2019-09-08 14:19:58 +01:00
Mike Auty
ffc7682d61
Ensure that layers are automatically imported when needed.
2019-09-08 14:13:28 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty
398c583432
Ensure failed downloads are reported.
2019-07-30 22:14:19 +01:00
Mike Auty
6fc295410f
Support progress callbacks and improve pdb downloading.
2019-07-30 22:14:19 +01:00
Mike Auty
3bb113b0a7
Improve documentation and integration.
2019-07-30 22:14:19 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Andrew Case
bc6e63cb19
Mac - skip invaid kaslr shift results
2019-05-28 19:59:14 -05:00
Mike Auty
4cfde031f6
Additional typing fixes.
2019-05-11 22:57:06 +01:00
Mike Auty
a7160dd6b6
Move the PDB downloading code and test for file writability.
2019-04-27 21:06:25 +01:00
Mike Auty
7c16c403d5
Ensure we delete the temorary file even if things go wrong.
2019-04-23 22:43:16 +01:00
Mike Auty
9350f7b88a
Don't forget to cleanup.
2019-04-23 00:32:29 +01:00
Mike Auty
ac282d01fb
Add in initial support at automatic downloading.
2019-04-23 00:16:19 +01:00
Mike Auty
03eddbfb74
Fix missing imports removed by the rebase.
2019-02-26 22:25:15 +00:00
Andrew Case and ikelos
c9adc6a0fa
remove usage of old string methods
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
6d2a5fbfaa
add mac_netstat and supporting networking code
2019-02-26 22:20:33 +00:00
Mike Auty
4e8c8a7232
Fix issues with SymbolRequirement refactoring.
2019-02-11 22:30:22 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
