Mike Auty
aedcf40fc2
Add support for separate symbol_tables and name in Modules.
2018-06-21 00:25:55 +01:00
Mike Auty
ffa54c45eb
Fix linux invalid keyword argument bug.
2018-06-20 22:15:42 +01:00
Mike Auty
70abef1f46
Rework how we handle import errors.
2018-06-19 09:58:09 +01:00
Mike Auty
d9ed86bcc5
Ensure we return the correct values for dir().
2018-06-16 14:29:51 +01:00
Mike Auty
c0ec52822b
Add some typing fixes.
2018-06-16 14:19:36 +01:00
Mike Auty
ac8401991c
Convert all remaining plugins to use the new classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
86c5302c99
_missing_ was a python-3.6 feature.
2018-06-16 12:36:00 +01:00
Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
5467c1c5e3
prevent from halting on an unknown registry value type
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
218b1fd37c
use masked length to extract data
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
6cfd3b6499
fix typo in debug statement
2018-06-16 09:54:45 +01:00
Michael Ligh and Mike Auty
76f5d35499
update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
ae9d7dbc86
use *args and **kwargs when inheriting from IntermediateSymbolTable
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
fb57e2c5f2
wininfo, procdump, dlldump, and json for pe & kdbg
2018-06-12 08:40:21 +01:00
Mike Auty
2cbd444603
Add in symbol table address masker.
2018-06-06 23:12:46 +01:00
Mike Auty
b228ad8e95
Add comment concerning reconstructability of SymbolTables.
2018-06-06 23:10:21 +01:00
Mike Auty
253304270b
Ensure we can add native_types when we create tables.
2018-06-06 00:42:23 +01:00
Mike Auty
36dee38a9e
Leave pointer out of the default types (since it needs an appropriate size).
2018-06-05 21:46:02 +01:00
Mike Auty
113c23a66d
Last of the typing fix-ups.
2018-06-04 23:55:38 +01:00
Mike Auty
2dc3d2928d
Fix more typing issues.
2018-06-04 23:28:26 +01:00
Dave Lassalle and ikelos
abfcdba524
add Windows 10 Registry process support
2018-06-04 20:17:28 +01:00
Mike Auty
9711793503
Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions.
2018-06-04 09:40:26 +01:00
Mike Auty
f957b2915e
Fix up issue having made optional parameters non-optional.
2018-06-04 09:39:38 +01:00
Mike Auty
7a52ac9deb
Fix a large number of typing issues.
...
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty
6a6acd2dcc
Move the table_mapping parameter to avoid disrupting the previous interface.
2018-05-30 18:37:29 +01:00
Mike Auty
f72e39d558
Fix up small but significant typo.
...
When asking for data with padding, the padding was guaranteed to always
be at the end without spaces between pages.
2018-05-29 00:42:52 +01:00
Mike Auty
67239002bc
Attempt to fix an intel read issue spotted by imhlv2
...
The length value inside the read method of the TranslationLayer base class
would potentially get overwritten by the inner loop which also defined a
length value.
2018-05-28 23:25:49 +01:00
Mike Auty
33b2c9522d
Add in support for ISF.create to handle table_mappings.
2018-05-23 22:26:52 +01:00
Mike Auty
a5df5372f5
Add in table_mapping through the ISF classes.
2018-05-23 22:23:32 +01:00
Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
665db0017e
Don't count the volatile bit when checking things are outside the hive maximum address.
2018-05-21 18:02:48 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
61bf1d40b0
Fix scan_iterator parameter type.
2018-05-15 00:06:43 +01:00
Mike Auty
037ac28534
Move around the scanning functions and create an API for the iterators.
2018-05-14 01:03:43 +01:00
Mike Auty
04d609064a
Remove TODO that's in the wrong place, and we've just to-done.
2018-05-13 21:32:05 +01:00
Mike Auty
63a1fb3690
Simplify intel scanning to ensure overlaps are handled correctly.
2018-05-13 20:57:11 +01:00
Mike Auty
a07691b04f
Ensure scanners don't return duplicates in the overlap.
2018-05-13 20:55:54 +01:00
Mike Auty
8b5c58fee9
Fix up slight intel scanner issue.
2018-05-13 15:46:02 +01:00
Mike Auty
44ca819869
Minor documentation tweaks.
2018-05-13 01:05:56 +01:00
Mike Auty
3ce9ad93c7
Fix return types for ModuleCollections.
2018-05-10 02:40:26 +01:00
Mike Auty
5c0140ed74
Fix typo in intel scanning engine.
2018-05-10 02:40:08 +01:00
Mike Auty
83eb346ba5
Clarify logic and fix an issue in intel scanning.
2018-05-10 02:13:46 +01:00
Mike Auty
19b8a0f696
Improve scan chunking for intel layers
...
We now use mapping to skip unmapped pages when scanning. This
should be slightly quicker and likely more accurate. We also now
don't chunk over the size requested by the scanner. We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty
b791b6c1a1
Add an ignore_errors check for positive lengths.
2018-05-09 01:16:47 +01:00
Mike Auty