Mike Auty
bca972f28a
Remove the python implementation of __getattribute__ for speed.
...
The __getattribute__ method is called for *all* attribute lookups, and
the python implementation is likely slow. The only function the python
implementation provided was to check that properties started with
helper_. Since this only provided a log message, we could add it back
in only if the log level is high enough? Either way, it's not
significant enough to warrant costing extra time in every attribute
lookup on every object.
2018-07-30 23:58:02 +01:00
Mike Auty
552101b593
Attempt to reduce the amount of time taken in calling templates.
2018-07-30 23:53:00 +01:00
Mike Auty
79d2bab44d
A few additional typing fixes.
2018-07-22 13:29:43 +01:00
Mike Auty
4897b7ab81
Fix up some typing errors.
2018-07-22 13:19:20 +01:00
Mike Auty
717aabf190
Mask off more symbols files and IDEs.
2018-07-22 12:00:31 +01:00
Mike Auty
b6b4c44300
Ensure cross-platform support for linux_cache.
2018-07-22 11:55:10 +01:00
Michael Ligh and ikelos
3d7c10dd32
add the cmdline plugin for windows
2018-07-19 21:26:32 +01:00
Mike Auty
2f3f291e53
Fix up missing parameter in symbol_space.
2018-07-19 09:54:56 +01:00
Mike Auty
2f28dfa6c9
Support finding symbols by ranges.
2018-07-19 09:51:51 +01:00
Mike Auty
083fd43890
Ensure get_module_symbols_by_absolute_location only returns modules at the appropriate offset.
2018-07-19 09:22:57 +01:00
Mike Auty
3ba628da7a
Add in NotAvailableValue for specific uses.
2018-07-18 22:44:27 +01:00
Mike Auty
106a0cb6fd
Rework the array_of_pointers utility function.
...
It now makes use of the original array's symbol table to get the pointer
template, such that the size of the pointer is correct according to the
original table. Resolves "pointer.size" attribute errors (firing inside
a property and thus throwing off unusual exceptions).
2018-07-18 22:35:13 +01:00
Mike Auty
5c41e05876
Improve Module construction.
...
The hash/size determination takes time, so make the hash generated on
use (so far, only on dedupe) and cache it, since it shouldn't change.
We also cache the Module construction, so that if it's done in a loop
(like pslist), it won't keep recaculating for the same module.
2018-07-18 21:46:56 +01:00
Mike Auty
cc5b470602
Remove the caching to see if it's causing the exceptions.
2018-07-18 21:08:50 +01:00
Mike Auty
ce05510413
Additional fixes for module collections.
2018-07-18 14:35:54 +01:00
Mike Auty
91e94440fe
Add in hashing for module differentiation and additional collection features.
2018-07-18 00:42:48 +01:00
Mike Auty
5906c76b1b
Fix omission where protect_values became a class method.
2018-07-17 21:15:41 +01:00
Mike Auty
5fbf923186
Fix documentation and try to guess the size where possible.
2018-07-17 21:15:09 +01:00
Mike Auty
8fd1196de7
Fix minor typo.
2018-06-25 00:22:00 +01:00
Mike Auty
0ebf11dcfa
Add typing information (and basic linting/formatting).
2018-06-25 00:18:02 +01:00
Mike Auty
9c06c25fae
Add in support for module sizes.
2018-06-25 00:16:17 +01:00
Mike Auty
c012842bd6
Refactor the name to be more accurate.
2018-06-21 00:27:38 +01:00
Mike Auty
aedcf40fc2
Add support for separate symbol_tables and name in Modules.
2018-06-21 00:25:55 +01:00
Mike Auty
d68d62e47d
Fix methodclass conversion for linux pslist.
2018-06-20 22:19:24 +01:00
Mike Auty
ffa54c45eb
Fix linux invalid keyword argument bug.
2018-06-20 22:15:42 +01:00
Michael Ligh and ikelos
ab6a9fa43b
add typing, catch more specific exceptions, raise pefile dependency issues, use classmethod
2018-06-19 09:59:28 +01:00
Michael Ligh and ikelos
e4fbc82ab3
verinfo still needs the primary and nt_symbols requirements
2018-06-19 09:59:28 +01:00
Michael Ligh and ikelos
c43c53a7d7
initial draft of verinfo
2018-06-19 09:59:28 +01:00
Mike Auty
70abef1f46
Rework how we handle import errors.
2018-06-19 09:58:09 +01:00
Mike Auty
4ca705a05c
Ensure the lack of yara doesn't kill volatility completely.
2018-06-17 20:39:29 +01:00
Mike Auty
f28ee6077e
Update for the new classmethod model.
2018-06-17 11:16:27 +01:00
Mike Auty
a1caf8d149
Add in initial VAD yarascan code.
2018-06-17 11:16:27 +01:00
Mike Auty
9c2ba66c53
Add in initial version of yarascan plugin.
2018-06-17 11:16:27 +01:00
Mike Auty
d9ed86bcc5
Ensure we return the correct values for dir().
2018-06-16 14:29:51 +01:00
Mike Auty
c0ec52822b
Add some typing fixes.
2018-06-16 14:19:36 +01:00
Mike Auty
60df83ef15
Convert modules/moddump to classmethod.
2018-06-16 14:03:22 +01:00
Mike Auty
ecb9d5cf05
Convert vadinfo calls to classmethods.
2018-06-16 13:38:48 +01:00
Mike Auty
c4c6d30d42
Rejig where the pslist plugin exists.
2018-06-16 13:38:48 +01:00
Mike Auty
ac8401991c
Convert all remaining plugins to use the new classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
6ca34e6607
Start converting plugins to use classmethod pslist.
2018-06-16 13:38:48 +01:00
Mike Auty
aea59ffa34
Make the change for the core pslist (breaks lots of plugins).
2018-06-16 13:38:48 +01:00
Mike Auty
86c5302c99
_missing_ was a python-3.6 feature.
2018-06-16 12:36:00 +01:00
Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
09475d5992
set default value for key since we combined exception handling
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
c68d02d565
combine exception handling to reduce code duplication
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Mike Auty