Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
5467c1c5e3
prevent from halting on an unknown registry value type
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
218b1fd37c
use masked length to extract data
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
6cfd3b6499
fix typo in debug statement
2018-06-16 09:54:45 +01:00
Michael Ligh and Mike Auty
76f5d35499
update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
ae9d7dbc86
use *args and **kwargs when inheriting from IntermediateSymbolTable
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
fb57e2c5f2
wininfo, procdump, dlldump, and json for pe & kdbg
2018-06-12 08:40:21 +01:00
Mike Auty
2cbd444603
Add in symbol table address masker.
2018-06-06 23:12:46 +01:00
Mike Auty
b228ad8e95
Add comment concerning reconstructability of SymbolTables.
2018-06-06 23:10:21 +01:00
Mike Auty
253304270b
Ensure we can add native_types when we create tables.
2018-06-06 00:42:23 +01:00
Mike Auty
36dee38a9e
Leave pointer out of the default types (since it needs an appropriate size).
2018-06-05 21:46:02 +01:00
Mike Auty
113c23a66d
Last of the typing fix-ups.
2018-06-04 23:55:38 +01:00
Mike Auty
2dc3d2928d
Fix more typing issues.
2018-06-04 23:28:26 +01:00
Dave Lassalle and ikelos
abfcdba524
add Windows 10 Registry process support
2018-06-04 20:17:28 +01:00
Mike Auty
9711793503
Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions.
2018-06-04 09:40:26 +01:00
Mike Auty
f957b2915e
Fix up issue having made optional parameters non-optional.
2018-06-04 09:39:38 +01:00
Mike Auty
7a52ac9deb
Fix a large number of typing issues.
...
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty
6a6acd2dcc
Move the table_mapping parameter to avoid disrupting the previous interface.
2018-05-30 18:37:29 +01:00
Mike Auty
f72e39d558
Fix up small but significant typo.
...
When asking for data with padding, the padding was guaranteed to always
be at the end without spaces between pages.
2018-05-29 00:42:52 +01:00
Mike Auty
67239002bc
Attempt to fix an intel read issue spotted by imhlv2
...
The length value inside the read method of the TranslationLayer base class
would potentially get overwritten by the inner loop which also defined a
length value.
2018-05-28 23:25:49 +01:00
Mike Auty
33b2c9522d
Add in support for ISF.create to handle table_mappings.
2018-05-23 22:26:52 +01:00
Mike Auty
a5df5372f5
Add in table_mapping through the ISF classes.
2018-05-23 22:23:32 +01:00
Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
665db0017e
Don't count the volatile bit when checking things are outside the hive maximum address.
2018-05-21 18:02:48 +01:00
Mike Auty
689756dc9a
Deal with NULL base blocks in the registry code.
2018-05-20 23:25:20 +01:00
Mike Auty
61bf1d40b0
Fix scan_iterator parameter type.
2018-05-15 00:06:43 +01:00
Mike Auty
037ac28534
Move around the scanning functions and create an API for the iterators.
2018-05-14 01:03:43 +01:00
Mike Auty
04d609064a
Remove TODO that's in the wrong place, and we've just to-done.
2018-05-13 21:32:05 +01:00
Mike Auty
63a1fb3690
Simplify intel scanning to ensure overlaps are handled correctly.
2018-05-13 20:57:11 +01:00
Mike Auty
a07691b04f
Ensure scanners don't return duplicates in the overlap.
2018-05-13 20:55:54 +01:00
Mike Auty
8b5c58fee9
Fix up slight intel scanner issue.
2018-05-13 15:46:02 +01:00
Mike Auty
44ca819869
Minor documentation tweaks.
2018-05-13 01:05:56 +01:00
Mike Auty
3ce9ad93c7
Fix return types for ModuleCollections.
2018-05-10 02:40:26 +01:00
Mike Auty
5c0140ed74
Fix typo in intel scanning engine.
2018-05-10 02:40:08 +01:00
Mike Auty
83eb346ba5
Clarify logic and fix an issue in intel scanning.
2018-05-10 02:13:46 +01:00
Mike Auty
19b8a0f696
Improve scan chunking for intel layers
...
We now use mapping to skip unmapped pages when scanning. This
should be slightly quicker and likely more accurate. We also now
don't chunk over the size requested by the scanner. We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty
b791b6c1a1
Add an ignore_errors check for positive lengths.
2018-05-09 01:16:47 +01:00
Mike Auty
b9fbf272d1
Add support for filename requirements
...
At the moment these are no different than strings, but they allow us to
do things like add URI handlers to file names if no scheme is provided,
and eventually do file existence testing. This also allows the web URI
to allow uploads as a means of passing a file in.
The configuration will only store the filename, because otherwise
someone could add a huge file which would need to be carried around in
the config forever after. Handling file existence errors is up to the
UI after the volatility library returns a "file not found" type
exception.
2018-05-08 23:54:08 +01:00
Mike Auty
983eabac86
Fix an issue with IntelPAE's mapping domain size.
2018-05-08 00:02:14 +01:00
Mike Auty
e53cb16485
Vastly speed-up intel memory traversals
...
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer. This means large holes in the memory
can be skipped more quickly. It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty
2cb5435911
Change the signature for add_process_layer to match linux.
2018-05-07 17:45:40 +01:00
Mike Auty
f23c4b51e4
Add in ModuleCollections for identifying symbols.
2018-05-07 00:05:01 +01:00
Michael Ligh
39413323b1
HexBytes() should inherit from bytes not int
2018-05-06 09:24:36 -05:00
Mike Auty
093b354f7e
Pylint and fix the _check_header return type.
2018-05-02 20:20:24 +01:00
Mike Auty
8cf92051d5
Put back in the comments we wanted to keep.
2018-05-02 20:14:06 +01:00
awalters and ikelos
848d55a59a
Updated to use new create convenience function for IntermediateSymbolTable.
2018-05-02 20:10:14 +01:00
