Commit Graph
103 Commits
Author SHA1 Message Date
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Mike Auty cf5cf5cacd Add in caching just at the page read point of intel spaces. 2019-05-11 20:58:06 +01:00
Mike Auty 6b3eef4083 Additional optimization by extracting the struct calls from the intel translation methods. 2019-02-14 23:42:06 +00:00
Mike Auty b6e3b8c5cc Add in minor optimizations. 2019-02-14 21:23:43 +00:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty 6bb927ebfa Fix up terminology to ensure we only refer to layers not spaces. 2019-01-03 00:40:13 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 5e8ba16709 Remove the unimplemented hook. 2018-12-13 01:16:05 +00:00
Mike Auty 7c4cb0d291 Remove attempts to improve speed that may not help. 2018-12-13 01:16:05 +00:00
Mike Auty da2f3b38d3 Add in page-table repetition blocking code (helps with windows 10 virtual space). 2018-12-13 01:16:05 +00:00
Mike Auty 91b2c61803 Try to add some optimizations to intel scanning. 2018-12-13 01:16:05 +00:00
Mike Auty 4703f192e4 Add in a check to ensure mappings that ignore errors don't cause errors. 2018-12-01 21:33:09 +00:00
Mike Auty f1c5b3ca29 Improve the typing in places. 2018-10-11 11:14:29 +01:00
Mike Auty de3bfad135 Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError. 2018-09-28 12:44:19 +01:00
Mike Auty 9711793503 Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions. 2018-06-04 09:40:26 +01:00
Mike Auty 037ac28534 Move around the scanning functions and create an API for the iterators. 2018-05-14 01:03:43 +01:00
Mike Auty 04d609064a Remove TODO that's in the wrong place, and we've just to-done. 2018-05-13 21:32:05 +01:00
Mike Auty 63a1fb3690 Simplify intel scanning to ensure overlaps are handled correctly. 2018-05-13 20:57:11 +01:00
Mike Auty 8b5c58fee9 Fix up slight intel scanner issue. 2018-05-13 15:46:02 +01:00
Mike Auty 5c0140ed74 Fix typo in intel scanning engine. 2018-05-10 02:40:08 +01:00
Mike Auty 83eb346ba5 Clarify logic and fix an issue in intel scanning. 2018-05-10 02:13:46 +01:00
Mike Auty 19b8a0f696 Improve scan chunking for intel layers
We now use mapping to skip unmapped pages when scanning.  This
should be slightly quicker and likely more accurate.  We also now
don't chunk over the size requested by the scanner.  We don't quite
handle overlaps correctly yet (we overlap, but don't prevent
duplicates if the pattern is entirely within the overlap segment).
2018-05-09 23:32:58 +01:00
Mike Auty b791b6c1a1 Add an ignore_errors check for positive lengths. 2018-05-09 01:16:47 +01:00
Mike Auty 983eabac86 Fix an issue with IntelPAE's mapping domain size. 2018-05-08 00:02:14 +01:00
Mike Auty e53cb16485 Vastly speed-up intel memory traversals
This uses the exceptions to indicate how much can be skipped in the
virtual intel translation layer.  This means large holes in the memory
can be skipped more quickly.  It also eliminates the is_valid/mapping
loop.
2018-05-07 23:10:01 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00
Mike Auty 470c139e81 Throw swap exceptions if the page is supposed to be swapped out, but the swap layer can't be found. 2018-03-23 00:48:28 +00:00
Mike Auty 3f37ab760c Change inheritance to fix type checking. 2018-03-08 00:23:49 +00:00
Mike Auty e8422f0774 Refactor to reduce duplication in swap support. 2018-03-05 23:53:34 +00:00
Mike Auty 994bd7c394 Fix up the finding of swap layers so swap actually works. 2018-02-11 21:41:39 +00:00
Mike Auty b7c68f4e98 Rework LayerListRequirement from a ListRequirement to a MultiRequirement. 2018-02-11 18:35:18 +00:00
Mike Auty cd8f6876ff Add in LayerListRequirement type. 2018-02-10 22:42:59 +00:00
Mike Auty 24be045266 Minor fix ups with typing and exceptions. 2018-02-10 22:42:31 +00:00
Mike Auty cbe75dadf7 Add in Intel32e and improve IntelPAE. 2018-02-10 00:03:13 +00:00
Mike Auty 8b75c458ba Fix up the calculations and filtering for pagefile offsets. 2018-02-09 01:19:22 +00:00
Mike Auty deb7da246b Add in initial shot at PAE page entry handling. 2018-01-28 16:29:28 +00:00
Mike Auty 35be4c5a84 Add in more information to the paged exceptions. 2018-01-28 16:25:16 +00:00
Mike Auty c203663f0b Refactor requirements to support a list of swap layers. 2018-01-28 14:48:50 +00:00
Mike Auty ac12098317 Add type-annotations for reamining layer files. 2017-12-13 20:48:52 +00:00
Mike Auty 30059766b6 Plug the WindowsMixin into the automagic. 2017-11-24 12:02:34 +00:00
Mike Auty d9d67efa3a Add in the capability to stash linux_banners.
Since the stacker and Linux automagic will always be different objects
(even if they're the same class), and we don't want to add OS specific
code to the stacker, this is the simplest way of allowing the Linux
symbol automagic to get information from the dtb finding stacker.
2017-11-04 17:09:59 +00:00
Mike Auty 761777c8ef Add commentary as to why we can't scan faster by ignoring surjective duplicates. 2017-06-03 20:57:19 +01:00
Mike Auty b72c3aaed5 Handle invalid translations lower than the top layer when scanning. 2017-06-03 20:26:21 +01:00
Mike Auty 5e15d522bd Remove automatic IDE-inserted attributions.
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written!  5:S

There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty de8508a8bb Reset the maxvirtaddr to use maxphyaddr just so we don't forget. 2017-05-01 14:35:22 +01:00