Mike Auty
d0ebeab253
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-06-05 23:01:34 +01:00
Mike Auty
5dedf00f64
Update the linux automagic based on the VMCOREINFO structure.
2017-06-05 23:01:22 +01:00
Mike Auty
761777c8ef
Add commentary as to why we can't scan faster by ignoring surjective duplicates.
2017-06-03 20:57:19 +01:00
Mike Auty
c05599d78a
Minor clean-up of segmented layer.
2017-06-03 20:26:45 +01:00
Mike Auty
b72c3aaed5
Handle invalid translations lower than the top layer when scanning.
2017-06-03 20:26:21 +01:00
Mike Auty
0675350346
Fix up minor logical error in multithreaded scanning global flag.
2017-06-03 17:49:56 +01:00
Mike Auty
c862f38917
Add in flag to forcibly disable all multithreaded scanning.
2017-06-03 17:48:32 +01:00
Mike Auty
9a2bfe7c92
Remove unused variable.
2017-06-03 17:44:59 +01:00
Mike Auty
93a6efd666
Ensure we don't get name confusion when dealing with variables.
2017-06-03 17:44:13 +01:00
Mike Auty
bc4c386d6d
Fix a multiprocessing issue (and tidy away the kwargs).
...
By not passing the arguments from exceptions down to the
base class Exception, it causes an issue when they are
pickled to be passed between processes. For more information,
see http://bugs.python.org/issue1692335 .
2017-06-03 12:41:18 +01:00
Mike Auty
fc325f8324
Ensure the pdb scanning heuristic works with 32-bit systems as well as 64-bit ones.
2017-06-01 23:52:30 +01:00
Mike Auty
904a5b18a3
Try to bomb out of the NlpDtbFinder if the space already has a dtb.
2017-06-01 01:00:49 +01:00
Mike Auty
bcfc40acfe
Fix egregious typo. 5:S
2017-06-01 00:56:40 +01:00
Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
5e15d522bd
Remove automatic IDE-inserted attributions.
...
They weren't consistent and they show just remind me how slowly
I've been getting vol 3 written! 5:S
There's git commits to track all of that stuff if we need it.
2017-05-14 11:40:49 +01:00
Mike Auty
17a3f1630c
Add back in the masking, since it is important if maxmium_address is ever not 1 less than a power of 2.
2017-05-10 17:37:38 +01:00
Mike Auty
a05a470347
Fix up some complete and utter daftness, tactfully pointed out by npetroni.
2017-05-10 17:30:45 +01:00
Mike Auty
4065cfa090
Add in first draft of Linux identification stacker.
2017-05-06 14:09:49 +01:00
Mike Auty
6da8076050
Add in Regular Expression scanner.
2017-05-06 14:02:09 +01:00
Mike Auty
16b1aca56b
Make the WintelHelper documentation accurate again.
2017-05-06 10:56:21 +01:00
Mike Auty
fe04c423ab
Remove left-over debugging features that slowed down the NLP dtb finder.
2017-05-02 14:51:50 +01:00
Mike Auty
d579f7f583
Add in a condensed version of Nick Petroni's DTB finder/stacker code.
2017-05-01 16:11:00 +01:00
Mike Auty
6e9791deb0
Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles.
2017-05-01 15:59:24 +01:00
Mike Auty
7e1965715d
Ensure the pdbscanner can operate when not handed an appropriate intel layer.
2017-05-01 14:38:47 +01:00
Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty
f520176b2b
Move the wrapper out to stop it seeming like a method.
2017-04-26 15:01:49 +01:00
Mike Auty
0c689de244
Fix up numerous silly mistakes.
2017-04-26 14:57:40 +01:00
Mike Auty
1d39c68799
All templates are equal (not just ObjectTemplates).
2017-04-26 14:51:56 +01:00
Mike Auty
6c4bd65b8a
Change my mind on accepting a full symbol rather than just the type.
2017-04-26 10:04:40 +01:00
Mike Auty
f97a5b4700
All the object constructor to accept a Symbol as well as a name.
2017-04-26 09:59:47 +01:00
Mike Auty
4a55d927c1
Fix up population of type attributes in ISF files.
2017-04-25 23:05:48 +01:00
Mike Auty
2523394118
Remove the deprecated utility adapters in favour of the initial Module implementation.
2017-04-23 17:19:22 +01:00
Mike Auty
7bf332617e
Remove non-determinism by favouring x64 (alphabetically lower). The bases detection requires improvement.
2017-04-23 02:43:08 +01:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
ff41d4e5b0
Improve config.json handling, making single_location optional but bypasses the stacker automagic.
2017-04-21 00:53:08 +01:00
Mike Auty
d37732e9b6
Add in array_to_string helper function.
2017-04-21 00:01:12 +01:00
Mike Auty
67015f3316
Fix up default logging levels.
2017-04-20 23:48:56 +01:00
Mike Auty
687da20cbc
Fix up a typo @npetroni pointed out.
2017-04-20 23:11:42 +01:00
Nick L. Petroni, Jr
f05df0c1cd
added Bin() to format_hints: print the value as a Python binary number
2017-04-17 14:05:50 -04:00
Mike Auty
0f9dbe3112
Fix up a small mistake in the interface version checking logic.
2017-03-29 20:29:19 +01:00
Mike Auty
dcc558717c
Shift around the object_factory and add the symbol rebaser.
...
The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
2017-03-24 01:50:16 +00:00
Mike Auty
1db4922033
Ensure we mimic python's errors as closely as possible.
2017-03-24 01:01:52 +00:00
Mike Auty