iMHLv2
d7d176d040
add Is64Bit and IsPAE properties to the windows.info plugin
2021-01-06 11:36:56 -06:00
iMHLv2
53397117ef
remove unnecessary and unused imports from the windows extensions init file
2021-01-06 10:30:01 -06:00
Andrew Case and ikelos
93c6a62972
Detect attempts to fix the image base for LARGEADDRESSAWARE executables and provide the user with a warning. #332
2020-12-10 18:58:00 +00:00
Mike Auty
d63aef566f
Codebase: Yapf the codebase again
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
747fe8609f
update copywrite to 2020
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
17e629a4c4
converted process_file_object into a classmethod
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
e9f870ff05
revert self.context change back to self._context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
9f977080c5
changed self._context to self.context
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
d98337cc09
added debug statements to dump_file_producer when none is returned
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
4f37a28185
dump_file_producer is now a classmethod and returns a FileInterface Object
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
49acf44302
dumpfiles.py is now consistent with master and runs correctly
2020-12-10 15:37:40 +00:00
Matt Tressler and ikelos
8e1a599203
changed PluginRequirement to VersionRequirement
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0a9e663c41
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
442f877e9a
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
20f4fbf157
add --virtaddr and --physaddr options so users can supply virtual or physical addresses (or both)
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
0c09b98318
use native_layer_name in file_name_with_device() in case the FILE_OBJECT is instantiated from a memory (physical) layer
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
25b56b5ca4
remove the _VACB.is_valid() method - do all validity checks in the calling function
2020-12-10 15:37:40 +00:00
iMHLv2 and ikelos
3ac89577cc
refs #197 initial commit of windows.dumpfiles
2020-12-10 15:37:40 +00:00
Mike Auty
56ff75a74b
Layers: Add internal intel debugging flag
2020-12-10 12:18:14 +00:00
Mike Auty
e28016e45b
Pdbutility: Improve usability of symbol_table_from_offset
2020-12-08 16:34:59 +00:00
Jan and ikelos
3dea2b4187
adds os_distinguisher for 18363
2020-12-08 10:34:07 +00:00
Jan and ikelos
b3ffddcff0
fixes wrong offset in 18363 x64
2020-12-08 10:34:07 +00:00
Jan and ikelos
774528206c
adds new vol3 netscan profiles and fixes rare bug
2020-12-08 10:34:07 +00:00
Mike Auty
0d267d0d56
Codebase: Improve typing using monkeytype
2020-12-06 21:34:28 +00:00
cecio and ikelos
c9c37a9b35
OS check reworked as suggested by @iMHLv2 and @ikelos
2020-12-02 14:23:12 +00:00
cecio and ikelos
1cf625fc89
fix: the bounce from physical to virtual process is required only for OS < Win10.
...
Added the check in the "dump" option
2020-12-02 14:23:12 +00:00
Mike Auty
f88ce55199
Automagic: Improve debugging output for linux/mac
2020-12-02 09:51:42 +00:00
Mike Auty
8fb53a32a8
PdbUtility: Support multiple debug directories
2020-12-01 01:21:36 +00:00
Mike Auty
4d0a07194a
PDBUtility: Update to use only pefile
2020-12-01 01:21:36 +00:00
Mike Auty
d77399b82b
Pdbconv: Use both pefile and volatility to get the guid
2020-12-01 01:21:36 +00:00
Mike Auty
65310eb841
Pdbconv: Slight tweaks to database_name finding
2020-11-29 23:05:21 +00:00
Mike Auty
dd0f690988
Pdbconv: Extract appropriate database name if possible
...
Fixes #381
2020-11-29 22:56:01 +00:00
AsafEitani and ikelos
4ec006e606
Fix 'maxsize variable doing nothing' bug
...
In one of the earlier commits the varible was erased from being passed to vaddump - that corrects it.
2020-11-18 19:56:30 +00:00
Mike Auty
9150cd971b
Core: Change base class for FileHandlerInterface
...
Python 3.6 doesn't appear to support IO[bytes] (and this is also from
the typing library), so we instead now inherit from RawIOBase. This
provides read, but does not come with a constructor (like FileIO) so
is suitable for our needs.
Fixes issue #376 .
2020-11-17 22:04:55 +00:00
Mike Auty
30de81795c
Windows: Update requirements to pslist 2.0.0
2020-11-16 09:41:42 +00:00
Mike Auty
745fce2281
Symbols: Fix pool error handling
...
Fixes #375
2020-11-15 23:56:07 +00:00
Mike Auty
4a8b4d1706
Plugins: Bump remaining plugins to framework require 2.0.0
2020-11-15 16:53:03 +00:00
Mike Auty
44c37d9761
Objects: Fix the comparison of enumerations
2020-11-12 17:32:56 +00:00
Mike Auty
60a70d06ca
PDB: Fix issue #374
2020-11-12 17:02:40 +00:00
Mike Auty
49aeaf2a49
Plugins: Resolve remaining LGTM recommendations
2020-11-09 00:03:07 +00:00
Mike Auty
0a655d76a8
Core: Fix LGTM recommendations
...
This is mostly unused imports and unused variables.
2020-11-04 22:41:39 +00:00
Mike Auty
7c75018fc4
Core: Fix Warnings from LGTM
2020-11-04 21:02:36 +00:00
Mike Auty
ae3a97e2c7
Core: Fix errors found by LGTM
2020-11-04 20:05:12 +00:00
Mike Auty
a9c742b3a2
Codebase: Fix == None (from lgtm audit)
2020-11-04 14:32:42 +00:00
Mike Auty
1d8081e409
Plugins: Fix exception thrown in handles
...
Fixes #368
2020-11-01 14:50:48 +00:00
Mike Auty
e9c753cfc7
Automagic: Optimize windows layer construction
2020-11-01 00:11:34 +00:00
Mike Auty
46f6ee2eae
Automagic: Ensure progress percentages complete
2020-10-31 23:32:17 +00:00
Mike Auty
47ff37b07b
Plugins: Make layerwiter more configurable
...
This adds support for dumping multiple layers at once, listing available
layers and selects the highest non-mapped layer. Mapping is specified
in the metadata and currently is only applied to intel layers.
2020-10-31 23:30:22 +00:00
Mike Auty
dbd00b9759
Plugins: Fix paths read by isfinfo
2020-10-31 21:26:26 +00:00
Mike Auty
7a36628e48
Extensions: Meaningful error for failed inet_ntop
2020-10-31 11:47:38 +00:00
iMHLv2