Mike Auty
ddeacd3524
Fix up my mistaken advice.
2018-06-16 09:56:10 +01:00
Dave Lassalle and ikelos
a0edd1e38e
root_cell_offset changes seem to have fixed maxaddr problems
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
09475d5992
set default value for key since we combined exception handling
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
c68d02d565
combine exception handling to reduce code duplication
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
f2029d5657
add comment about registry key case sensitivity and re-work root_cell_offset
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
b85c143af9
yield UnreadableValues when key not found, and set default RootCell on exception
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
201fc5780a
don't use BaseBlock.Length for maxaddr
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
0c3866ef77
make registry path comparison case insensitive
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
5467c1c5e3
prevent from halting on an unknown registry value type
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
218b1fd37c
use masked length to extract data
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
481ea01149
catch the KeyError so we can iterate over all hives for a key path
2018-06-16 09:54:45 +01:00
Dave Lassalle and ikelos
6cfd3b6499
fix typo in debug statement
2018-06-16 09:54:45 +01:00
Mike Auty
33e146533e
Fix minor typo in malfind.
2018-06-15 23:04:01 +01:00
Michael Ligh and ikelos
7338cdbf8a
BaseDllName should be an UnreadableValue() if it cannot be accessed
2018-06-13 15:10:58 +01:00
Michael Ligh and ikelos
3eeb48cc0e
add the moddump plugin for windows
2018-06-13 15:10:58 +01:00
Michael Ligh
95214216ea
BaseDllName and FullDllName should be UnreadableValue() if they cannot be accessed
2018-06-13 09:10:47 -05:00
Mike Auty
5f130a3b2a
Update timeliner and convert pslist to support it.
2018-06-12 09:01:01 +01:00
Mike Auty
eed92de9ef
Bulk of the modifications for the timeliner interface.
2018-06-12 09:01:01 +01:00
Michael Ligh and Mike Auty
76f5d35499
update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
7ae0d654c2
pass native_types to KdbgIntermedSymbols.create() instead of table_mapping
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
ae9d7dbc86
use *args and **kwargs when inheriting from IntermediateSymbolTable
2018-06-12 08:41:37 +01:00
Michael Ligh and Mike Auty
7797a6a385
add a class string to windows.info so that the plugin has a description
2018-06-12 08:40:21 +01:00
Michael Ligh and Mike Auty
fb57e2c5f2
wininfo, procdump, dlldump, and json for pe & kdbg
2018-06-12 08:40:21 +01:00
Mike Auty
2cbd444603
Add in symbol table address masker.
2018-06-06 23:12:46 +01:00
Mike Auty
b228ad8e95
Add comment concerning reconstructability of SymbolTables.
2018-06-06 23:10:21 +01:00
Mike Auty
253304270b
Ensure we can add native_types when we create tables.
2018-06-06 00:42:23 +01:00
Mike Auty
36dee38a9e
Leave pointer out of the default types (since it needs an appropriate size).
2018-06-05 21:46:02 +01:00
Mike Auty
113c23a66d
Last of the typing fix-ups.
2018-06-04 23:55:38 +01:00
Mike Auty
2dc3d2928d
Fix more typing issues.
2018-06-04 23:28:26 +01:00
Dave Lassalle and ikelos
abfcdba524
add Windows 10 Registry process support
2018-06-04 20:17:28 +01:00
Mike Auty
816db6b626
Fix up some missing logging names that slipped through the review net.
2018-06-04 10:10:44 +01:00
Mike Auty
9711793503
Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions.
2018-06-04 09:40:26 +01:00
Mike Auty
f957b2915e
Fix up issue having made optional parameters non-optional.
2018-06-04 09:39:38 +01:00
Mike Auty
7a52ac9deb
Fix a large number of typing issues.
...
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
2018-06-04 01:25:02 +01:00
Mike Auty
d3782c0519
Fix typo as identified by @imhlv2.
2018-06-03 23:51:46 +01:00
Mike Auty
9740c4af84
Add in configwriter plugin, fixes issue #26 .
2018-05-31 11:50:40 +01:00
Mike Auty
213c70527f
Change the plugins option to plugin_dirs to avoid conflict with timeliner.
2018-05-31 11:48:12 +01:00
Mike Auty
b647c3a089
Refactor volshell with inheritance and add dt.
...
It makes enourmous sense to inherit the windows volshell plugin from the
volshell one. I also added the generic dt function.
2018-05-30 22:36:42 +01:00
Michael Ligh
17924a0667
refs #27 use _KLDR_DATA_TABLE_ENTRY on windows if its available
2018-05-30 13:55:20 -05:00
Mike Auty
6a6acd2dcc
Move the table_mapping parameter to avoid disrupting the previous interface.
2018-05-30 18:37:29 +01:00
Mike Auty
f72e39d558
Fix up small but significant typo.
...
When asking for data with padding, the padding was guaranteed to always
be at the end without spaces between pages.
2018-05-29 00:42:52 +01:00
Mike Auty
67239002bc
Attempt to fix an intel read issue spotted by imhlv2
...
The length value inside the read method of the TranslationLayer base class
would potentially get overwritten by the inner loop which also defined a
length value.
2018-05-28 23:25:49 +01:00
Mike Auty
33b2c9522d
Add in support for ISF.create to handle table_mappings.
2018-05-23 22:26:52 +01:00
Mike Auty
a5df5372f5
Add in table_mapping through the ISF classes.
2018-05-23 22:23:32 +01:00
Mike Auty
1aa980169c
Fix up the -f help message and tidy the code.
2018-05-23 22:12:47 +01:00
Mike Auty
d6b7415bab
Revert "Remove the -f flag before it gains too much use."
...
As @npetroni quite rightly pointed out, the purpose of the CLI is to
make it easy for people to use on the commandline, so at the expense of
some dynamic ability, -f is returning for convenience purposes.
This reverts commit 4450766d50
2018-05-23 22:08:52 +01:00
Mike Auty
87d0f97f52
Remove the unnecessary exception and add in a better one.
2018-05-23 19:41:40 +01:00
Mike Auty
8bc5a4e898
Ensure maxaddr is never includes the volatile bit.
2018-05-23 19:41:13 +01:00
Mike Auty
347b4854ff
Comment out the HBIN size check for now
...
Leave a comment to ensure we get back to checking out why the hbin size
check fails to only prevent bad accesses (and effectively gives false
positives).
2018-05-21 22:57:10 +01:00
Mike Auty
665db0017e
Don't count the volatile bit when checking things are outside the hive maximum address.
2018-05-21 18:02:48 +01:00
Mike Auty