Mike Auty
de8508a8bb
Reset the maxvirtaddr to use maxphyaddr just so we don't forget.
2017-05-01 14:35:22 +01:00
Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty
d0580236b1
Add in the schema version 3.0.0.
2017-04-26 20:51:03 +01:00
Mike Auty
f520176b2b
Move the wrapper out to stop it seeming like a method.
2017-04-26 15:01:49 +01:00
Mike Auty
0c689de244
Fix up numerous silly mistakes.
2017-04-26 14:57:40 +01:00
Mike Auty
1d39c68799
All templates are equal (not just ObjectTemplates).
2017-04-26 14:51:56 +01:00
Mike Auty
6c4bd65b8a
Change my mind on accepting a full symbol rather than just the type.
2017-04-26 10:04:40 +01:00
Mike Auty
f97a5b4700
All the object constructor to accept a Symbol as well as a name.
2017-04-26 09:59:47 +01:00
Mike Auty
4a55d927c1
Fix up population of type attributes in ISF files.
2017-04-25 23:05:48 +01:00
Mike Auty
2523394118
Remove the deprecated utility adapters in favour of the initial Module implementation.
2017-04-23 17:19:22 +01:00
Mike Auty
7bf332617e
Remove non-determinism by favouring x64 (alphabetically lower). The bases detection requires improvement.
2017-04-23 02:43:08 +01:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
ff41d4e5b0
Improve config.json handling, making single_location optional but bypasses the stacker automagic.
2017-04-21 00:53:08 +01:00
Mike Auty
b6b984503f
Fix up help messages for plugins.
2017-04-21 00:52:06 +01:00
Mike Auty
d37732e9b6
Add in array_to_string helper function.
2017-04-21 00:01:12 +01:00
Mike Auty
67015f3316
Fix up default logging levels.
2017-04-20 23:48:56 +01:00
Mike Auty
687da20cbc
Fix up a typo @npetroni pointed out.
2017-04-20 23:11:42 +01:00
ikelos and GitHub
11b0b36d90
Merge pull request #5 from npetroni/binary-format-hint
...
added Bin() to format_hints: print the value as a Python binary number
2017-04-20 14:15:19 +01:00
Nick L. Petroni, Jr
f05df0c1cd
added Bin() to format_hints: print the value as a Python binary number
2017-04-17 14:05:50 -04:00
Mike Auty
0f9dbe3112
Fix up a small mistake in the interface version checking logic.
2017-03-29 20:29:19 +01:00
Mike Auty
dcc558717c
Shift around the object_factory and add the symbol rebaser.
...
The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
2017-03-24 01:50:16 +00:00
Mike Auty
1db4922033
Ensure we mimic python's errors as closely as possible.
2017-03-24 01:01:52 +00:00
Mike Auty
5d3677a0b9
Add an open method to IntermediateSymbolTable to load relative paths.
2017-03-24 00:47:26 +00:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
ikelos and GitHub
5c9a77128d
Merge pull request #4 from volatilityfoundation/dlllist
...
Add windows dlllist plugin and accompanying extensions
2017-02-21 22:35:40 +00:00
iMHLv2
7096f1853f
refer to self's symbol table when constructing objects inside an extension
2017-02-21 18:07:51 +00:00
iMHLv2
efd2468639
import modules rather than classes
2017-02-21 18:06:52 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
08eb2bce96
Add in schema 2.1.0 and supporting code changes.
2017-02-13 22:39:20 +00:00
Mike Auty
c0dfe48c05
Remove configurability of architecture, the translation layer should define the architecture internally.
2017-02-13 22:36:40 +00:00
Mike Auty
0d1dd2d2cd
Fix silly typo.
2017-02-13 21:30:23 +00:00
Mike Auty
d6728fc2b4
Add in attributes and appropriate validation of TranslationLayers based on those attributes.
2017-02-10 13:57:44 +00:00
Mike Auty
6603e503c5
Rework enumeration access in symbol tables.
2017-02-04 14:46:46 +00:00
Mike Auty
cd2eaeab06
Rename the imported context interface to match other examples in the code.
2017-01-23 01:12:44 +00:00
Mike Auty
371aca2808
Fix up development code with previous changes to the ContextInterface.
2017-01-23 01:05:05 +00:00
Mike Auty
c3ab678c5b
Make the vol.py CLI stub executable.
2017-01-22 23:53:58 +00:00
Mike Auty
96c414fb5f
Refactor TextRenderer to QuickTextRenderer to ensure we don't forget that the output is speedy not nicely formatted.
2017-01-22 14:17:19 +00:00
Mike Auty
a2eb60ed39
Add support for HexBytes to the text renderer.
2017-01-22 14:16:13 +00:00
Mike Auty
9f4ea6da1f
Split the useful code out into a subfunction for reuse.
2017-01-19 16:20:11 +00:00
Mike Auty
49009ec458
Parameterize the plugin calling, with run as the default.
2017-01-19 16:19:10 +00:00
Mike Auty
5d3ff13a6e
Ensure LayerStacker's default doesn't get accepted blindly.
2017-01-08 18:08:13 +00:00
Mike Auty
3a648d75b0
Don't double wrap unsatisifed requirements, each should return its full config path of the requirement checked.
2017-01-08 17:59:04 +00:00
Mike Auty