Mike Auty
44d8af70e0
Ensure we don't run the DTB finder twice.
2017-05-01 14:34:52 +01:00
Mike Auty
e182e44815
Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables.
2017-04-30 22:09:26 +01:00
Mike Auty
ff41d4e5b0
Improve config.json handling, making single_location optional but bypasses the stacker automagic.
2017-04-21 00:53:08 +01:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
5d3ff13a6e
Ensure LayerStacker's default doesn't get accepted blindly.
2017-01-08 18:08:13 +00:00
Mike Auty
149e57afee
Change the requirement validation system to return all unsatisfied requirements, to provide more feedback.
2017-01-08 17:26:09 +00:00
Mike Auty
cafc09a6d3
Add dynmically generated command line parameters for the CLI.
...
Note this now requires the file to be specified with single-location,
it also requires a specific ordering of parameters.
2017-01-08 02:31:31 +00:00
Mike Auty
282af4db99
Make automagic config_path a requirement rather than optional.
2017-01-08 02:23:14 +00:00
Mike Auty
1af85d628f
Remove the pointless class/instance variable.
2017-01-01 02:14:53 +00:00
Mike Auty
f0ce27f0a7
Improve the documentation for automagic.
2016-12-30 01:10:05 +00:00
Mike Auty
5fe078e487
Adapt Automagic to have requirements, and convert the Stacker's single_location parameter to make use of it.
2016-12-29 15:21:39 +00:00
Mike Auty
88e9786967
Improve the requirements documentation.
2016-12-28 22:33:17 +00:00
Mike Auty
aee4349e3c
More documentation updates (and minor code cleanups).
2016-12-28 03:20:44 +00:00
Mike Auty
9399480f1a
Add a chunk of documentation alphabetically.
2016-12-26 23:50:51 +00:00
Mike Auty
9666e34603
Remove the filenames from the intermediate format prefix search, to improve the documentation.
2016-12-26 23:50:16 +00:00
Mike Auty
bab71d4358
Refactor the progress_callback so it can be used in automagics.
...
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.
The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty
4cd9b98211
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-12-26 22:53:29 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
ba7275f973
Allow relative file paths in the pdb scanner prefix variable, for the documentation.
2016-12-26 18:47:06 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
d51dd2a992
Add in TODOs for future heuristic enhancements.
2016-12-24 19:45:02 +00:00
Mike Auty
6a0b0d71c0
Remove debugging code that shouldn't have made it in the final code.
2016-12-24 19:41:58 +00:00
Mike Auty
23e61d9756
Add in a little more information to the debug log.
2016-12-22 16:00:46 +00:00
Mike Auty
bbabf4db0e
Add in a heuristic for finding the correct DTB on recent Win10.
...
This removes again the single_page_map_offset configuration value,
and requires that a full/correct config be used to supply a manual DTB
value.
The expectation is that the single_page_map_offset feature be
re-introduced but override *all* scanning (so the scanning doesn't take
place even if the stacking does).
2016-12-22 15:44:07 +00:00
Mike Auty
d669b57546
Rewrite our fallback virtual kernel offset algorithm.
2016-12-21 16:54:35 +00:00
Mike Auty
9ca001df8b
Allow start/end positions on the pdb scanning.
2016-12-21 02:28:03 +00:00
Mike Auty
698d1c2b4a
Improve the granularity of logging.
2016-12-15 01:38:24 +00:00
Mike Auty
30fe381d00
Don't do work we don't have to.
2016-12-14 09:26:15 +00:00
Mike Auty
6b4e80f1e5
Take a tiny bit longer, but properly check all the kernels in case a match is hiding later in the list.
2016-12-14 01:54:50 +00:00
Mike Auty
90b024562f
Rule out kernels that couldn't find a suitable MZ header.
2016-12-14 01:42:40 +00:00
Mike Auty
0f416b4765
Improve logging from the stacker.
2016-12-14 01:30:30 +00:00
Mike Auty
eae84fd8e0
Ensure we only stack when needed
...
We shouldn't be stacking unless we're required, so now
we run after the construction phase, and run our own construction
phase is we've changed anything.
2016-12-12 02:06:54 +00:00
Mike Auty
046d1955b5
Ensure that only unfulfilled symbol requirements trigger the pdb scanner.
2016-12-12 02:04:20 +00:00
Mike Auty
b9dbc80baf
Improve logging of automagic actitivies.
2016-12-11 18:16:02 +00:00
Mike Auty
5d15f810e1
Tidy up the config namespace around automagic a little.
2016-12-11 13:58:17 +00:00
Mike Auty
9bb0745b83
Clean up the debug messages for pdbscanning.
2016-12-08 16:29:36 +00:00
Mike Auty
2aebb99ee6
Slightly improve the output and get rid of pointless parameters.
2016-12-08 16:24:59 +00:00
Mike Auty
8a0609e800
Add in a secondary scan to determine the kernel base in randomized kernel base systems.
2016-12-08 16:24:03 +00:00
Mike Auty
482516d93d
Rework the kvo finding code to allow for Win10 kernel base randomization.
2016-12-08 14:56:32 +00:00
Mike Auty
631ae07a26
Insert a check to use valid kernels where a pdb signature is found in multiple locations.
2016-12-08 11:55:46 +00:00
Mike Auty
183ff67699
Attach the kernel virtual offset to intel spaces.
2016-12-07 16:00:31 +00:00
Mike Auty
6cb5d06d6d
Ensure all offsets are normalized to fall within their layer's address range.
2016-12-07 00:07:57 +00:00
Mike Auty
734b9a68b8
Ensure we use math.log correctly.
...
This is unlikely to ever happen (since we use python3)
but still just as well to implement in case something else
similar comes up.
https://www.willmcgugan.com/blog/tech/post/finding-the-first-bit-set-with-python/
2016-12-06 23:40:21 +00:00
Mike Auty
40694ff26c
Add a note about precedence to the pdb loader.
2016-12-06 09:08:51 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty
05ae4aa64a
Fix up offset for PAE.
2016-12-04 10:24:33 +00:00
Mike Auty
d8b72cfc14
Add in checks and set the appropriate kernel location for all architectures.
2016-12-04 02:17:11 +00:00
Mike Auty
4121895d4d
Ensure the kernel virtual to physical offset mapping is correct.
2016-12-04 01:21:10 +00:00
Mike Auty
23fd704027
Add in the kernel offset recursion code.
2016-12-04 01:00:37 +00:00
Mike Auty
9a3402ccff
Fix the incorrect signature offset returned.
2016-12-03 21:39:04 +00:00
Mike Auty