Mike Auty
fdb386d714
Return more information when particular types cannot be looked up.
2017-04-29 15:03:20 +01:00
Mike Auty
029f6eca52
Fix up interface versioning issues.
...
Unfortunately one interface change was missed, getting the versions
slightly out of alignment. Due to the 2.1 schema already being
published, the best course of action was to move to version 4.0.
This means that there's a tiny chance some schemas exist somewhere in
the world with a non-existant 3.0.0 schema. Volatility will fail with
an error saying they're not supported. 5:S Sorry!
2017-04-29 15:02:43 +01:00
Mike Auty
9ed403a463
Ensure the native table has an appropriate (and non-conflicting) table name.
2017-04-26 23:55:29 +01:00
Mike Auty
1ba5ce7560
Ensure we return a NativeTable rather than just the lookup dict.
2017-04-26 23:50:26 +01:00
Mike Auty
f6214f9ce1
Don't try to add a void lookup, they're handled separately in the NativeTable.
2017-04-26 23:43:55 +01:00
Mike Auty
22dcea9451
Add in first draft of ISF version 3.0.0 support.
2017-04-26 21:38:42 +01:00
Mike Auty
4a55d927c1
Fix up population of type attributes in ISF files.
2017-04-25 23:05:48 +01:00
Mike Auty
7bf332617e
Remove non-determinism by favouring x64 (alphabetically lower). The bases detection requires improvement.
2017-04-23 02:43:08 +01:00
Mike Auty
0f9dbe3112
Fix up a small mistake in the interface version checking logic.
2017-03-29 20:29:19 +01:00
Mike Auty
1db4922033
Ensure we mimic python's errors as closely as possible.
2017-03-24 01:01:52 +00:00
Mike Auty
5d3677a0b9
Add an open method to IntermediateSymbolTable to load relative paths.
2017-03-24 00:47:26 +00:00
Mike Auty
b1c561b655
Ensure standard name for JSON files is used throughout the code (ISF).
2017-03-24 00:32:29 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
iMHLv2
7096f1853f
refer to self's symbol table when constructing objects inside an extension
2017-02-21 18:07:51 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
08eb2bce96
Add in schema 2.1.0 and supporting code changes.
2017-02-13 22:39:20 +00:00
Mike Auty
6603e503c5
Rework enumeration access in symbol tables.
2017-02-04 14:46:46 +00:00
Mike Auty
b4c36bcd15
Make the config_prefix parameter optional.
2017-01-04 22:29:47 +00:00
Mike Auty
3da5512fbd
Ensure we instantiate on the physical layer, not the existing kernel layer.
2017-01-02 22:21:39 +00:00
Mike Auty
24aecb49b7
Ensure we set the correct page_map_offset by masking it to the size of the physical register maximum.
2017-01-02 22:12:52 +00:00
Mike Auty
b745f41c6c
Move the interface fo rthe SymbolSpace over to the interfaces module.
2016-12-28 22:50:52 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
8e334ca086
Remove fallthrough/default natives from symbol_spaces.
2016-12-25 18:37:54 +00:00
Mike Auty
fb8143f7f4
Ensure Intermediate natives include their table name during resolution.
2016-12-25 18:35:13 +00:00
Mike Auty
1c3638d6c5
Allow native tables to accept and purpetuate table names.
2016-12-25 18:33:04 +00:00
Mike Auty
c5cd3595de
Fix up minor typo and hard depend on >= python 3.4.
2016-12-25 13:44:03 +00:00
Mike Auty
be075939d2
Remove flags as a fully-fledged object until it's been discussed
2016-12-18 19:38:05 +00:00
Mike Auty
a8b4db3ee3
Don't forget to also clone during intermediate format native creation.
2016-12-18 19:25:27 +00:00
Mike Auty
09ee0e6258
Fix fairly deep flaw where resolved templates could be modified by casting or creating an object.
2016-12-18 19:21:27 +00:00
Mike Auty
54678823f8
Refactor BitField subtype to base_type to match enums (and fix a minor enum typo too).
2016-12-18 16:12:08 +00:00
Mike Auty
6f1a929f88
Refactor the location of windows extension classes.
2016-12-18 15:38:46 +00:00
Mike Auty
65ef2927a3
Refactor the enumeration_choices code into the existing weak_resolve code.
2016-12-18 02:53:07 +00:00
Mike Auty
b2701d7ba6
Update inaccurate error message.
2016-12-18 02:48:46 +00:00
Mike Auty
cf4ac3a7f6
Allow enumeration dictionaries to be accessed through the SymbolSpace directly.
2016-12-18 02:48:23 +00:00
Mike Auty
4ac682fc42
Rename Enumeration subtype to base_type, since it should always be a primitive.
2016-12-18 02:07:11 +00:00
Mike Auty
5f6c9ca08a
Add in support for version 2.0.0 of the JSON schema.
2016-12-17 21:03:54 +00:00
Mike Auty
8a687ef409
Ensure we include the natives in the Intermed type lists.
2016-12-16 00:26:22 +00:00
Mike Auty
ac6a5a2b9a
Ensure that we use a reasonable type for enumerations when constructing them without further details.
2016-12-15 23:04:23 +00:00
Mike Auty
a32c7e27a9
Add in cryptic comments nearly lost during the vtypes purge.
2016-12-13 19:40:18 +00:00
Mike Auty
058346b74d
Ensure IntermediateSymbols can handle cross-table references.
2016-12-13 19:32:22 +00:00
Mike Auty
ed716ca12a
Convert SymbolTableInterfaces to descend from ConfigurableInterface
...
This allows SymbolTables to hold actual requirements (which
IntermedSymbolTable already did, but without pulling in the right
interface). It means that values like kernel_virtual_offset get saved.
We still need to figure out how to allow plugins to demand optional
configuration values in other places (such as the kvo) but for now the
plugin will barf if it doesn't get it.
2016-12-12 02:08:32 +00:00
Mike Auty
e2d5f51ad5
Remove old and rotten code.
2016-12-12 00:25:03 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty
c52bf7cb6f
Pull out the appropriate natives based on the intermediate format data.
2016-12-04 23:50:13 +00:00
Mike Auty
770a8ee42a
Improve error handling to prevent endless recursion in template.__call__
2016-12-04 11:17:48 +00:00
Mike Auty
e1cc55aeed
Add in wchar to our set of bases for x64 systems.
2016-12-04 01:02:17 +00:00
Mike Auty
e27a444068
Very minimally fix up the docstring for a function.
2016-12-04 01:01:46 +00:00
Mike Auty
ed552d20e8
Add in support for lzma compressed json data.
2016-12-02 01:34:07 +00:00
Mike Auty
282eaa7f00
Improve/remove unnecessary imports.
2016-11-07 12:26:06 +00:00
Mike Auty