Mike Auty
df804928b5
Layers: Alter the decode method to take data directly
2020-03-04 20:29:42 +00:00
Mike Auty
87dc98655b
Layers: Fix up an intel inaccuracy in mapping sizes
2020-03-04 20:29:42 +00:00
Mike Auty
e089314898
Layers: Add pad option to the decode/encode steps
2020-03-04 20:29:42 +00:00
Mike Auty
ca9d7075d3
Layers: Refactor the decode/encode methods
2020-03-04 20:29:42 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
7c260ce4bd
Crashdump: Ensure the number of runs is reflected in the array length
2020-02-29 18:47:34 +00:00
Tamas K Lengyel and ikelos
6a6cf37b02
pdbconv: save _imp functions in JSON
2020-02-14 09:20:15 +00:00
Andrew Case and ikelos
a60bef3283
Mac - update queue walking code
2020-02-12 21:04:23 +00:00
Andrew Case and ikelos
5a99d35a9e
update timer code
2020-02-12 19:56:37 +00:00
Michael Ligh and ikelos
4c7f2a3762
catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes)
2020-02-12 19:19:27 +00:00
Andrew Case and ikelos
ab42f0941c
Add sysctl docstrings and return types
2020-02-12 19:17:19 +00:00
Andrew Case and ikelos
29cc435b5e
update sysctl v2
2020-02-12 19:17:19 +00:00
Mike Auty
7873a65999
Procdump: Don't loop through twice without good reason.
2020-02-12 19:07:24 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
c4829ccca3
Caching: Add clear-cache option (except hashcaches)
2020-01-30 01:57:48 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
6e38727ffe
Mac: Refactor/optimize repeated code.
2020-01-28 01:37:21 +00:00
Mike Auty
f111e9e051
Mac: Ensure queues error check all entries, not just the first.
2020-01-28 01:37:21 +00:00
comet and ikelos
beed68b8bf
update
2020-01-27 23:31:05 +00:00
Mike Auty
f00453e366
Procdump: Remove redundant line as caught by @iMHLv2
2020-01-22 19:49:11 +00:00
Michael Ligh and ikelos
1d7da6402b
svcscan cleanup: win10 before 15063 uses win8 types
2020-01-22 19:23:30 +00:00
Mike Auty
b664e38c66
Resources: Add a comment about removing the old python code.
2020-01-22 19:22:02 +00:00
Michael Ligh and ikelos
d6c8ac87d7
try unverified retrieval if ssl.SSLCertVerificationError or ssl.SSLError with CERTIFICATE_VERIFY_FAILED
2020-01-22 19:19:48 +00:00
Mike Auty
ddfd5ec2d2
Framework: Refactor where the python version check happens.
...
Fixes issue #181 .
2020-01-22 19:05:06 +00:00
Mike Auty
9fe6e6ba37
registry: Add the hivedump plugin
2020-01-17 17:22:04 +00:00
Mike Auty
fe999aa9e2
registry: Fix up previous naive mapping method
2020-01-17 17:14:16 +00:00
Mike Auty
81653dba6d
Registry: Ignore errors if ignore_errors is set.
2020-01-17 01:14:09 +00:00
Mike Auty
8f71c61440
layerwriter: Fix mistaken hardcoded layer name.
2020-01-16 23:07:27 +00:00
Mike Auty
99af98f639
layerwiter: Refactor to classmethod.
2020-01-16 22:57:47 +00:00
Mike Auty
572313cc34
Objects: Make sure bytes provide a template size.
2020-01-16 11:06:16 +00:00
Mike Auty
a3def09a13
Registry: Optimize calls to DataLength and improve documentation.
2020-01-15 22:59:58 +00:00
Mike Auty
cedca0bb84
Objects: Document void size a little more.
2020-01-15 21:55:30 +00:00
Mike Auty
2d408491bd
Printkey: Slightly improve subkey name determination.
2020-01-15 02:19:12 +00:00
Mike Auty
3f5b96f3c7
Yapf: Clean-up the whole codebase.
2020-01-14 15:44:07 +00:00
Mike Auty
b7ba877727
procdump: Enure proc_id is defined.
2020-01-14 15:36:54 +00:00
doomedraven and ikelos
07b94abc1e
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
cdc0835863
Update procdump.py
2020-01-14 10:52:05 +00:00
doomedraven and ikelos
e4d7b7975f
expose process_dump to other plugins
2020-01-14 10:52:05 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
Mike Auty
8a03cf53f0
Objects: Ensure templates objects aren't ReferenceTemplates.
2020-01-13 13:58:35 +00:00
Mike Auty
b4a9937da7
Objects: Void has no size, and BitFields don't inherit from Integer.
2020-01-13 02:16:35 +00:00
Mike Auty
0f49673aa0
Objects: Ensure string template objects return the right size.
2020-01-13 01:41:57 +00:00
Mike Auty
3977a3c356
objects: Fixes for the comments in #159
2020-01-10 12:47:06 +00:00
Mike Auty
d969d89da9
Objects: Ensure array sizes change with their count
2020-01-10 12:47:06 +00:00
Mike Auty
fba6511486
Objects: Add size to ObjectInfo so it can be statically access later
2020-01-10 12:47:06 +00:00
Michael Ligh and ikelos
e80e9e09b6
the hand-written 32-bit windows 10 service record types were missing the Tag member
2020-01-05 01:53:52 +00:00
iMHLv2 and GitHub
f7cc94a244
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
...
Use a kernel layer to read vad protection constants
2020-01-04 10:02:59 -06:00
Michael Ligh
b7b6c44eab
remove unused variable in vaddump.py
2020-01-04 09:35:51 -06:00
iMHLv2 and GitHub
af468e7657
Merge pull request #162 from Lyx09/fix_vad_dump_var
...
VadDump: Fix incorrect variable out_of_range in vad_dump
2020-01-04 09:34:25 -06:00
Mike Auty