doomedraven and ikelos
e4d7b7975f
expose process_dump to other plugins
2020-01-14 10:52:05 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
Mike Auty
8a03cf53f0
Objects: Ensure templates objects aren't ReferenceTemplates.
2020-01-13 13:58:35 +00:00
Mike Auty
b4a9937da7
Objects: Void has no size, and BitFields don't inherit from Integer.
2020-01-13 02:16:35 +00:00
Mike Auty
0f49673aa0
Objects: Ensure string template objects return the right size.
2020-01-13 01:41:57 +00:00
Mike Auty
3977a3c356
objects: Fixes for the comments in #159
2020-01-10 12:47:06 +00:00
Mike Auty
d969d89da9
Objects: Ensure array sizes change with their count
2020-01-10 12:47:06 +00:00
Mike Auty
fba6511486
Objects: Add size to ObjectInfo so it can be statically access later
2020-01-10 12:47:06 +00:00
Michael Ligh and ikelos
e80e9e09b6
the hand-written 32-bit windows 10 service record types were missing the Tag member
2020-01-05 01:53:52 +00:00
iMHLv2 and GitHub
f7cc94a244
Merge pull request #168 from volatilityfoundation/issue-10-vad-protection-layer
...
Use a kernel layer to read vad protection constants
2020-01-04 10:02:59 -06:00
Michael Ligh
b7b6c44eab
remove unused variable in vaddump.py
2020-01-04 09:35:51 -06:00
iMHLv2 and GitHub
af468e7657
Merge pull request #162 from Lyx09/fix_vad_dump_var
...
VadDump: Fix incorrect variable out_of_range in vad_dump
2020-01-04 09:34:25 -06:00
Mike Auty
d2daa12564
Malfind: Rename the layer_name parameter to be more descripttive
2020-01-03 22:12:04 +00:00
Andrew Case and ikelos
d7f5a13c46
Mac - properly check for broken proc pointers
2020-01-03 19:42:18 +00:00
Andrew Case and ikelos
3bf3e0601a
Remove earliler trigger of SymbolError
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
a66e1bb6c2
Move symbol catching to generator
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
65556a2c92
Linux - update handling of kernels that do not have loadable module support
2020-01-03 17:50:06 +00:00
William LIN
e6656c96af
VadDump: Fix incorrect variable out_of_range in vad_dump
2019-12-26 19:51:13 +01:00
Mike Auty
348ac4e41b
Layers: Remove while true Take 2.
2019-12-11 20:04:30 +00:00
Mike Auty
a8a467a0c3
Revert "Layers: Remove (horrible, horrible) uses of while true in the codebase (my bad)"
...
This reverts commit a963938e11
2019-12-11 19:56:29 +00:00
Mike Auty
a963938e11
Layers: Remove (horrible, horrible) uses of while true in the codebase (my bad)
2019-12-11 19:42:10 +00:00
Michael Ligh
cd841616af
refs #144 use a kernel layer to read vad protection constants
2019-12-08 07:46:02 -06:00
Mike Auty
83a8afba6b
Objects: Simplify get_symbol_table to get_symbol_table_name.
2019-12-04 23:41:27 +00:00
Mike Auty
fa26dbf659
Yarascan: Make generic yarascan just scan kernel memory.
2019-12-04 23:17:10 +00:00
Mike Auty
f34958a16d
Poolscanner: Add necessary exception handling.
2019-12-04 22:11:42 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Michael Ligh and ikelos
d0f9cf9a2f
refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299
2019-12-04 21:19:19 +00:00
Mike Auty
1eea645da0
EPROCESS: Wrap get_peb functions in error handlers
2019-12-04 21:13:19 +00:00
Mike Auty
17247426d8
pdbconv: Avoid more name-collisions
...
Previously we allow name-collisions for types with name <anonymouos-tag>
so this has now been resolved, as well as descending too deeply down the
type to tree determine the size of array occassionally.
2019-12-04 20:04:22 +00:00
xabiugarte and ikelos
35abb343da
Raise exception instead of return None
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
3545ab7746
Fixes on pydoc, types, exception catching
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
c9520dc37f
Remove extra line
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
11d3d304ba
Refactor get_peb functionality in EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
a6944f7a06
Add InitOrder and MemOrder functions to EPROCESS
2019-12-04 20:02:31 +00:00
Mike Auty
af3b3e305f
Timeliner: Report progress on which plugin is being run.
2019-12-04 17:25:33 +00:00
xabiugarte and ikelos
949a2a2ddc
Change unsigned long long by pointer
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
8da9d90c19
Small fix on EPROCESS is_valid
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
1123ed074d
Tiny fix in EPROCESS.is_valid
2019-12-02 13:07:04 +00:00
Mike Auty
b6d807ff51
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
2019-11-27 11:30:14 +00:00
Mike Auty
1f4498be37
MultiRegExScanner: Results are always bytes and never strings
2019-11-27 11:30:14 +00:00
Mike Auty
af43e506fb
Elf64Layer: Fix typo in exception message.
2019-11-27 11:30:14 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
d29cd776ec
Layers: Fixing multiprocessing typing issue.
2019-11-27 11:30:14 +00:00
Mike Auty
0e016797bb
Typing: Change signatures to co-variant Mapping from Dict
2019-11-27 11:30:14 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
06c4a6dcc7
pdbconv: Swap the suffix ordering to make the less common option second.
2019-11-20 20:04:14 +00:00
Mike Auty
9928b40afb
pdbconv: ResourceAccessor now logs the written file
2019-11-20 20:04:14 +00:00
