Mike Auty
e596c6a1b7
Further documentation updates.
2017-01-03 23:06:39 +00:00
Mike Auty
3da5512fbd
Ensure we instantiate on the physical layer, not the existing kernel layer.
2017-01-02 22:21:39 +00:00
Mike Auty
1437e24b53
Add a note about _maxphyaddr.
2017-01-02 22:17:35 +00:00
Mike Auty
24aecb49b7
Ensure we set the correct page_map_offset by masking it to the size of the physical register maximum.
2017-01-02 22:12:52 +00:00
Mike Auty
1af85d628f
Remove the pointless class/instance variable.
2017-01-01 02:14:53 +00:00
Mike Auty
a7ea6e2210
Improve the object/template documentation.
2017-01-01 01:43:08 +00:00
Mike Auty
f0bc4ea59b
Improve the symbol interface documentation, but it needs more work.
2016-12-30 02:46:40 +00:00
Mike Auty
ba05632efd
Improve plugin and renderer interface documentation.
2016-12-30 02:44:01 +00:00
Mike Auty
8f6f5f6403
Update object interface documentation.
2016-12-30 02:36:06 +00:00
Mike Auty
d75c1fc808
Update layer interface documentation.
2016-12-30 02:29:22 +00:00
Mike Auty
8b5ed7ea88
Improve the context documentation.
2016-12-30 02:19:44 +00:00
Mike Auty
0f811fbe34
Refactor the code to make it easier to find classes, and update documentation.
2016-12-30 02:13:23 +00:00
Mike Auty
f0ce27f0a7
Improve the documentation for automagic.
2016-12-30 01:10:05 +00:00
Mike Auty
5fe078e487
Adapt Automagic to have requirements, and convert the Stacker's single_location parameter to make use of it.
2016-12-29 15:21:39 +00:00
Mike Auty
7f0fb89da5
We don't need to check the element's type twice.
2016-12-29 15:20:44 +00:00
Mike Auty
3aec66333e
Allow the vmware stacker to ask the FileLayer it's on top of what filename it had.
2016-12-29 15:10:21 +00:00
Mike Auty
de9034f378
Ensure that configuration.branch allows for the return of an empty dict.
2016-12-29 15:06:28 +00:00
Mike Auty
1abebe67db
Further documentation improvements.
2016-12-29 03:14:40 +00:00
Mike Auty
c6c5283974
Add a little text (and remove the timestamp) from the exceptions and an unnecessary exception.
2016-12-29 01:28:25 +00:00
Mike Auty
16a8fcc6c7
Add in some context documentation.
2016-12-29 00:52:59 +00:00
Mike Auty
b745f41c6c
Move the interface fo rthe SymbolSpace over to the interfaces module.
2016-12-28 22:50:52 +00:00
Mike Auty
88e9786967
Improve the requirements documentation.
2016-12-28 22:33:17 +00:00
Mike Auty
aee4349e3c
More documentation updates (and minor code cleanups).
2016-12-28 03:20:44 +00:00
Mike Auty
390ccd330d
Remove property from _unresolved, since we manually make it a property when necessary.
2016-12-27 22:32:25 +00:00
Mike Auty
e56e61eac5
Remove the need for ctypes by using a single-letter code instead.
2016-12-27 22:32:06 +00:00
Mike Auty
9399480f1a
Add a chunk of documentation alphabetically.
2016-12-26 23:50:51 +00:00
Mike Auty
9666e34603
Remove the filenames from the intermediate format prefix search, to improve the documentation.
2016-12-26 23:50:16 +00:00
Mike Auty
bab71d4358
Refactor the progress_callback so it can be used in automagics.
...
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.
The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty
2680bba785
Fix up lack of logging object in layers interface.
2016-12-26 23:24:14 +00:00
Mike Auty
4cd9b98211
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-12-26 22:53:29 +00:00
Mike Auty
b54cb86c89
Allow automagics to use natives without a set of global natives.
...
This allows NativeSymbolTables to be appended to symbol_spaces and
uses this to let automagic modules (which have no existing symbol table
to rely on) to load natives for reading format data.
2016-12-26 22:49:51 +00:00
Mike Auty
943c625d5a
Ensure VMware fails back to flat with zero region metadata files.
2016-12-26 22:48:29 +00:00
Mike Auty
ba7275f973
Allow relative file paths in the pdb scanner prefix variable, for the documentation.
2016-12-26 18:47:06 +00:00
Mike Auty
d2c5cde545
Add in an EPROCESS class override with an add_process_layer method.
2016-12-25 22:38:45 +00:00
Mike Auty
3578768e2d
Correct odd/unnecessary typo.
2016-12-25 22:38:02 +00:00
Mike Auty
011b6dc3f4
Add in the object_factory capability and use it by example in pslist.
2016-12-25 19:02:48 +00:00
Mike Auty
8e334ca086
Remove fallthrough/default natives from symbol_spaces.
2016-12-25 18:37:54 +00:00
Mike Auty
fb8143f7f4
Ensure Intermediate natives include their table name during resolution.
2016-12-25 18:35:13 +00:00
Mike Auty
433f47c458
Allow casting to inherit the symbol table of its parent.
2016-12-25 18:34:14 +00:00
Mike Auty
1c3638d6c5
Allow native tables to accept and purpetuate table names.
2016-12-25 18:33:04 +00:00
Mike Auty
627bdd74a5
Allow developers to see when an exception has occurred with their scanner.
2016-12-25 17:43:10 +00:00
Mike Auty
34b3f75b99
Fix up the physical layer scanner appropriately.
2016-12-25 17:39:56 +00:00
Mike Auty
f03f99e64c
Ensure the non-multithreaded scanner works the same way as the multithreaded one.
2016-12-25 17:26:06 +00:00
Mike Auty
a4f27e73f4
Refactor the scanners to allow multithreaded searching.
2016-12-25 17:01:05 +00:00
Mike Auty
1c85db0c31
Add in multi-processing on TranslationLayer scan method.
2016-12-25 13:45:08 +00:00
Mike Auty
c5cd3595de
Fix up minor typo and hard depend on >= python 3.4.
2016-12-25 13:44:03 +00:00
Mike Auty
60bf657895
Allow pickling of FileLayers by unsetting the file (it'll be reopened as soon as a read happens).
2016-12-25 00:02:42 +00:00
Mike Auty
e230bbf6a8
Ensure we don't ever get in a loop looking up ._vol (could happen when pickling/unpickling).
2016-12-25 00:02:11 +00:00
Mike Auty
d51dd2a992
Add in TODOs for future heuristic enhancements.
2016-12-24 19:45:02 +00:00
Mike Auty
6a0b0d71c0
Remove debugging code that shouldn't have made it in the final code.
2016-12-24 19:41:58 +00:00
Mike Auty