 superponibleandikelos
|
eb9a426760
|
switch enum.Enum to enum.IntEnum
|
2018-08-30 10:57:18 +01:00 |
|
|
Dave Lassalleandikelos
|
c676f17fc8
|
refs #39 - update _CM_KEY_BODY.get_full_key_name()
|
2018-08-30 10:57:18 +01:00 |
|
|
Mike Auty
|
f4dd40ba0b
|
Ensure we're catching the appropriate expcetions rather than all of them.
|
2018-08-30 09:41:39 +01:00 |
|
|
superponible
|
19dcb80de6
|
catch os detection exception, change loop break to continue
|
2018-08-29 20:59:42 -05:00 |
|
|
Mike Auty
|
cc99d08c88
|
Move userassist keys over to a JSON data file.
|
2018-08-30 00:52:02 +01:00 |
|
|
Mike Auty
|
93607b2586
|
Fix up exception catching with no exception specified.
|
2018-08-30 00:36:32 +01:00 |
|
|
Mike Auty
|
fe9a1617c9
|
Include printkey in the hivelist conversion.
|
2018-08-29 23:31:39 +01:00 |
|
|
Mike Auty
|
0aa6ba0fe0
|
Convert hivelist to classmethod style.
|
2018-08-29 23:29:51 +01:00 |
|
|
Mike Auty
|
059be517fc
|
Fix up minor typing issues.
|
2018-08-29 23:29:00 +01:00 |
|
|
Mike Auty
|
303c63da68
|
Revert userassist to creating a new layer for each userassist data.
|
2018-08-29 23:14:28 +01:00 |
|
|
Mike Auty
|
62451ecef6
|
Reformat code and use has_member instead of RelativeChildOffset.
|
2018-08-29 23:01:02 +01:00 |
|
|
Mike Auty
|
3a6b4ad35c
|
Add in the has_member method for objects and templates.
|
2018-08-29 22:54:56 +01:00 |
|
|
superponible
|
40b83c505a
|
refactor userassist, stop creating registry tables for each entry
|
2018-08-29 16:10:53 -05:00 |
|
|
superponibleandikelos
|
4d0bdb7d72
|
removed additional object creation for determining OS version
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
140ed54331
|
use context.module for userassist
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
719f1d30e8
|
clean up exception handling
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
9723eb847e
|
handle win7 vs winxp assignments together
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
57166fa549
|
change method for detecting win7
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
93e05f4def
|
longer loop variable names
|
2018-08-29 21:51:52 +01:00 |
|
|
superponibleandikelos
|
dcb4ae08e3
|
change check for valid node path
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
c7e0ff9fa0
|
docstring and comment about get() vs _missing_()
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
0d12a6dbf3
|
alternative to RegValueTypes enum in lieu of _missing_()
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
4b500b66e9
|
fix variable name mismatch
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
d6a1e9acfc
|
add an optional filter to hivelist to return only matching names
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
32bcdf2ebc
|
add userassist types to registry.json
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
823cbddef5
|
fix an off by one error in printing hex
|
2018-08-29 21:51:52 +01:00 |
|
|
Dave Lassalleandikelos
|
ebd528610d
|
initial userassist plugin
|
2018-08-29 21:51:52 +01:00 |
|
|
Michael Lighandikelos
|
6862573734
|
only ask for the requirements that we need
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
617510f6d6
|
change how we iterate through the symbol_generator results
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
ea63c7e80e
|
define a find_address() method for consistent behavior for 32 and 64-bit systems
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
45ea3437f1
|
explicitly list the nt_symbols requirement
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
13e5145e46
|
use from ... import ... statements
|
2018-08-29 15:10:46 +01:00 |
|
|
Michael Lighandikelos
|
34bb059cfe
|
add the ssdt plugin for windows
|
2018-08-29 15:10:46 +01:00 |
|
|
Mike Auty
|
b84a7abd37
|
Ensure we only offer the configuration options we use.
|
2018-08-28 22:39:40 +01:00 |
|
|
Mike Auty
|
244af47a2a
|
Swap inheritted config options for explicit config options.
|
2018-08-28 22:32:52 +01:00 |
|
|
Mike Auty
|
ee38c9c4fe
|
Add in caching for the lengthy symbol sorting.
|
2018-08-23 17:29:16 +01:00 |
|
|
Mike Auty
|
b74eb68c04
|
Pull the check on layer names out so that DataLayerInterface types get it as well.
|
2018-08-22 09:33:47 +01:00 |
|
|
Mike Auty
|
ec3c6f34b8
|
Convert malfind to classmethod convention (and fix a broken protect_values call).
|
2018-08-17 11:03:49 +01:00 |
|
|
Mike Auty
|
981d333195
|
Fix ObjectInterface __getattr__ making objects that don't override return None rather than raising an AttributeError.
|
2018-08-17 10:52:48 +01:00 |
|
|
Mike Auty
|
218567c228
|
Allow Context.module to create a SizedModule if a size is provided.
|
2018-08-09 14:53:21 +01:00 |
|
|
Mike Auty
|
0a55a7c3f2
|
Introduced SizedModules to simplify when we just don't care about the size.
|
2018-08-09 14:42:18 +01:00 |
|
|
Mike Auty
|
0f08432aa5
|
Refactor Symbol interface to SymbolInterface.
|
2018-08-09 14:28:08 +01:00 |
|
|
Mike Auty
|
366269deb2
|
Refactor Module in interfaces to ModuleInterface.
|
2018-08-09 13:55:16 +01:00 |
|
|
Mike Auty
|
9e4875009d
|
Move the horrendously slow no-module-size calculation to an on-demand calculation.
|
2018-08-09 13:39:07 +01:00 |
|
|
Mike Auty
|
99f8859549
|
It turns out that cloning native_templates was unnecessary or slow. Fix and document why clearly.
|
2018-08-09 12:49:51 +01:00 |
|
|
Mike Auty
|
19bdc367bf
|
Add in a new exception for when expected data structures cannot be found.
|
2018-08-08 21:26:25 +01:00 |
|
|
Mike Auty
|
60f31852b9
|
Add in basic documentation covering an example plugin.
|
2018-08-08 00:41:08 +01:00 |
|
|
Mike Auty
|
d092a0614d
|
Add in volatility 3 basics documentation.
|
2018-08-06 14:21:33 +01:00 |
|
|
Mike Auty
|
e19ac82480
|
Improve generator documentation.
|
2018-08-05 16:26:27 +01:00 |
|
|
Mike Auty
|
d08c29ffab
|
Improve style to use default iterators rather than explicit ones.
|
2018-08-05 16:18:53 +01:00 |
|