Mike Auty
2c02df125a
Fix the truncation of strings
...
MHL kindly pointed out that the string wasn't truncating, and it turns
out I misread the struct documentation, which truncates or pads with
\x00s to ensure the appropriate length. We now truncate to the first
null we find.
2016-12-13 20:41:09 +00:00
Mike Auty
1f6fcd7bad
Ensure that the value of pointers always fall within their layer.
2016-12-07 09:52:33 +00:00
Mike Auty
797e51608e
Move the masking code into the data layer.
2016-12-07 09:50:59 +00:00
Mike Auty
6cb5d06d6d
Ensure all offsets are normalized to fall within their layer's address range.
2016-12-07 00:07:57 +00:00
Mike Auty
1c7de06bd0
Fix up issue with pointer sizes. Since cls is never used we're not losing information.
2016-12-06 02:44:11 +00:00
Mike Auty
e4e563ead0
Fix up the array slicing code.
2016-12-03 00:23:00 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
6b405383c4
Refactor targets to subtypes.
2016-10-26 01:24:58 +01:00
Mike Auty
e02feed16e
Python 3 has a sane super() implementation (no arguments), so convert to using that.
2016-08-14 00:55:02 +01:00
Mike Auty
34b81a5265
Add in Unions
...
Since a Union is identical to a Struct (and at the moment a struct
doesn't enforce non-overlapping members), these are identical and a
Union is a descendent of Struct. If this ever becomes a problem there
is a filthy way to fix it, but it's really bad and will likely cause
more subtle and difficult to diagnose problems. Stick with inheritance.
2016-05-22 12:03:46 +01:00
Mike Auty
2d23c93def
Completely refactor constants and structures to symbols and types.
2016-05-22 11:51:06 +01:00
Mike Auty
d7aefdce28
Add a comment explaining why we don't truncate strings on \x00.
2016-02-14 02:50:37 +00:00
Mike Auty
0ef389dec9
Tidy up Bytes and String to require all the appropriate parameters.
2016-02-14 02:49:28 +00:00
Mike Auty
86526fa9ad
Separate out the object_info to make debugging easier in future.
2016-02-14 01:43:28 +00:00
Mike Auty
9c1dbf88e2
Change Bytes to not require a struct_format, since we generate it from the length parameter.
2016-02-14 01:43:09 +00:00
Mike Auty
bcbfee9016
Refactor the validity function names to make it easier for autocomplete to find.
2015-12-29 22:24:32 +00:00
Mike Auty
d258c56991
Rerun pylint with pycharm-5 and fix pep8 issues as well.
2015-11-21 13:12:00 +00:00
Mike Auty
49fa45cda1
Clean-up the namespace even more by putting the template proxy code into its own subclass.
2015-01-05 15:57:35 +00:00
Mike Auty
87967853f7
Convert volinfo namespace to vol namespace.
2015-01-05 15:04:40 +00:00
Mike Auty
ea3ba27a04
Refactor template_* functions.
2015-01-04 20:52:34 +00:00
Mike Auty
446536d789
Remove the concept of template_info and revert to structure_name alone.
2015-01-04 04:27:52 +00:00
Mike Auty
15b2f6f717
Initial introduction of ObjectInformation class.
2015-01-04 03:41:37 +00:00
Mike Auty
9c919a3d91
Fill in a few more of the missing abstract methods.
2014-12-31 21:03:52 +00:00
Mike Auty
4a4deebda5
Fix up refactoring error in pointer dereference caching.
2014-12-31 03:45:56 +00:00
Mike Auty
47a1390bb9
Allow explicit dereferencing at a layer within memory.
...
This is in contrast to volatility-2.x where object were automatically
instantiated with a native_vm (or native_layer in 3.x parlance) and then
any dereferences occurred in the correct layer.
The space savings are now minimal since each object carries around only
a layer name, and not a reference to the entire space. However, given
situations such as kernel structures containing pointers into
process spaces, where the native_vm is useless, this decision is
designed to make working on a particular layer explicit and therefore
more obvious. It may mean exposing that up through levels of functions,
but hopefully it will make all the code more obvious and less
automagical.
2014-12-31 03:03:31 +00:00
Mike Auty
ed5d047dc9
Clean-up member/attribute selection.
2014-12-30 22:49:02 +00:00
Mike Auty
3c54065cdc
Add array type validity checking.
2014-12-30 04:19:34 +00:00
Mike Auty
04720d5ab9
Fix two important typo errors in Arrays.
2014-12-30 04:08:59 +00:00
Mike Auty
77417b2785
Add in relative_child_offset and refactor to reuse the checking code.
2014-12-30 03:51:02 +00:00
Mike Auty
a97bd19988
Reformat and optimize code, including trailing whitespace and end of file newline.
2014-06-10 15:40:50 +01:00
Mike Auty
89e7e6e7ff
Tidy up several areas using PyCharm corrections.
2014-03-30 00:46:31 +00:00
Mike Auty
3709143c40
Clean-up a few files according to PyCharm's warning system.
2014-03-28 08:47:00 +00:00
Mike Auty
5b23325447
Change symbol_names to structure_names.
2014-03-22 13:46:22 +00:00
Mike Auty
26f8d0f7cc
Add in write support, and change symbols to be both structures and constants.
2013-12-28 05:30:54 +00:00
Mike Auty
26caf31974
Revisit the decision to try out super, and decide to stick with specific inheritance to avoid **kwargs everywhere.
2013-05-08 19:17:21 +01:00
Mike Auty
9c2e486356
Refactor code locations, tidy up object initializers and add in File Layer.
2013-05-06 17:45:15 +01:00
Mike Auty