Mike Auty
a32c7e27a9
Add in cryptic comments nearly lost during the vtypes purge.
2016-12-13 19:40:18 +00:00
Mike Auty
058346b74d
Ensure IntermediateSymbols can handle cross-table references.
2016-12-13 19:32:22 +00:00
Mike Auty
ed716ca12a
Convert SymbolTableInterfaces to descend from ConfigurableInterface
...
This allows SymbolTables to hold actual requirements (which
IntermedSymbolTable already did, but without pulling in the right
interface). It means that values like kernel_virtual_offset get saved.
We still need to figure out how to allow plugins to demand optional
configuration values in other places (such as the kvo) but for now the
plugin will barf if it doesn't get it.
2016-12-12 02:08:32 +00:00
Mike Auty
e2d5f51ad5
Remove old and rotten code.
2016-12-12 00:25:03 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty
c52bf7cb6f
Pull out the appropriate natives based on the intermediate format data.
2016-12-04 23:50:13 +00:00
Mike Auty
770a8ee42a
Improve error handling to prevent endless recursion in template.__call__
2016-12-04 11:17:48 +00:00
Mike Auty
e1cc55aeed
Add in wchar to our set of bases for x64 systems.
2016-12-04 01:02:17 +00:00
Mike Auty
e27a444068
Very minimally fix up the docstring for a function.
2016-12-04 01:01:46 +00:00
Mike Auty
ed552d20e8
Add in support for lzma compressed json data.
2016-12-02 01:34:07 +00:00
Mike Auty
282eaa7f00
Improve/remove unnecessary imports.
2016-11-07 12:26:06 +00:00
Mike Auty
62fb752c82
Add in validation caching for JSON schema use and only record success when actual validation occurs.
2016-11-07 01:17:08 +00:00
Mike Auty
96a7a56edd
Commit the initial JSON schema for the intermediate format.
2016-11-06 01:48:01 +00:00
Mike Auty
7b12483719
Change version to format and move the delegate function factory outside of the class.
2016-11-06 01:33:51 +00:00
Mike Auty
f0c6b0d1a4
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2016-11-04 18:09:04 +00:00
Mike Auty
2dba1bbddd
Update wording to clarify the different between package version and interface version.
2016-11-04 17:56:58 +00:00
Mike Auty
11d60b9f7f
Update the accepted format version.
2016-11-03 01:03:38 +00:00
Mike Auty
d57733d530
Add in support for format versioning.
2016-11-01 01:33:44 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
d1b58143fe
Add in UnresolvedTemplate type.
...
This template type allows objects that have not been able to be resolved
to exist within the symbol system. It emits a debug message on creation
so that intermediate format developers can identify potential issues,
but does not raise an exception so as to allow partial tables to be
used.
If the UnresolvedTemplate is called (to create an object) before the
symbol has been added to the symbolspace, it will fail with a
SymbolError (as thrown by the individual SymbolTable). For this reason,
the class has been made private to the SymbolSpace class to prevent
unexpected use.
2016-10-30 16:54:12 +00:00
Mike Auty
287baeb03a
Add in rudimentary symbol support to the intermediate format.
2016-10-26 01:49:52 +01:00
Mike Auty
6f1bdcb6cb
Refactor symbol.offset to symbol.address.
2016-10-26 01:42:37 +01:00
Mike Auty
6b405383c4
Refactor targets to subtypes.
2016-10-26 01:24:58 +01:00
Mike Auty
50f5a5ddb7
Fix up broken vtypes that looks like it might never have worked.
2016-10-26 01:16:25 +01:00
Mike Auty
5f0ceff4d2
Fix up the broken vtypes conversion by translating between the names.
2016-10-26 01:16:07 +01:00
Mike Auty
0b447b6958
Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying.
2016-10-26 01:09:29 +01:00
Mike Auty
e02feed16e
Python 3 has a sane super() implementation (no arguments), so convert to using that.
2016-08-14 00:55:02 +01:00
Mike Auty
b92ccd771f
Fix up the DTB finder code and stick it all together.
2016-07-30 02:35:40 +01:00
Mike Auty
43aba96e3f
Minor pylint (alphabetical imports) and refactoring the construct class to work for symbols.
2016-07-30 01:58:29 +01:00
Mike Auty
bb2dd859d5
Refactor the get_schema call to make more sense.
2016-07-29 02:56:20 +01:00
Mike Auty
16bed2aa94
Allow specifying a table_name for get_symbols_by_location.
2016-05-22 16:02:30 +01:00
Mike Auty
e0b7f0b5f0
Add in helper functions for symbolspaces/symboltables to locate specific symbols.
2016-05-22 15:57:48 +01:00
Mike Auty
fea6e0820a
Convert to using a BANG variable for the symbol name delimiter.
...
Whilst it's easy to do now (because we don't yet use it many places)
convert the ! delimiter into a variable.
2016-05-22 15:26:31 +01:00
Mike Auty
2d23c93def
Completely refactor constants and structures to symbols and types.
2016-05-22 11:51:06 +01:00
Mike Auty
0ef389dec9
Tidy up Bytes and String to require all the appropriate parameters.
2016-02-14 02:49:28 +00:00
Mike Auty
9c1dbf88e2
Change Bytes to not require a struct_format, since we generate it from the length parameter.
2016-02-14 01:43:09 +00:00
Mike Auty
a8828d7185
Add Strings and Bytes to the native structure code.
2016-02-13 17:18:23 +00:00
Mike Auty
34b8671ce3
Refactor basic to extensions for windows additions.
2016-02-13 17:17:10 +00:00
Mike Auty
211bbbe5f6
Ensure that symbol space providers correctly provision the space.
...
Also corrects failed importing using import_module from importlib.
2016-01-16 22:01:03 +00:00
Mike Auty
78cd3c84c0
Add in a NativeSymbolTable validator.
2016-01-16 21:38:00 +00:00
Mike Auty
84815d204e
Refactor and clarify exactly what the dependency resolver's doing.
...
Also includes requirements and a provider to support adding the
symbol spaces required for XP SP2.
2016-01-16 21:05:37 +00:00
Mike Auty
00660f2a2b
Refactor requirements to their own file.
2016-01-16 21:04:41 +00:00
Mike Auty
a8d6fd5647
Refactor windows code to windows basic to avoid import loops.
2016-01-16 20:09:18 +00:00
Mike Auty
16ffc3e237
Refactor the location of xp_sp2_x86_vtypes.
2016-01-16 13:21:06 +00:00
Mike Auty
d258c56991
Rerun pylint with pycharm-5 and fix pep8 issues as well.
2015-11-21 13:12:00 +00:00
Mike Auty
65fcd5fbe5
Minor pylinting.
2015-09-28 01:34:52 +01:00
Mike Auty
143335402d
Use a default value to allow instantiation of contexts, rather than allowing None and checking all the time.
2015-04-09 16:30:01 -05:00
Mike Auty
180db2e23d
Minor neatening of iter.
2015-04-09 16:25:21 -05:00
Mike Auty
5493617727
Fix up minor typo in the recent SymbolSpace changes.
2015-04-09 16:24:04 -05:00
Mike Auty
35506bb7d3
Allow SymbolSpaces to be uninitialized, and move context from framework to framework.contexts.
2015-04-09 16:22:25 -05:00
Mike Auty