superponible and ikelos
ef7e7fd905
only catch InvalidAddressException
2019-08-13 20:37:46 +01:00
superponible and ikelos
317c1cdb7b
store cmhive name instead of _cmhive
2019-08-13 20:37:46 +01:00
Dave Lassalle and ikelos
60193b2a3f
remove HBIN bounds check
2019-08-13 20:37:46 +01:00
Dave Lassalle and ikelos
0e22eea58d
improved exception handling in registry and printkey
2019-08-13 20:37:46 +01:00
Mike Auty
8e4fd03190
Improve the help for the renderer global CLI option.
2019-08-12 00:35:17 +01:00
Mike Auty
fb68e22767
Expose the context for a module, so we don't have to ship both around.
2019-08-12 00:17:09 +01:00
Mike Auty
39fa9057ff
Remove errant scan_kernel from svcscan for rekall.
2019-08-11 23:32:34 +01:00
Mike Auty
bbac649a62
Remove the dependency on pdbparse since pdbparse-to-json is no longer necessary.
2019-08-11 17:39:34 +01:00
Mike Auty
75f386784a
Clean up development directory.
2019-08-11 17:33:53 +01:00
Mike Auty
0b71c1130f
Add in the image-hash to make results easier to match up.
2019-08-11 17:19:59 +01:00
Mike Auty
196da74fdb
Fix up a manual typo (and remove trailing spaces).
2019-08-11 17:16:57 +01:00
Mike Auty
40d04ed1ff
Improve comparison titles, store stderr and output up until timeout.
2019-08-11 11:33:42 +01:00
Mike Auty
cdc19ad5fa
Add in 5 minute timeout for comparison tests.
2019-08-10 18:58:47 +01:00
Mike Auty
4cde0da8a9
Support passing through functions from specific to generic template.
2019-08-10 00:25:21 +01:00
Mike Auty
b2da35c05a
Revert "Apply relative offsets to type_name as well as symbol_names for modules."
...
This reverts commit d67fcc9a6a
2019-08-10 00:23:18 +01:00
Mike Auty
d67fcc9a6a
Apply relative offsets to type_name as well as symbol_names for modules.
2019-08-09 20:08:05 +01:00
Mike Auty
8ddfe8ce16
Update plugins using the old PESymbolTable method
2019-08-09 00:49:05 +01:00
Mike Auty
6f7dc1a75e
Add in the scan_kernel parameter for rekall to offer a fair comparison.
2019-08-08 23:20:59 +01:00
Mike Auty
a412d3ef2f
Guard against list size returns.
2019-08-08 20:30:33 +01:00
Mike Auty
1120854350
Ensure we descend LF_MODIFIERs when finding forward referenced array sizes.
2019-08-08 17:15:25 +01:00
Mike Auty
fbeab3608c
Make we raise if the _POOL_HEADER type doesn't exist.
2019-08-08 01:09:56 +01:00
Mike Auty
253ce69fc9
Refactor poolscanner layer to move more into the parallel scanner.
2019-08-07 18:37:56 +01:00
Mike Auty
9ed1a5a5b6
The header is not dependent on the constraint, so only construct it once.
2019-08-07 16:33:13 +01:00
Mike Auty
e3057e305d
Support parallelism on CLI.
2019-08-07 11:44:29 +01:00
Mike Auty
6c23968a11
Add in support for choosing specific frameworks to test.
2019-08-06 13:32:03 +01:00
Mike Auty
f8587a08f2
Refactor and add support for testing rekall.
2019-08-05 01:20:24 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty
f9e22d02de
Further typing discrepancy fixes.
2019-07-30 22:14:19 +01:00
Mike Auty
282ddc2f07
Fix up more little math typos and try to clarify what counter is where.
2019-07-30 22:14:19 +01:00
Mike Auty
4a7151a23f
Ensure the 'stream not present' indicator is adhered to.
2019-07-30 22:14:19 +01:00
Mike Auty
f3d7de4558
Fix up consumption of padding.
2019-07-30 22:14:19 +01:00
Mike Auty
0302f4b96a
Change calculations to not alter original values for clarity.
2019-07-30 22:14:19 +01:00
Mike Auty
bd2e948d9e
Fix up size for Unions but also ensure total sizes aren't used in calculations.
2019-07-30 22:14:19 +01:00
Mike Auty
6bcb23ea87
Consumed length of enums and FieldLists was slightly off.
2019-07-30 22:14:19 +01:00
Mike Auty
7a0b71f7ae
Fix an issue we hit 1 in 1000 times.
...
Turns out, that because the name consumption is fairly lax (often lots
of excess space after the name, etc) we were reading 2 too many bytes
(because we weren't taken the length of the leaf off the available
length). This would error when it so happened that a structure was at
the end of the type list and we'd read past the end of the tpi stream.
2019-07-30 22:14:19 +01:00
Mike Auty
e729877d38
Better error handling in the MSF layer.
2019-07-30 22:14:19 +01:00
Mike Auty
848fe7391a
Add in further pointer fixes.
2019-07-30 22:14:19 +01:00
Mike Auty
927bcd3318
Only use different pointers when necessary.
2019-07-30 22:14:19 +01:00
Mike Auty
72b78fb94d
Initially attempt at sorting out pointer issues.
2019-07-30 22:14:19 +01:00
Mike Auty
f8ce286894
Add downloading progress when retrieving PDBs.
2019-07-30 22:14:19 +01:00
Mike Auty
a788856fd3
Ensure the CLI version of mspdb provides progress.
2019-07-30 22:14:19 +01:00
Mike Auty
398c583432
Ensure failed downloads are reported.
2019-07-30 22:14:19 +01:00
Mike Auty
eab74af5df
Fix up union naming and omap symbol mapping.
2019-07-30 22:14:19 +01:00
Mike Auty
42f10b9c40
Support old unnamed types.
2019-07-30 22:14:19 +01:00
Mike Auty
e998082d84
Add in HRESULT primative.
2019-07-30 22:14:19 +01:00
Mike Auty
aee05f61f6
Add in linkage name code.
2019-07-30 22:14:19 +01:00
Mike Auty
90ed31ce16
Don't forget get arrays and enums.
2019-07-30 22:14:19 +01:00
Mike Auty
108a4f9b41
Ensure we get the right max_length when getting names for structures/unions.
2019-07-30 22:14:19 +01:00
Mike Auty
f9316626dd
Improve typing issues with pdb code.
2019-07-30 22:14:19 +01:00
Mike Auty
b501b5484b
Don't forget to add the license headers.
2019-07-30 22:14:19 +01:00
