 Mike Auty
|
f28ee6077e
|
Update for the new classmethod model.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
a1caf8d149
|
Add in initial VAD yarascan code.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
9c2ba66c53
|
Add in initial version of yarascan plugin.
|
2018-06-17 11:16:27 +01:00 |
|
|
Mike Auty
|
d9ed86bcc5
|
Ensure we return the correct values for dir().
|
2018-06-16 14:29:51 +01:00 |
|
|
Mike Auty
|
c0ec52822b
|
Add some typing fixes.
|
2018-06-16 14:19:36 +01:00 |
|
|
Mike Auty
|
60df83ef15
|
Convert modules/moddump to classmethod.
|
2018-06-16 14:03:22 +01:00 |
|
|
Mike Auty
|
ecb9d5cf05
|
Convert vadinfo calls to classmethods.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
c4c6d30d42
|
Rejig where the pslist plugin exists.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
ac8401991c
|
Convert all remaining plugins to use the new classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
6ca34e6607
|
Start converting plugins to use classmethod pslist.
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
aea59ffa34
|
Make the change for the core pslist (breaks lots of plugins).
|
2018-06-16 13:38:48 +01:00 |
|
|
Mike Auty
|
86c5302c99
|
_missing_ was a python-3.6 feature.
|
2018-06-16 12:36:00 +01:00 |
|
|
Mike Auty
|
ddeacd3524
|
Fix up my mistaken advice.
|
2018-06-16 09:56:10 +01:00 |
|
|
Dave Lassalleandikelos
|
a0edd1e38e
|
root_cell_offset changes seem to have fixed maxaddr problems
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
09475d5992
|
set default value for key since we combined exception handling
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
c68d02d565
|
combine exception handling to reduce code duplication
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
f2029d5657
|
add comment about registry key case sensitivity and re-work root_cell_offset
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
b85c143af9
|
yield UnreadableValues when key not found, and set default RootCell on exception
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
201fc5780a
|
don't use BaseBlock.Length for maxaddr
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
0c3866ef77
|
make registry path comparison case insensitive
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
5467c1c5e3
|
prevent from halting on an unknown registry value type
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
218b1fd37c
|
use masked length to extract data
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
481ea01149
|
catch the KeyError so we can iterate over all hives for a key path
|
2018-06-16 09:54:45 +01:00 |
|
|
Dave Lassalleandikelos
|
6cfd3b6499
|
fix typo in debug statement
|
2018-06-16 09:54:45 +01:00 |
|
|
Mike Auty
|
33e146533e
|
Fix minor typo in malfind.
|
2018-06-15 23:04:01 +01:00 |
|
|
Michael Lighandikelos
|
7338cdbf8a
|
BaseDllName should be an UnreadableValue() if it cannot be accessed
|
2018-06-13 15:10:58 +01:00 |
|
|
Michael Lighandikelos
|
3eeb48cc0e
|
add the moddump plugin for windows
|
2018-06-13 15:10:58 +01:00 |
|
|
Michael Ligh
|
95214216ea
|
BaseDllName and FullDllName should be UnreadableValue() if they cannot be accessed
|
2018-06-13 09:10:47 -05:00 |
|
|
Mike Auty
|
5f130a3b2a
|
Update timeliner and convert pslist to support it.
|
2018-06-12 09:01:01 +01:00 |
|
|
Mike Auty
|
eed92de9ef
|
Bulk of the modifications for the timeliner interface.
|
2018-06-12 09:01:01 +01:00 |
|
|
Michael LighandMike Auty
|
76f5d35499
|
update _KDDEBUGGER_DATA64.get_build_lab() to not reference "nt_symbols"
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
7ae0d654c2
|
pass native_types to KdbgIntermedSymbols.create() instead of table_mapping
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
ae9d7dbc86
|
use *args and **kwargs when inheriting from IntermediateSymbolTable
|
2018-06-12 08:41:37 +01:00 |
|
|
Michael LighandMike Auty
|
7797a6a385
|
add a class string to windows.info so that the plugin has a description
|
2018-06-12 08:40:21 +01:00 |
|
|
Michael LighandMike Auty
|
fb57e2c5f2
|
wininfo, procdump, dlldump, and json for pe & kdbg
|
2018-06-12 08:40:21 +01:00 |
|
|
Mike Auty
|
2cbd444603
|
Add in symbol table address masker.
|
2018-06-06 23:12:46 +01:00 |
|
|
Mike Auty
|
b228ad8e95
|
Add comment concerning reconstructability of SymbolTables.
|
2018-06-06 23:10:21 +01:00 |
|
|
Mike Auty
|
253304270b
|
Ensure we can add native_types when we create tables.
|
2018-06-06 00:42:23 +01:00 |
|
|
Mike Auty
|
36dee38a9e
|
Leave pointer out of the default types (since it needs an appropriate size).
|
2018-06-05 21:46:02 +01:00 |
|
|
Mike Auty
|
113c23a66d
|
Last of the typing fix-ups.
|
2018-06-04 23:55:38 +01:00 |
|
|
Mike Auty
|
2dc3d2928d
|
Fix more typing issues.
|
2018-06-04 23:28:26 +01:00 |
|
|
Dave Lassalleandikelos
|
abfcdba524
|
add Windows 10 Registry process support
|
2018-06-04 20:17:28 +01:00 |
|
|
Mike Auty
|
816db6b626
|
Fix up some missing logging names that slipped through the review net.
|
2018-06-04 10:10:44 +01:00 |
|
|
Mike Auty
|
9711793503
|
Ensure intel.read(pad=True) doesn't return InvalidAddressExceptions.
|
2018-06-04 09:40:26 +01:00 |
|
|
Mike Auty
|
f957b2915e
|
Fix up issue having made optional parameters non-optional.
|
2018-06-04 09:39:38 +01:00 |
|
|
Mike Auty
|
7a52ac9deb
|
Fix a large number of typing issues.
There are several instances where mypy didn't detect
if blah is not None:
blah = thing
and so were rewritten as:
blah = blah or thing
|
2018-06-04 01:25:02 +01:00 |
|
|
Mike Auty
|
d3782c0519
|
Fix typo as identified by @imhlv2.
|
2018-06-03 23:51:46 +01:00 |
|
|
Mike Auty
|
9740c4af84
|
Add in configwriter plugin, fixes issue #26.
|
2018-05-31 11:50:40 +01:00 |
|
|
Mike Auty
|
213c70527f
|
Change the plugins option to plugin_dirs to avoid conflict with timeliner.
|
2018-05-31 11:48:12 +01:00 |
|
|
Mike Auty
|
b647c3a089
|
Refactor volshell with inheritance and add dt.
It makes enourmous sense to inherit the windows volshell plugin from the
volshell one. I also added the generic dt function.
|
2018-05-30 22:36:42 +01:00 |
|