Mike Auty
f2bfd39c57
Add in more debugging information.
2017-07-17 17:17:46 +01:00
Mike Auty
23ccb4d4c8
Fix the real root cause, files not containing a banner.
2017-07-17 17:11:05 +01:00
Mike Auty
9b9792f3e2
Ensure we save the results of checking for non-existant files.
2017-07-17 17:06:52 +01:00
Mike Auty
5ca4f8e788
Use a central bit of code to do the load and unload of cached linux banners.
2017-07-17 16:38:25 +01:00
Mike Auty
f6a55876d0
Add in check to avoid unsightly exceptions.
2017-07-17 16:19:36 +01:00
Mike Auty
8b95480e88
Write the cached linuxbanners after each one so that cancellations don't require re-runs.
2017-07-16 22:59:01 +01:00
Mike Auty
807b5dcaf0
Ensure we throw an appropriate error if there's no patterns available.
2017-07-16 22:52:56 +01:00
Mike Auty
b68932a7bc
Improve the linux DTB finding code.
2017-07-16 18:05:19 +01:00
Mike Auty
d0b1177c31
Add in the linux signature scanner.
2017-07-16 18:05:08 +01:00
Mike Auty
b099822ce2
Refactor requirement finding recursion since we use it a lot.
2017-07-16 18:04:22 +01:00
Mike Auty
c4fbaf248e
Max the number of hash buckets needed precise, and explicitly linked to the hash function.
2017-07-16 01:27:20 +01:00
Mike Auty
f9375d0797
Reduce pointless memory usage, and remove old imports and debugging exception handlers.
2017-07-16 01:23:31 +01:00
Mike Auty
0ca78bc890
Add an efficient multi-string search module (based on Wu-Manber 1994).
...
Empirically this seems far quicker than either Aho-Corasick or
Commentz-Walter for our dataset (very many long search terms).
2017-07-16 01:13:49 +01:00
Mike Auty
8c4bdc8c61
Change the behaviour of multithreaded scans to return results as soon as possible (at the cost of ordering).
2017-07-14 01:16:30 +01:00
Mike Auty
2b718f104d
Remove imports that will break the code.
2017-07-14 01:15:52 +01:00
Mike Auty
a4bb297db7
Improve the progress calculator for multithreaded progress.
2017-07-13 01:31:47 +01:00
Mike Auty
a5e8d98a9c
Refactor the location of the linux banner cache.
2017-07-13 01:31:19 +01:00
Mike Auty
dd7c9d777a
Refactor the scanners to allow for better organization.
2017-07-13 01:30:01 +01:00
Mike Auty
2453b7f180
Add a little information to the log to see when the cache is being built.
2017-07-10 01:24:52 +01:00
Mike Auty
d1cdf805df
Update the comments slightly.
2017-07-10 01:20:01 +01:00
Mike Auty
0811bdaa1a
Add in initial version of linux banner cache mechanism.
2017-07-10 01:17:09 +01:00
Mike Auty
9127f1827f
Carry out the base64 decoding when the symbol is constructed.
2017-07-10 00:06:17 +01:00
Mike Auty
8d4ccb846a
Split out the JSON hashing function for reuse with other caching mechanisms.
2017-07-10 00:05:05 +01:00
Mike Auty
d80fbf1a69
Fix validation typo preventing the newer symbols from properly working.
2017-07-10 00:04:29 +01:00
Mike Auty
4fb88c4636
Move the ISF validation caching to use ISF rather than IDF.
2017-07-10 00:03:30 +01:00
Mike Auty
f12ab2a460
Move the symbol paths into the constants package.
2017-07-10 00:02:31 +01:00
Mike Auty
3a8e43a95a
Doh, fix the schema from an earlier iteration.
2017-07-09 00:52:40 +01:00
Mike Auty
f60901efb8
Don't forget to actually add the schema...
2017-07-09 00:51:08 +01:00
Mike Auty
5675942050
Add in symbol constant_data and bump the schema to 0.4.1.
...
Special thanks to @npetroni for having to suffer a very long discussion
with me about my need for things to have particular names because I
don't know the field very well. 5:S Sorry! 5:)
2017-07-08 21:50:25 +01:00
Mike Auty
2850035825
Add in the mypy generated cache.
2017-07-02 17:58:20 +01:00
Mike Auty
1cfe64e786
Update and organize the gitignore file a bit.
2017-07-02 15:52:21 +01:00
Mike Auty
4838a17f24
Ensure that the framework plugins are always loaded.
2017-07-02 15:51:41 +01:00
Mike Auty
c38210b8a5
Add the harness for using the nlpdtbfinder.
2017-07-01 23:16:00 +01:00
Mike Auty
2efbd3dd68
Ensure framework plugins are loaded just like non-framework plugins.
2017-07-01 22:22:43 +01:00
Mike Auty
8625343792
Add the ability to create 'hidden' classes.
...
These will not be returned as part of the subclasses of
their descendents when listed using the classes_subclasses function.
They can be inherited from and their descendents will be listed unless
they also specify the hidden property and mark it as True
(ideally, using the class decorator hide_from_subclasses).
2017-07-01 22:19:50 +01:00
Mike Auty
a4c6c8bf55
Add in logging option to prevent creating example.log all the time.
2017-06-29 00:08:55 +01:00
Mike Auty
ea8a721882
Add in ability to quieten the progress output (-q or --quiet).
2017-06-28 23:26:14 +01:00
Mike Auty
d79d428edc
Ensure we use the native dictionary for more recent IFF versions (and correct issues with pointers and chars).
2017-06-23 15:44:58 +01:00
Mike Auty
e1c1981ed7
Fix up plugin argument help messages.
2017-06-20 17:44:59 +01:00
Mike Auty
df527d2f00
Convert from abstractproperty which was deprecated in python-3.3.
2017-06-20 15:14:13 +01:00
Mike Auty
d0ebeab253
Merge branch 'master' of github.com:volatilityfoundation/volatility3
2017-06-05 23:01:34 +01:00
Mike Auty
5dedf00f64
Update the linux automagic based on the VMCOREINFO structure.
2017-06-05 23:01:22 +01:00
Mike Auty
761777c8ef
Add commentary as to why we can't scan faster by ignoring surjective duplicates.
2017-06-03 20:57:19 +01:00
Mike Auty
c05599d78a
Minor clean-up of segmented layer.
2017-06-03 20:26:45 +01:00
Mike Auty
b72c3aaed5
Handle invalid translations lower than the top layer when scanning.
2017-06-03 20:26:21 +01:00
Mike Auty
0675350346
Fix up minor logical error in multithreaded scanning global flag.
2017-06-03 17:49:56 +01:00
Mike Auty
c862f38917
Add in flag to forcibly disable all multithreaded scanning.
2017-06-03 17:48:32 +01:00
Mike Auty
9a2bfe7c92
Remove unused variable.
2017-06-03 17:44:59 +01:00
Mike Auty
93a6efd666
Ensure we don't get name confusion when dealing with variables.
2017-06-03 17:44:13 +01:00
Mike Auty
bc4c386d6d
Fix a multiprocessing issue (and tidy away the kwargs).
...
By not passing the arguments from exceptions down to the
base class Exception, it causes an issue when they are
pickled to be passed between processes. For more information,
see http://bugs.python.org/issue1692335 .
2017-06-03 12:41:18 +01:00
Mike Auty