Mike Auty
fd582f62e2
Fix a potential exception when earlier automagics don't succeed.
2017-11-04 18:54:52 +00:00
Mike Auty
9d7d547667
Minor linting.
2017-11-04 18:45:18 +00:00
Mike Auty
a4b4a8eed3
Improve the error handling with automagics.
2017-11-04 18:45:08 +00:00
Mike Auty
8166b0cc96
Add better logging around the stacker.
2017-11-04 17:13:01 +00:00
Mike Auty
d9d67efa3a
Add in the capability to stash linux_banners.
...
Since the stacker and Linux automagic will always be different objects
(even if they're the same class), and we don't want to add OS specific
code to the stacker, this is the simplest way of allowing the Linux
symbol automagic to get information from the dtb finding stacker.
2017-11-04 17:09:59 +00:00
Mike Auty
dab5caf104
Paths from the banner cache are already URIs, so we don't need to reconvert them.
2017-11-04 15:52:02 +00:00
Mike Auty
01043b9f3e
Rework isf_filename to isf_url since we can load it from a remote location if required.
2017-11-04 15:47:52 +00:00
Mike Auty
4b7543f2f4
Unify the resource opening.
2017-11-02 21:46:39 +00:00
Mike Auty
dbc73df8f2
Make sure we support windows filenames
...
Consider refactoring out the various URL openning code into
one that just returns the open file handle. This would require changing
the config option of "filename" to "location" and rejigging a few other
bits elsewhere, but would centralize and make it more managable.
2017-11-02 11:56:03 +00:00
Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
5d2b0f9004
Add in support for determining if a key is volatile.
2017-10-23 17:09:25 +01:00
Mike Auty
f085c9d2e3
Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX.
2017-10-09 01:41:08 +01:00
Mike Auty
c09ce60f73
Support the new HMAP_ENTRY structure for Win10.
2017-10-09 01:40:37 +01:00
Mike Auty
3f70ee92be
Improve the debugging output for unknown registry node signatures.
2017-10-09 00:54:02 +01:00
Mike Auty
587b6e9d9e
Add back in the deprecated helper for _CMHIVE.
2017-10-09 00:20:32 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
b8f545633d
Ensure we do logging rather than printing.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
023598a582
Additional improvements to the registry layer and cell/node handling.
2017-10-09 00:19:05 +01:00
Mike Auty
042ff5ca25
Use .vol.count for consistency.
2017-10-09 00:19:05 +01:00
Mike Auty
fadb421331
Improve the support for signatures of cells.
2017-10-09 00:19:05 +01:00
Mike Auty
757837633f
Make sure we don't lose volatile bit for members.
2017-10-09 00:19:05 +01:00
Mike Auty
7a093ad4c4
Move the registry types to their own location.
2017-10-09 00:19:05 +01:00
Mike Auty
19d66bd063
Add in current work in progress.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
30fc62e11c
Add in fallbacks for legacy code.
2017-10-09 00:18:00 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
334412330c
Ensure offsets are appropriately prefixed, given we can now support accepting 0x### numbers.
2017-10-09 00:02:03 +01:00
Mike Auty
8dc6401ad8
Add in gentle deprecation warnings about non-helper properties to prevent member confusion.
2017-10-08 23:02:13 +01:00
Mike Auty
624289b94d
Drop out the NlpDtbfinder from the linux plugins, since the LayerStacker should sort it.
2017-10-08 20:24:24 +01:00
Mike Auty
ae9e33292f
Add in restrictions on automagics should be used for each type of plugin.
2017-10-08 20:22:10 +01:00
Mike Auty
42579ca619
Allow subtypes for array_of_pointers to be strings.
2017-10-05 00:30:16 +01:00
Mike Auty
06767bd44c
Ensure we get a warning of some kind when a bad scheme is provided.
2017-10-05 00:13:45 +01:00
Mike Auty
5fbc90e699
Add in utility function for recasting objects as array of pointers of objects.
2017-10-05 00:10:02 +01:00
Mike Auty
88fa13bbdd
Allow count to be specified as a parameter.
2017-10-04 22:21:29 +01:00
Mike Auty
6523364c90
Add a validate method to all objects to allow for (optional) validation of data on construction.
2017-09-22 09:57:01 +01:00
Mike Auty
fea912baaa
Change the InvalidDataException to include the object that threw the validation error.
2017-09-22 09:56:22 +01:00
Mike Auty
393d657d6f
Add exception for data validation.
2017-09-21 21:23:20 +01:00
Mike Auty
71cfec18a6
Add commentary around a potential conflict of method with property.
2017-09-20 09:38:28 +01:00
Mike Auty
5261da780b
Allow the size of array to be changed (may override an existing count member).
2017-09-18 23:23:23 +01:00
Mike Auty
255228ecb0
Convert to abc (post python-3.3).
2017-09-18 23:22:08 +01:00
Mike Auty
7db811fa09
Move nlpdtbscanner's stack order lower down since it isn't accurate for linux (and was tried before it previously).
2017-09-05 11:00:51 +01:00
Mike Auty
946fbd5e61
Use the convenience function built for exactly this circumstance.
2017-09-04 01:26:40 +01:00
Mike Auty
0599ec8f36
Slightly improve potential error condition.
2017-09-03 23:17:07 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
e90b4e2d02
Add and make use of free_table_name for symbol_spaces.
2017-09-03 22:54:42 +01:00
Mike Auty
a4bb32d797
Rework the linux automagic to include utility functions for finding the ASLR and KASLR shifts.
2017-09-03 21:51:11 +01:00
Mike Auty
6265fc4e2d
Catch errors if the stacker didn't manage to stack correctly.
2017-08-31 01:04:01 +01:00
Mike Auty