Mike Auty
5ef65d6d38
Remove the ntkrnlmp name and use ntsymbols instead.
2017-11-01 21:23:44 +00:00
Mike Auty
28036c9405
Add in the ability to recurse keys (off by default).
2017-10-23 17:11:15 +01:00
Mike Auty
d6235325f9
Make changes according to the deprecations.
2017-10-09 00:19:05 +01:00
Mike Auty
957fa23af2
Move the registry plugin to an appropriate location.
2017-10-09 00:19:05 +01:00
Mike Auty
930c8a2e08
Make the registry test plugin work with keys and offset parameters.
2017-10-09 00:19:05 +01:00
Mike Auty
a12246a423
Shift the order of the columns.
2017-10-09 00:19:05 +01:00
Mike Auty
6c0d98ba1b
Improve registry value handling.
2017-10-09 00:19:05 +01:00
Mike Auty
4fb24985eb
Add in standard registry walking to the regtest plugin.
2017-10-09 00:19:05 +01:00
Mike Auty
38b6e12ec5
Minor changes to the testrig.
2017-10-09 00:19:05 +01:00
Mike Auty
0f1e84139f
Remove the extra regtest plugin.
2017-10-09 00:18:15 +01:00
Mike Auty
27e5dbfcc6
Add in testing plugin temporarily.
2017-10-09 00:18:15 +01:00
Mike Auty
f538319d7c
Add a little more code to the registry layer.
...
Really need to figure out how to deal with _HBIN and _HCELL for
systems that don't have those structures. The format seems extremely
unlikely to change, but better not to hard code anything if avoidable.
2017-10-09 00:18:15 +01:00
Mike Auty
5a30ef3708
Start adding in some code for reading the registry.
2017-10-09 00:18:15 +01:00
Mike Auty
ef5d21ea7c
Refactor the names given the new deprecation.
...
The concept is to have a helper_ namespace, to ensure that
members cannot accidentally be overriden by properties in
extended classes.
This demonstrates that by renaming all extension properties to
helper_<name>.
2017-10-09 00:05:50 +01:00
Mike Auty
6c6d0473a1
Fixed table names will no longer work since tables are prefix-named.
2017-09-03 23:17:40 +01:00
Mike Auty
710043f508
Fix up the ASLR finding to compensate for older task_struct structures.
2017-09-03 23:16:22 +01:00
Mike Auty
9b835b1baf
Remove excess windows volshell local variables.
2017-08-29 23:55:34 +01:00
Mike Auty
f40665f1b7
Split volshell into windows and base/os-agnostic versions.
2017-08-29 23:54:11 +01:00
Mike Auty
cdf64ae08e
Add in initial implementation, currently with windows specific bits.
2017-08-29 01:06:46 +01:00
Nick L. Petroni, Jr
5bb2aef9fc
Created linux.proc.Maps plugin.
...
Added object extensions for the key structures. Also added
constants.linux, which will contain Linux-specific constants
that can't be extracted via dwarf.
2017-08-16 16:14:33 -04:00
Mike Auty
570a2d35be
Make the DllList import a little more sensible/consistent.
2017-08-10 10:07:57 +01:00
Mike Auty
c19ad1cb22
Placeholder change to ensure even if we don't change it to a from statement, it isn't bizarre.
2017-08-10 10:03:39 +01:00
Mike Auty
8be6869a84
Tidy up imports and adhere to the coding style of never directly importing objects.
2017-08-09 22:22:43 +01:00
Mike Auty
775ece3cb2
Convert the 'ntkrnlmp' requirement into an 'nt' requirement.
2017-07-24 15:43:34 +01:00
Mike Auty
8ad9fbfd24
Ensure imported plugins have their correct requirements fulfilled (even if they change).
2017-07-24 15:41:47 +01:00
ikelos and GitHub
fe66301cf3
Merge pull request #8 from volatilityfoundation/mhl-cmhive
...
move the hive name decision to _CMHIVE extension for hivelist (and ot…
2017-07-19 20:43:05 +01:00
iMHLv2
770dba1f0a
use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr
2017-07-19 18:12:50 +00:00
iMHLv2
b9adcb2b87
move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future)
2017-07-19 17:10:49 +00:00
iMHLv2
cc8114e872
add the modules plugin for windows
2017-07-18 23:51:35 +00:00
iMHLv2
60e67a80d8
fix a misleading pydoc string in the hivelist plugin
2017-07-18 23:50:38 +00:00
iMHLv2
8493f4c4d6
add hivelist plugin for windows
2017-07-18 23:21:44 +00:00
Mike Auty
4838a17f24
Ensure that the framework plugins are always loaded.
2017-07-02 15:51:41 +01:00
Mike Auty
dd7ea07228
Rejig plugins and partially parse the command-line options to set a plugin path early.
2017-06-01 00:54:07 +01:00
Nick L. Petroni, Jr
8fcbf988b5
initial linux.pslist.PsList plugin
2017-05-14 22:24:05 -04:00
Mike Auty
60ded760b6
Add in a first draft of a Module and context.module call.
2017-04-21 21:50:26 +01:00
Mike Auty
b6b984503f
Fix up help messages for plugins.
2017-04-21 00:52:06 +01:00
Mike Auty
dcc558717c
Shift around the object_factory and add the symbol rebaser.
...
The object_factory is now a separate function, but to ease the
transition the object_factory method in Context has been left.
I'll most likely deprecate it before the full release, but I'm open the
idea of leaving it if someone can convince me it's a better decision.
2017-03-24 01:50:16 +00:00
Mike Auty
00f3b4fb44
Remove the error checking in dlllist, we need to be throwing exceptions and handling them.
2017-02-21 23:25:02 +00:00
iMHLv2
efd2468639
import modules rather than classes
2017-02-21 18:06:52 +00:00
iMHLv2
3cc70c1f1c
add windows dlllist plugin and accompanying extensions
2017-02-16 14:44:55 +00:00
Mike Auty
d6728fc2b4
Add in attributes and appropriate validation of TranslationLayers based on those attributes.
2017-02-10 13:57:44 +00:00
Mike Auty
9f4ea6da1f
Split the useful code out into a subfunction for reuse.
2017-01-19 16:20:11 +00:00
Mike Auty
7f887414cb
Clean up an unnecessary 'as' import.
2016-12-29 15:23:35 +00:00
Mike Auty
011b6dc3f4
Add in the object_factory capability and use it by example in pslist.
2016-12-25 19:02:48 +00:00
Mike Auty
183ff67699
Attach the kernel virtual offset to intel spaces.
2016-12-07 16:00:31 +00:00
Mike Auty
9af583d22e
Completely rework how pslist operates using the kernel_virtual_offset requirement.
2016-12-04 01:02:53 +00:00
Mike Auty
0b447b6958
Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying.
2016-10-26 01:09:29 +01:00
Mike Auty
ca61cf10b9
Refactor the context back into the ConfigurableInterface.
...
This also adds support for manually constructed configurables to
populate the config tree in the current context.
I'm still toying around with this though, I need to figure out
what to do with optional values and think the whole thing through
to make sure it's worthwhile.
2016-08-14 21:28:43 +01:00
Mike Auty
b92ccd771f
Fix up the DTB finder code and stick it all together.
2016-07-30 02:35:40 +01:00
Mike Auty
d3a226d7a8
Remove constraints as a thing, they'll need to come back, but in a different form.
2016-07-30 01:52:44 +01:00
Mike Auty