Commit Graph

  • 5ef65d6d38 Remove the ntkrnlmp name and use ntsymbols instead. Mike Auty 2017-11-01 21:23:44 +00:00
  • c1f16c412f Add in boolean option fix. Mike Auty 2017-10-23 17:11:36 +01:00
  • 28036c9405 Add in the ability to recurse keys (off by default). Mike Auty 2017-10-23 17:11:15 +01:00
  • 5d2b0f9004 Add in support for determining if a key is volatile. Mike Auty 2017-10-23 17:09:25 +01:00
  • f085c9d2e3 Use a _CELL_DATA directly, rather than the eronious construction of a _CM_CACHED_VALUE_INDEX. Mike Auty 2017-10-09 01:41:08 +01:00
  • c09ce60f73 Support the new HMAP_ENTRY structure for Win10. Mike Auty 2017-10-09 01:40:37 +01:00
  • 3f70ee92be Improve the debugging output for unknown registry node signatures. Mike Auty 2017-10-09 00:54:02 +01:00
  • 587b6e9d9e Add back in the deprecated helper for _CMHIVE. Mike Auty 2017-10-09 00:20:32 +01:00
  • d6235325f9 Make changes according to the deprecations. Mike Auty 2017-10-09 00:13:40 +01:00
  • 957fa23af2 Move the registry plugin to an appropriate location. Mike Auty 2017-10-08 16:57:11 +01:00
  • 930c8a2e08 Make the registry test plugin work with keys and offset parameters. Mike Auty 2017-10-08 16:51:58 +01:00
  • a12246a423 Shift the order of the columns. Mike Auty 2017-10-08 16:37:38 +01:00
  • b8f545633d Ensure we do logging rather than printing. Mike Auty 2017-10-08 16:37:22 +01:00
  • 6c0d98ba1b Improve registry value handling. Mike Auty 2017-10-08 16:29:04 +01:00
  • 4fb24985eb Add in standard registry walking to the regtest plugin. Mike Auty 2017-10-08 01:46:05 +01:00
  • 023598a582 Additional improvements to the registry layer and cell/node handling. Mike Auty 2017-10-07 18:30:19 +01:00
  • 042ff5ca25 Use .vol.count for consistency. Mike Auty 2017-09-19 10:12:29 +01:00
  • 38b6e12ec5 Minor changes to the testrig. Mike Auty 2017-09-18 23:30:12 +01:00
  • fadb421331 Improve the support for signatures of cells. Mike Auty 2017-09-18 23:29:27 +01:00
  • 757837633f Make sure we don't lose volatile bit for members. Mike Auty 2017-09-18 23:28:23 +01:00
  • 7a093ad4c4 Move the registry types to their own location. Mike Auty 2017-09-18 23:25:30 +01:00
  • 0f1e84139f Remove the extra regtest plugin. Mike Auty 2017-09-18 21:11:18 +01:00
  • 27e5dbfcc6 Add in testing plugin temporarily. Mike Auty 2017-09-17 23:10:17 +01:00
  • 19d66bd063 Add in current work in progress. Mike Auty 2017-09-17 23:09:52 +01:00
  • f538319d7c Add a little more code to the registry layer. Mike Auty 2017-06-24 23:46:01 +01:00
  • 5a30ef3708 Start adding in some code for reading the registry. Mike Auty 2017-06-23 23:17:13 +01:00
  • 30fc62e11c Add in fallbacks for legacy code. Mike Auty 2017-10-09 00:18:00 +01:00
  • ef5d21ea7c Refactor the names given the new deprecation. Mike Auty 2017-10-09 00:05:50 +01:00
  • 334412330c Ensure offsets are appropriately prefixed, given we can now support accepting 0x### numbers. Mike Auty 2017-10-09 00:02:03 +01:00
  • 8dc6401ad8 Add in gentle deprecation warnings about non-helper properties to prevent member confusion. Mike Auty 2017-10-08 23:02:13 +01:00
  • 624289b94d Drop out the NlpDtbfinder from the linux plugins, since the LayerStacker should sort it. Mike Auty 2017-10-08 20:24:24 +01:00
  • ae9e33292f Add in restrictions on automagics should be used for each type of plugin. Mike Auty 2017-10-08 20:22:10 +01:00
  • 74c2a47d7f Support reading strings to determine the base automatically (such as 0x### for hex). Mike Auty 2017-10-08 16:52:23 +01:00
  • 42579ca619 Allow subtypes for array_of_pointers to be strings. Mike Auty 2017-10-05 00:30:16 +01:00
  • 06767bd44c Ensure we get a warning of some kind when a bad scheme is provided. Mike Auty 2017-10-05 00:13:45 +01:00
  • 5fbc90e699 Add in utility function for recasting objects as array of pointers of objects. Mike Auty 2017-10-05 00:10:02 +01:00
  • 88fa13bbdd Allow count to be specified as a parameter. Mike Auty 2017-10-04 22:21:29 +01:00
  • 6523364c90 Add a validate method to all objects to allow for (optional) validation of data on construction. Mike Auty 2017-09-22 09:57:01 +01:00
  • fea912baaa Change the InvalidDataException to include the object that threw the validation error. Mike Auty 2017-09-22 09:56:22 +01:00
  • 393d657d6f Add exception for data validation. Mike Auty 2017-09-21 21:23:20 +01:00
  • 71cfec18a6 Add commentary around a potential conflict of method with property. Mike Auty 2017-09-20 09:38:28 +01:00
  • 5261da780b Allow the size of array to be changed (may override an existing count member). Mike Auty 2017-09-18 23:23:23 +01:00
  • 255228ecb0 Convert to abc (post python-3.3). Mike Auty 2017-09-18 23:22:08 +01:00
  • 46ed044774 Improve the schema validation tool. Mike Auty 2017-09-17 19:51:45 +01:00
  • 7db811fa09 Move nlpdtbscanner's stack order lower down since it isn't accurate for linux (and was tried before it previously). Mike Auty 2017-09-05 11:00:51 +01:00
  • 946fbd5e61 Use the convenience function built for exactly this circumstance. Mike Auty 2017-09-04 01:26:40 +01:00
  • 6c6d0473a1 Fixed table names will no longer work since tables are prefix-named. Mike Auty 2017-09-03 23:17:40 +01:00
  • 0599ec8f36 Slightly improve potential error condition. Mike Auty 2017-09-03 23:17:07 +01:00
  • 710043f508 Fix up the ASLR finding to compensate for older task_struct structures. Mike Auty 2017-09-03 23:16:22 +01:00
  • e90b4e2d02 Add and make use of free_table_name for symbol_spaces. Mike Auty 2017-09-03 22:54:42 +01:00
  • a4bb32d797 Rework the linux automagic to include utility functions for finding the ASLR and KASLR shifts. Mike Auty 2017-09-03 21:50:53 +01:00
  • 6265fc4e2d Catch errors if the stacker didn't manage to stack correctly. Mike Auty 2017-08-31 01:04:01 +01:00
  • 9346e220ed Add more detailed information for non-threaded scanners. Mike Auty 2017-08-31 01:02:42 +01:00
  • e09ad9b884 Make the automagic progress a little easier to understand. Mike Auty 2017-08-31 00:23:41 +01:00
  • 9b835b1baf Remove excess windows volshell local variables. Mike Auty 2017-08-29 23:55:34 +01:00
  • f40665f1b7 Split volshell into windows and base/os-agnostic versions. Mike Auty 2017-08-29 23:54:11 +01:00
  • cdf64ae08e Add in initial implementation, currently with windows specific bits. Mike Auty 2017-08-29 01:06:46 +01:00
  • aa87c87a22 Remove the additional import that was entirely my fault being there in the first place. Mike Auty 2017-08-16 21:40:58 +01:00
  • 8698328654 Merge pull request #10 from npetroni/linux-proc-maps ikelosandGitHub 2017-08-16 21:39:15 +01:00
  • 59b9645b04 Import linux so we don't need to subimport it everywhere we need to use it. Mike Auty 2017-08-16 21:34:37 +01:00
  • c4e6b07ee0 refactored constants.linux usage Nick L. Petroni, Jr 2017-08-16 16:30:12 -04:00
  • 5bb2aef9fc Created linux.proc.Maps plugin. Nick L. Petroni, Jr 2017-08-16 00:00:21 -04:00
  • efc2d75a86 Ensure that other constant modules are imported. Mike Auty 2017-08-16 14:28:43 +01:00
  • 91fdc2166e Don't forget to fix up the path move. Mike Auty 2017-08-15 01:10:38 +01:00
  • 6b24dd1d03 Convert constants to a module in preparation for pull request #9. Mike Auty 2017-08-15 01:07:01 +01:00
  • eeeda60bfb A couple more small documentation updates. Mike Auty 2017-08-11 19:30:39 +01:00
  • 2954d7433f Improve documentation and ordering. Mike Auty 2017-08-11 19:29:37 +01:00
  • e434909e50 Make SymbolTable.symbols consistent with enumerations and types. Mike Auty 2017-08-11 19:25:13 +01:00
  • f7f1c1d5e0 Raise the right kind of exception in Intermediate Format SymbolTables. Mike Auty 2017-08-11 08:49:49 +01:00
  • c6724a538a Initial support for compressed files. Mike Auty 2017-08-11 01:12:50 +01:00
  • efdd961313 Prevent exceptions if there are no linux symboltables. Mike Auty 2017-08-11 00:05:50 +01:00
  • a008686c20 Reduce the logging level of the Pdbscan automagic. Mike Auty 2017-08-10 23:58:34 +01:00
  • c336a39695 Fix up the Char type (struct.unpack returns a bytes, not a string). Mike Auty 2017-08-10 20:44:21 +01:00
  • 570a2d35be Make the DllList import a little more sensible/consistent. Mike Auty 2017-08-10 10:07:57 +01:00
  • c19ad1cb22 Placeholder change to ensure even if we don't change it to a from statement, it isn't bizarre. Mike Auty 2017-08-10 10:03:39 +01:00
  • ab5f4fa3ab Refactor the List and Choice Requirements Mike Auty 2017-08-09 22:44:06 +01:00
  • d32fc223e2 Fix up additional imports inconsistent with the coding style. Mike Auty 2017-08-09 22:32:44 +01:00
  • 8be6869a84 Tidy up imports and adhere to the coding style of never directly importing objects. Mike Auty 2017-08-09 22:22:43 +01:00
  • bfb83f0c33 Fix up silly typo (and replace another hardcoded bang). Mike Auty 2017-08-09 21:34:26 +01:00
  • 9c3ad5588a Improve the error handling the LinuxSymbolCache. Mike Auty 2017-08-09 18:06:35 +01:00
  • ce89564f71 Merge branch 'master' of github.com:volatilityfoundation/volatility3 Mike Auty 2017-08-08 17:45:52 +01:00
  • f0d7dbdf68 Add in translate method for TranslationLayers. Mike Auty 2017-08-08 17:45:36 +01:00
  • fc0fa96ed8 Replace hardcoded exclamation marks for constants.BANG Mike Auty 2017-08-08 09:50:22 +01:00
  • 2caeeb275e First stab at refactoring the add_process_layer code out of the Windows _EPROCESS structure. Mike Auty 2017-08-07 21:42:10 +01:00
  • ab8d76eeef Revert the generator changes, the visiting function should be used instead. Mike Auty 2017-08-02 10:40:16 +01:00
  • d8c53b63bf Don't forget to iterate over the populate generator. Mike Auty 2017-08-02 10:05:12 +01:00
  • ff3d5e8f3b Maintain a row count for populated tree grids. Mike Auty 2017-08-01 15:39:38 +01:00
  • 029fa8e940 Ensure ColumnSortKey is callable, and make sure the top level direction is considered. Mike Auty 2017-08-01 15:39:01 +01:00
  • 80508c8711 Allow for ascending or descending sort order. Mike Auty 2017-08-01 02:41:55 +01:00
  • 5e9b2306d4 Ensure symbol tables are created with unique names. Mike Auty 2017-07-31 16:34:02 +01:00
  • d119f372dc Ensure the populate generator is actually a generator. Mike Auty 2017-07-31 13:52:54 +01:00
  • b8f7433dba Ensure that non-multiprocessing does not use multiprocessing. Mike Auty 2017-07-30 22:40:33 +01:00
  • 9c8add5d5c Ensure the dtb is not uninitialized. Mike Auty 2017-07-30 21:10:12 +01:00
  • b7c8c8a058 Improve the docstrings for automagic. Mike Auty 2017-07-29 12:53:35 +01:00
  • 775ece3cb2 Convert the 'ntkrnlmp' requirement into an 'nt' requirement. Mike Auty 2017-07-24 15:43:34 +01:00
  • 8ad9fbfd24 Ensure imported plugins have their correct requirements fulfilled (even if they change). Mike Auty 2017-07-24 15:41:47 +01:00
  • 4b0515aa65 Fix up the logging so there are five standard levels, and list the cache location. Mike Auty 2017-07-24 01:39:29 +01:00
  • d34b344507 Ensure linux doesn't bog down windows searching. Mike Auty 2017-07-20 19:54:10 +01:00
  • c0a8ddd9a3 Improve the progress messages. Mike Auty 2017-07-20 19:35:12 +01:00
  • 0b6e50daba Convert pdbscanner to a generator. Mike Auty 2017-07-20 17:47:21 +01:00