Commit Graph

  • b8fe2a96be Avoid a variable-reuse issue. Mike Auty 2017-07-20 11:58:16 +01:00
  • 14ae9db745 Improve the progress output. Mike Auty 2017-07-20 11:40:30 +01:00
  • 469afc800b Revert "Change the behaviour of multithreaded scans to return results as soon as possible (at the cost of ordering)." Mike Auty 2017-07-20 11:09:42 +01:00
  • f8767af1b8 Catch the most general InvalidAddressException in case it's thrown by a lower layer. Mike Auty 2017-07-20 00:58:07 +01:00
  • 8087f86bcf Remove debugging statements. Mike Auty 2017-07-20 00:51:03 +01:00
  • fbd70438a0 Slightly more error checking. Mike Auty 2017-07-20 00:49:56 +01:00
  • 03cdd91fbf Add in the capability to merge two config dicts (so that manually set settings aren't overwritten). Mike Auty 2017-07-20 00:49:36 +01:00
  • fe66301cf3 Merge pull request #8 from volatilityfoundation/mhl-cmhive ikelosandGitHub 2017-07-19 20:43:05 +01:00
  • 770dba1f0a use @property and update pydoc for _CMHIVE.name. catch AttributeError instead of checking hasattr iMHLv2 2017-07-19 18:12:50 +00:00
  • b9adcb2b87 move the hive name decision to _CMHIVE extension for hivelist (and other plugins in the future) iMHLv2 2017-07-19 17:10:49 +00:00
  • e2450a0458 Add in more debugging information. Mike Auty 2017-07-19 17:52:19 +01:00
  • a423b034a2 Merge pull request #7 from volatilityfoundation/mhl-modules ikelosandGitHub 2017-07-19 15:26:53 +01:00
  • cc8114e872 add the modules plugin for windows iMHLv2 2017-07-18 23:51:35 +00:00
  • 60e67a80d8 fix a misleading pydoc string in the hivelist plugin iMHLv2 2017-07-18 23:50:38 +00:00
  • 8493f4c4d6 add hivelist plugin for windows iMHLv2 2017-07-18 23:21:44 +00:00
  • edcfda0688 Change the stacking order, to ensure Lime gets loaded before linux. Mike Auty 2017-07-17 22:51:42 +01:00
  • d2eef99e37 Don't try making URIs into URIs. Mike Auty 2017-07-17 21:52:01 +01:00
  • 9f3470a8e9 Speed up linux caching by allowing lack of validation. This should NOT be enabled without knowing exactly what you're doing. Mike Auty 2017-07-17 21:42:58 +01:00
  • d49e956546 Improve file URL handling. Mike Auty 2017-07-17 18:33:45 +01:00
  • e152f929e0 Ensure we unquote the parse URL path when opening standard files. Mike Auty 2017-07-17 18:22:12 +01:00
  • f2bfd39c57 Add in more debugging information. Mike Auty 2017-07-17 17:17:46 +01:00
  • 23ccb4d4c8 Fix the real root cause, files not containing a banner. Mike Auty 2017-07-17 17:11:05 +01:00
  • 9b9792f3e2 Ensure we save the results of checking for non-existant files. Mike Auty 2017-07-17 17:06:52 +01:00
  • 5ca4f8e788 Use a central bit of code to do the load and unload of cached linux banners. Mike Auty 2017-07-17 16:38:25 +01:00
  • f6a55876d0 Add in check to avoid unsightly exceptions. Mike Auty 2017-07-17 16:19:36 +01:00
  • 8b95480e88 Write the cached linuxbanners after each one so that cancellations don't require re-runs. Mike Auty 2017-07-16 22:59:01 +01:00
  • 807b5dcaf0 Ensure we throw an appropriate error if there's no patterns available. Mike Auty 2017-07-16 22:52:56 +01:00
  • b68932a7bc Improve the linux DTB finding code. Mike Auty 2017-07-16 18:05:19 +01:00
  • d0b1177c31 Add in the linux signature scanner. Mike Auty 2017-07-16 18:05:08 +01:00
  • b099822ce2 Refactor requirement finding recursion since we use it a lot. Mike Auty 2017-07-16 18:04:22 +01:00
  • c4fbaf248e Max the number of hash buckets needed precise, and explicitly linked to the hash function. Mike Auty 2017-07-16 01:27:20 +01:00
  • f9375d0797 Reduce pointless memory usage, and remove old imports and debugging exception handlers. Mike Auty 2017-07-16 01:23:31 +01:00
  • 0ca78bc890 Add an efficient multi-string search module (based on Wu-Manber 1994). Mike Auty 2017-07-16 01:13:38 +01:00
  • 8c4bdc8c61 Change the behaviour of multithreaded scans to return results as soon as possible (at the cost of ordering). Mike Auty 2017-07-14 01:16:30 +01:00
  • 2b718f104d Remove imports that will break the code. Mike Auty 2017-07-14 01:15:52 +01:00
  • a4bb297db7 Improve the progress calculator for multithreaded progress. Mike Auty 2017-07-13 01:31:47 +01:00
  • a5e8d98a9c Refactor the location of the linux banner cache. Mike Auty 2017-07-13 01:31:19 +01:00
  • dd7c9d777a Refactor the scanners to allow for better organization. Mike Auty 2017-07-13 01:28:51 +01:00
  • 2453b7f180 Add a little information to the log to see when the cache is being built. Mike Auty 2017-07-10 01:24:52 +01:00
  • d1cdf805df Update the comments slightly. Mike Auty 2017-07-10 01:20:01 +01:00
  • 0811bdaa1a Add in initial version of linux banner cache mechanism. Mike Auty 2017-07-10 01:17:09 +01:00
  • 9127f1827f Carry out the base64 decoding when the symbol is constructed. Mike Auty 2017-07-10 00:06:17 +01:00
  • 8d4ccb846a Split out the JSON hashing function for reuse with other caching mechanisms. Mike Auty 2017-07-10 00:05:05 +01:00
  • d80fbf1a69 Fix validation typo preventing the newer symbols from properly working. Mike Auty 2017-07-10 00:04:29 +01:00
  • 4fb88c4636 Move the ISF validation caching to use ISF rather than IDF. Mike Auty 2017-07-10 00:03:04 +01:00
  • f12ab2a460 Move the symbol paths into the constants package. Mike Auty 2017-07-10 00:02:31 +01:00
  • 3a8e43a95a Doh, fix the schema from an earlier iteration. Mike Auty 2017-07-09 00:52:40 +01:00
  • f60901efb8 Don't forget to actually add the schema... Mike Auty 2017-07-09 00:51:08 +01:00
  • 5675942050 Add in symbol constant_data and bump the schema to 0.4.1. Mike Auty 2017-07-08 21:50:25 +01:00
  • 2850035825 Add in the mypy generated cache. Mike Auty 2017-07-02 17:58:20 +01:00
  • 1cfe64e786 Update and organize the gitignore file a bit. Mike Auty 2017-07-02 15:52:21 +01:00
  • 4838a17f24 Ensure that the framework plugins are always loaded. Mike Auty 2017-07-02 15:51:41 +01:00
  • c38210b8a5 Add the harness for using the nlpdtbfinder. Mike Auty 2017-07-01 23:16:00 +01:00
  • 2efbd3dd68 Ensure framework plugins are loaded just like non-framework plugins. Mike Auty 2017-07-01 22:22:43 +01:00
  • 8625343792 Add the ability to create 'hidden' classes. Mike Auty 2017-07-01 22:19:50 +01:00
  • a4c6c8bf55 Add in logging option to prevent creating example.log all the time. Mike Auty 2017-06-29 00:08:55 +01:00
  • ea8a721882 Add in ability to quieten the progress output (-q or --quiet). Mike Auty 2017-06-28 23:26:14 +01:00
  • d79d428edc Ensure we use the native dictionary for more recent IFF versions (and correct issues with pointers and chars). Mike Auty 2017-06-23 15:44:58 +01:00
  • e1c1981ed7 Fix up plugin argument help messages. Mike Auty 2017-06-20 17:44:59 +01:00
  • df527d2f00 Convert from abstractproperty which was deprecated in python-3.3. Mike Auty 2017-06-20 15:14:13 +01:00
  • d0ebeab253 Merge branch 'master' of github.com:volatilityfoundation/volatility3 Mike Auty 2017-06-05 23:01:34 +01:00
  • 5dedf00f64 Update the linux automagic based on the VMCOREINFO structure. Mike Auty 2017-06-05 23:01:22 +01:00
  • 761777c8ef Add commentary as to why we can't scan faster by ignoring surjective duplicates. Mike Auty 2017-06-03 20:57:19 +01:00
  • c05599d78a Minor clean-up of segmented layer. Mike Auty 2017-06-03 20:26:45 +01:00
  • b72c3aaed5 Handle invalid translations lower than the top layer when scanning. Mike Auty 2017-06-03 20:26:21 +01:00
  • 0675350346 Fix up minor logical error in multithreaded scanning global flag. Mike Auty 2017-06-03 17:49:56 +01:00
  • c862f38917 Add in flag to forcibly disable all multithreaded scanning. Mike Auty 2017-06-03 17:48:32 +01:00
  • 9a2bfe7c92 Remove unused variable. Mike Auty 2017-06-03 17:44:59 +01:00
  • 93a6efd666 Ensure we don't get name confusion when dealing with variables. Mike Auty 2017-06-03 17:44:13 +01:00
  • bc4c386d6d Fix a multiprocessing issue (and tidy away the kwargs). Mike Auty 2017-06-03 12:41:18 +01:00
  • fc325f8324 Ensure the pdb scanning heuristic works with 32-bit systems as well as 64-bit ones. Mike Auty 2017-06-01 23:52:30 +01:00
  • cb2430f661 Reshuffle the command line parameters in the help. Mike Auty 2017-06-01 01:01:39 +01:00
  • 904a5b18a3 Try to bomb out of the NlpDtbFinder if the space already has a dtb. Mike Auty 2017-06-01 01:00:49 +01:00
  • bcfc40acfe Fix egregious typo. 5:S Mike Auty 2017-06-01 00:56:40 +01:00
  • dd7ea07228 Rejig plugins and partially parse the command-line options to set a plugin path early. Mike Auty 2017-06-01 00:54:07 +01:00
  • 4e08d6e414 Merge branch 'master' of github.com:volatilityfoundation/volatility3 Mike Auty 2017-06-01 00:34:42 +01:00
  • 6e80303e0c Update pdbscanner to match the latest API. Mike Auty 2017-06-01 00:34:33 +01:00
  • 5a691f3d2b Merge pull request #6 from npetroni/linux-pslist-2017-05-14 ikelosandGitHub 2017-05-15 14:51:22 +01:00
  • 8fcbf988b5 initial linux.pslist.PsList plugin Nick L. Petroni, Jr 2017-05-14 22:24:05 -04:00
  • 5e15d522bd Remove automatic IDE-inserted attributions. Mike Auty 2017-05-14 11:40:49 +01:00
  • 17a3f1630c Add back in the masking, since it is important if maxmium_address is ever not 1 less than a power of 2. Mike Auty 2017-05-10 17:37:38 +01:00
  • a05a470347 Fix up some complete and utter daftness, tactfully pointed out by npetroni. Mike Auty 2017-05-10 17:30:45 +01:00
  • 4065cfa090 Add in first draft of Linux identification stacker. Mike Auty 2017-05-06 14:09:49 +01:00
  • 6da8076050 Add in Regular Expression scanner. Mike Auty 2017-05-06 14:02:09 +01:00
  • 16b1aca56b Make the WintelHelper documentation accurate again. Mike Auty 2017-05-06 10:56:21 +01:00
  • fe04c423ab Remove left-over debugging features that slowed down the NLP dtb finder. Mike Auty 2017-05-02 14:51:50 +01:00
  • d579f7f583 Add in a condensed version of Nick Petroni's DTB finder/stacker code. Mike Auty 2017-05-01 16:06:35 +01:00
  • 6e9791deb0 Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles. Mike Auty 2017-05-01 15:57:04 +01:00
  • 7e1965715d Ensure the pdbscanner can operate when not handed an appropriate intel layer. Mike Auty 2017-05-01 14:38:47 +01:00
  • de8508a8bb Reset the maxvirtaddr to use maxphyaddr just so we don't forget. Mike Auty 2017-05-01 14:35:22 +01:00
  • 44d8af70e0 Ensure we don't run the DTB finder twice. Mike Auty 2017-05-01 14:34:52 +01:00
  • e182e44815 Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables. Mike Auty 2017-04-30 22:09:26 +01:00
  • fdb386d714 Return more information when particular types cannot be looked up. Mike Auty 2017-04-29 15:03:20 +01:00
  • 029f6eca52 Fix up interface versioning issues. Mike Auty 2017-04-29 14:59:48 +01:00
  • 9ed403a463 Ensure the native table has an appropriate (and non-conflicting) table name. Mike Auty 2017-04-26 23:55:29 +01:00
  • 1ba5ce7560 Ensure we return a NativeTable rather than just the lookup dict. Mike Auty 2017-04-26 23:50:26 +01:00
  • f6214f9ce1 Don't try to add a void lookup, they're handled separately in the NativeTable. Mike Auty 2017-04-26 23:43:55 +01:00
  • 22dcea9451 Add in first draft of ISF version 3.0.0 support. Mike Auty 2017-04-26 21:38:42 +01:00
  • d0580236b1 Add in the schema version 3.0.0. Mike Auty 2017-04-26 20:51:03 +01:00
  • f520176b2b Move the wrapper out to stop it seeming like a method. Mike Auty 2017-04-26 15:01:49 +01:00