Commit Graph

  • 9af583d22e Completely rework how pslist operates using the kernel_virtual_offset requirement. Mike Auty 2016-12-04 01:02:53 +00:00
  • e1cc55aeed Add in wchar to our set of bases for x64 systems. Mike Auty 2016-12-04 01:02:17 +00:00
  • e27a444068 Very minimally fix up the docstring for a function. Mike Auty 2016-12-04 01:01:46 +00:00
  • 88f1166c6d Add in a helper function that will likely be useful in the future. Mike Auty 2016-12-04 01:01:13 +00:00
  • 23fd704027 Add in the kernel offset recursion code. Mike Auty 2016-12-04 01:00:37 +00:00
  • 9a3402ccff Fix the incorrect signature offset returned. Mike Auty 2016-12-03 21:39:04 +00:00
  • e4e563ead0 Fix up the array slicing code. Mike Auty 2016-12-03 00:23:00 +00:00
  • 70815b0837 Shift the location of the pdbscan prefix/suffix values. Mike Auty 2016-12-02 21:44:23 +00:00
  • ed552d20e8 Add in support for lzma compressed json data. Mike Auty 2016-12-02 01:34:07 +00:00
  • c86f0ddef4 Add in a very rudimentary kernel PDB finding plugin that identifies and automatically loads the appropriate kernel for the image. Mike Auty 2016-11-27 23:40:19 +00:00
  • b2c3c76954 Don't forget the fixes that still need to happen. Mike Auty 2016-11-19 23:41:35 +00:00
  • 72259008f3 Use the physical layer and improve the output. Mike Auty 2016-11-19 23:36:48 +00:00
  • d2fcc1d4b0 Add in optimization technique to reduce the number of pages that are scanned more than once. Mike Auty 2016-11-19 23:34:08 +00:00
  • c9abd290ec Remove an unnecessary test from the intel scan loop. Mike Auty 2016-11-19 18:05:41 +00:00
  • 38b1c61acc Remove debugging values from the pdb scanner. Mike Auty 2016-11-18 17:18:50 +00:00
  • 3c181e940e Tidy up to use a single method for reading from the context. Mike Auty 2016-11-18 17:18:30 +00:00
  • f707c0c4e9 Add in first shot at an 'efficient' virtual memory scanner. Uses page misses to calculate skipping distances. Mike Auty 2016-11-18 17:14:48 +00:00
  • 096e2f4610 Make the paged exceptions more useful at knowing how big an area is unavailable. Mike Auty 2016-11-18 11:40:48 +00:00
  • f688af529b Initial commit of pdb kernel scanning automagic code. Mike Auty 2016-11-18 11:39:55 +00:00
  • ab9c0860c8 Update the schema validator toy to include debugging information. Mike Auty 2016-11-07 12:37:24 +00:00
  • 96800818af Show exceptions as debugging information when failed to validate, and allow disabling of cache. Mike Auty 2016-11-07 12:36:53 +00:00
  • 399e63d344 Update the schema so that bitfields can only be built on a base type. Mike Auty 2016-11-07 12:35:11 +00:00
  • 2f91cf32b7 Make the schema a little more strict. Mike Auty 2016-11-07 12:26:34 +00:00
  • 282eaa7f00 Improve/remove unnecessary imports. Mike Auty 2016-11-07 12:26:06 +00:00
  • 62fb752c82 Add in validation caching for JSON schema use and only record success when actual validation occurs. Mike Auty 2016-11-07 01:17:08 +00:00
  • 96a7a56edd Commit the initial JSON schema for the intermediate format. Mike Auty 2016-11-06 01:48:01 +00:00
  • 7b12483719 Change version to format and move the delegate function factory outside of the class. Mike Auty 2016-11-06 01:33:51 +00:00
  • f0c6b0d1a4 Merge branch 'master' of github.com:volatilityfoundation/volatility3 Mike Auty 2016-11-04 18:09:04 +00:00
  • 2dba1bbddd Update wording to clarify the different between package version and interface version. Mike Auty 2016-11-04 17:56:58 +00:00
  • 11d60b9f7f Update the accepted format version. Mike Auty 2016-11-03 01:03:38 +00:00
  • 28fdbbe348 Refactor the pdb names, to make the class more generic. Mike Auty 2016-11-03 00:53:08 +00:00
  • df2172754c Refactor the pdbscanning code so it doesn't sneak into the library accidentally. Mike Auty 2016-11-01 23:32:12 +00:00
  • d6039fb899 Initial port of npetroni's pdbscanner (with bugfix for multiple RDRS entries in a single scan chunk). Mike Auty 2016-11-01 02:06:08 +00:00
  • d57733d530 Add in support for format versioning. Mike Auty 2016-11-01 01:33:44 +00:00
  • dc375024b2 Set the version back, given we're early enough to do so. Mike Auty 2016-11-01 00:02:10 +00:00
  • 667014a1fd Attempt to standardize error message display. Mike Auty 2016-10-30 17:51:45 +00:00
  • f771de3703 Tidy up error messages. Mike Auty 2016-10-30 17:07:48 +00:00
  • d1b58143fe Add in UnresolvedTemplate type. Mike Auty 2016-10-30 16:54:12 +00:00
  • 287baeb03a Add in rudimentary symbol support to the intermediate format. Mike Auty 2016-10-26 01:49:52 +01:00
  • 6f1bdcb6cb Refactor symbol.offset to symbol.address. Mike Auty 2016-10-26 01:42:37 +01:00
  • 6b405383c4 Refactor targets to subtypes. Mike Auty 2016-10-26 01:24:58 +01:00
  • 50f5a5ddb7 Fix up broken vtypes that looks like it might never have worked. Mike Auty 2016-10-26 01:16:25 +01:00
  • 5f0ceff4d2 Fix up the broken vtypes conversion by translating between the names. Mike Auty 2016-10-26 01:16:07 +01:00
  • 0b447b6958 Initial implementation of the Intermediate Format, breaks the vtypes format and needs a lot of tidying. Mike Auty 2016-10-26 01:09:29 +01:00
  • ea9ff20ca0 The sorted function requires a keyword argument for the key. Mike Auty 2016-10-04 09:43:55 +01:00
  • bfcc6661c7 Sort by largest pointer size found during self-referential searches. Mike Auty 2016-10-01 23:04:21 +01:00
  • d232be2f6e Try to update the generic dtb finder to rule out false positives. Mike Auty 2016-10-01 22:13:42 +01:00
  • 1a83470993 Convert dtbfinder to a standalone app. Mike Auty 2016-09-25 19:33:04 +01:00
  • 824ad5b143 Add in the LimeStacker, and fix the lack of appropriate information on LimeLayer creation. Mike Auty 2016-08-26 08:35:09 +01:00
  • 37dcbb88b0 Rework lime to use the new layer constructor, and factor out the header check. Mike Auty 2016-08-26 08:30:22 +01:00
  • fbe3682592 Allow stack functions to return None as a failure response. Mike Auty 2016-08-26 08:29:45 +01:00
  • eb9b2dcb79 Reduce the number of input variables need for the vol test CLI still to run. Mike Auty 2016-08-24 01:32:06 +01:00
  • 32bdeafa8a Improve the stacker to append the generated stack configuration into the original context. Mike Auty 2016-08-24 01:31:45 +01:00
  • 721d5ade3f Give the LowestLayer a proper name in the interim configs, and ensure it's in the stack. Mike Auty 2016-08-24 01:30:32 +01:00
  • 04b760ee3e Increase the priority so this is always run first, and we're going to use the requirement variable. Mike Auty 2016-08-24 01:29:53 +01:00
  • 9959697ba5 Move where the rescursion into TranslationLayers happens. Mike Auty 2016-08-24 01:29:11 +01:00
  • f3bc1d30b3 Refactor the build_configuration in Layers so that even data layers get their requirements populated. Mike Auty 2016-08-24 01:14:34 +01:00
  • 4d7701be66 Fix the config printer to sort the values. Mike Auty 2016-08-24 01:13:38 +01:00
  • 6b47b992a7 Ensure splice requirement perpetuates down the HierarchicalDict. Mike Auty 2016-08-24 01:13:20 +01:00
  • 341ae950b8 Ensure configurations do not include any generated values (ie TranslationLayer/SymbolLayer names) Mike Auty 2016-08-24 01:12:43 +01:00
  • 01616af655 Remove comment, it's already been converted. Mike Auty 2016-08-24 01:11:46 +01:00
  • ab1ebeafc4 Update the test rig with the signficant changes that were just made. Mike Auty 2016-08-22 02:38:25 +01:00
  • 546bca1893 Rename the IntelHelper to make it a little more accurate. Mike Auty 2016-08-22 02:28:20 +01:00
  • 3a07d6810b Add in a reminder for additional work required. Mike Auty 2016-08-22 02:27:13 +01:00
  • 3dc161f9b4 Rework Translation Layers to tie more closely to configurations Mike Auty 2016-08-22 02:20:10 +01:00
  • d3e63fbc1a Rename update_configuration to build_configuration and return a standalone config. Mike Auty 2016-08-22 02:18:23 +01:00
  • a1b9be74c7 Refactor several configuration/requirement structures to avoid import loops. Mike Auty 2016-08-22 02:15:54 +01:00
  • eb5e3f69de Ensure we're not importing sub-imports from something else. Mike Auty 2016-08-22 02:01:31 +01:00
  • c5139ba568 Stop exposing the config_path for now, and fix the version that's passed in the construction phase. Mike Auty 2016-08-22 00:36:58 +01:00
  • f48ee5ff33 Add in the actual stacking automagic. Mike Auty 2016-08-22 00:06:04 +01:00
  • 05d3da602f Remove splice as too dangerous (and hopefully unnecessary). Mike Auty 2016-08-22 00:05:05 +01:00
  • 7648c94083 Add in the intial works at a stacking plugin to emulate volatility 2 address space stacking. Mike Auty 2016-08-22 00:00:21 +01:00
  • dc16d93b77 Alter the config.path_join function to remove empty sections. Mike Auty 2016-08-21 21:47:45 +01:00
  • e54505701f Refactor Memory into an interface. Mike Auty 2016-08-21 21:26:21 +01:00
  • 386e8a34c7 Minor clean-up. Mike Auty 2016-08-21 21:23:29 +01:00
  • e173c7c080 Squashed commit of the following: Nick L. Petroni, Jr 2016-08-20 14:12:37 -04:00
  • f0cf128bdd Add in the self-referential tests to the standalone component of the windows automagic module. Mike Auty 2016-08-20 16:55:32 +01:00
  • c38d650819 Add in generic self-referential tests. Mike Auty 2016-08-20 16:54:04 +01:00
  • 77f295f0a4 Calculate the pointer size, rather than taking it as an argument. Mike Auty 2016-08-20 16:53:36 +01:00
  • 2467917431 Fix up DTB Finder which was broken in commit eccfb1c2. 5:S Mike Auty 2016-08-20 14:16:02 +01:00
  • fbf5eb6309 Remove other unnecessary files and drop the templates, but use the static files. Mike Auty 2016-08-20 13:21:47 +01:00
  • 2bf92be628 Remove unnecessary elements imported with the python3 doc theme. Mike Auty 2016-08-20 13:10:20 +01:00
  • 31b6d84e58 Add in python3 documentation theme files and convert to using those. Mike Auty 2016-08-20 12:07:08 +01:00
  • 84f64a2394 doc: auto-generate files and cleanup syntax Nick L. Petroni, Jr 2016-08-18 17:01:09 -04:00
  • 2bd12b834f Fix minor breakage from the previous reordering of parameters. Mike Auty 2016-08-17 23:25:08 +01:00
  • 6712d5dee1 Update the automagic uses to ensure a consistent ordering of the arguments. Mike Auty 2016-08-17 20:38:18 +01:00
  • 0fd0fa0d55 Fix up the comment to match the acceptance of returning objects other than just offsets. Mike Auty 2016-08-17 20:05:23 +01:00
  • 462295fc4b Ensure lime is properly imported, so that its classes get picked up by the plugin system. Mike Auty 2016-08-16 10:55:27 +01:00
  • db21d4628c Rework importing of interfaces, a little more verbose in the code, but a little less complex to import and name. Mike Auty 2016-08-16 10:54:57 +01:00
  • ca61cf10b9 Refactor the context back into the ConfigurableInterface. Mike Auty 2016-08-14 21:28:43 +01:00
  • ce16d60eaf Add a warning about the dangers of splicing. Mike Auty 2016-08-14 21:27:13 +01:00
  • 9111f13a8a Get rid of obsolete fulfillment method (now handled by _construct_class in ConstructableRequirementInterface). Mike Auty 2016-08-14 11:44:18 +01:00
  • 8089a03f81 Convert the private file attribute to a property to allow for cloning. Mike Auty 2016-08-14 01:09:36 +01:00
  • e02feed16e Python 3 has a sane super() implementation (no arguments), so convert to using that. Mike Auty 2016-08-14 00:55:02 +01:00
  • 523e159047 Add in convenience functions for working with the configuration and context. Mike Auty 2016-08-14 00:32:22 +01:00
  • 303ca04a5a Remove the (emtpy) fileformat file in preparation for a dataformat version. Mike Auty 2016-08-14 00:30:25 +01:00
  • c6b60a0035 Add in more error checking on the automagic routine. Mike Auty 2016-08-14 00:28:20 +01:00
  • c160698465 Add in comment concerning when the dtb finder fails. Mike Auty 2016-08-01 00:39:49 +01:00
  • cb1b226bbb Fix an obvious typo. Mike Auty 2016-07-30 18:38:12 +01:00
  • 8fc925a920 Remove the obsolete generic scan (it was only generic for 64-bit register size). Mike Auty 2016-07-30 18:38:03 +01:00