Commit Graph

  • eccfb1c247 Conver the individual tests to the scanner framework, and work that into the automagic. Mike Auty 2016-07-30 18:20:14 +01:00
  • 0a0054e30a Make the logging a bit clearer and remove the print statement. Mike Auty 2016-07-30 02:41:26 +01:00
  • b92ccd771f Fix up the DTB finder code and stick it all together. Mike Auty 2016-07-30 02:35:40 +01:00
  • 43aba96e3f Minor pylint (alphabetical imports) and refactoring the construct class to work for symbols. Mike Auty 2016-07-30 01:58:29 +01:00
  • 1c3521cf64 Give construct_layers a forcably low priority, it's important. Mike Auty 2016-07-30 01:54:42 +01:00
  • 710214fffd Refactor automagics so that the UI can control which ones run. Mike Auty 2016-07-30 01:53:29 +01:00
  • d3a226d7a8 Remove constraints as a thing, they'll need to come back, but in a different form. Mike Auty 2016-07-30 01:52:44 +01:00
  • 7661d2ce52 Remove errant debugging statements. Mike Auty 2016-07-30 00:42:46 +01:00
  • 8db3adae05 Update the scanner interface to return all kind of objects. Mike Auty 2016-07-30 00:38:53 +01:00
  • 32b0b073ce Remove unnecessary components after all the refactoring. Mike Auty 2016-07-30 00:37:24 +01:00
  • f8c3019165 Refactor requirements to expose the name ordering for quicker lookups. Mike Auty 2016-07-29 03:28:02 +01:00
  • 14c0cc262c Significantly rework the configuration system. Mike Auty 2016-07-29 03:00:06 +01:00
  • 2ae251b803 Remove argparse attempt until we're ready to bring it back. Mike Auty 2016-07-29 02:58:01 +01:00
  • b63f07f493 Rework the imports to make the intel layers easier to read. Mike Auty 2016-07-29 02:57:10 +01:00
  • bb2dd859d5 Refactor the get_schema call to make more sense. Mike Auty 2016-07-29 02:36:56 +01:00
  • 4f17143fd3 Add in proper logging statements. Mike Auty 2016-07-29 02:35:07 +01:00
  • 25bbbe0937 Refactor the way that plugins are imported for use on other modules (such as the upcoming automagic). Mike Auty 2016-07-28 21:29:53 +01:00
  • 8c6354e013 Document the ScannerInterface to make its use clearer. Mike Auty 2016-07-05 17:09:36 +01:00
  • b470ff3715 Recent changes affect the API (layer.mapping and InvalidAddressException) so get in the habit of bumping the version. Mike Auty 2016-07-02 16:30:44 +01:00
  • be54ea0dda Fix minor docstring typo. Mike Auty 2016-07-02 16:24:17 +01:00
  • 90fa5574b4 Add in the initial scanning framework. Mike Auty 2016-07-02 15:49:00 +01:00
  • c626bebb59 Convert mapping to a generator rather than a list. It must still return in sorted order. Mike Auty 2016-07-02 15:48:09 +01:00
  • fc34850345 Implement mapping with ignore_errors to get a (sorted) list of valid chunks in a layer. Mike Auty 2016-07-02 15:39:36 +01:00
  • 46190e37a9 Fix padding error in base read function. Mike Auty 2016-07-02 15:30:40 +01:00
  • 98fff4616c Add in linted spacing by pycharm. Mike Auty 2016-07-02 14:55:52 +01:00
  • 8c6e7918ee Fix up one missing exception change. Mike Auty 2016-07-02 14:53:41 +01:00
  • 5290baf73d Make InvalidAddress exceptions more useful. Mike Auty 2016-07-02 13:31:36 +01:00
  • 14e8346730 Merge branch 'master' of github.com:volatilityfoundation/volatility3 Mike Auty 2016-07-02 12:34:19 +01:00
  • 0c56c494ae Support saving/loading configs to a (JSON) string. Mike Auty 2016-07-02 12:34:09 +01:00
  • 58b0f2ef4a Merge pull request #1 from npetroni/lime-rebased ikelos 2016-05-26 22:43:27 +01:00
  • 02f26e7829 lime.py: improve check -- empty lists evaluate to False Nick L. Petroni, Jr 2016-05-26 09:24:36 -04:00
  • 2686487e6f lime.py: first working version Nick L. Petroni, Jr 2016-05-26 06:44:09 -04:00
  • f9a950bb39 added LIME translation layer Nick L. Petroni, Jr 2016-05-25 20:52:46 -04:00
  • 633225edb2 Minor reformatting by pycharm for line length. Mike Auty 2016-05-26 09:14:37 +01:00
  • 472132e574 Clarify and verify that the memory_layer parameter is the name of the memory layer, not the layer itself. Mike Auty 2016-05-26 09:14:09 +01:00
  • d882f93fee Move the length check, and require a non-zero length to protect is_valid. Mike Auty 2016-05-22 19:23:15 +01:00
  • 9faa13820a Since we're a forensics program, make sure we only read unless we know the user REALLY wants to write. Mike Auty 2016-05-22 19:21:24 +01:00
  • 16bed2aa94 Allow specifying a table_name for get_symbols_by_location. Mike Auty 2016-05-22 16:02:30 +01:00
  • e0b7f0b5f0 Add in helper functions for symbolspaces/symboltables to locate specific symbols. Mike Auty 2016-05-22 15:28:12 +01:00
  • fea6e0820a Convert to using a BANG variable for the symbol name delimiter. Mike Auty 2016-05-22 15:26:31 +01:00
  • 34b81a5265 Add in Unions Mike Auty 2016-05-22 12:03:46 +01:00
  • 659bfc1670 Add in Symbol class to properly represent programming symbols. Mike Auty 2016-05-22 11:54:44 +01:00
  • 2d23c93def Completely refactor constants and structures to symbols and types. Mike Auty 2016-05-22 11:41:54 +01:00
  • 7a62e74996 Refactor the translation method out of the TranslationLayer, since it's not always applicable/useful. Contemplate a rename of the TranslationLayer now it doesn't actually translate. 5;) Mike Auty 2016-04-10 11:54:32 +01:00
  • 8e49c66049 Ensure we don't find bogus DTBs, but do still allow non-usr-count DTBs. Mike Auty 2016-02-27 14:11:40 +00:00
  • 9fce3a4b1f Tidy up the tests and add a bit of error checking to the dtb finder. Mike Auty 2016-02-27 11:53:44 +00:00
  • b06306f884 Fix reducing the tuple mid sorting. Mike Auty 2016-02-27 01:50:38 +00:00
  • 445031c880 Unfix the self-referential checker. Mike Auty 2016-02-27 01:43:03 +00:00
  • 29e75339df Fix the self-referential checker again. Mike Auty 2016-02-27 01:40:01 +00:00
  • dbcb59e0e9 Fix the self-referential checker. Mike Auty 2016-02-27 01:38:29 +00:00
  • 8ab1dedd44 Change the output to hide the ordering data, and fix up the standalone tool a little bit. Mike Auty 2016-02-26 20:36:57 +00:00
  • afd28575ca Re-check constraints when building the tree, in case they change. Also comment on why we don't use that when trimming the possibilties for windows automagic. Mike Auty 2016-02-25 22:03:49 +00:00
  • d6cc66cb77 Add in self referential checker, should windows change what it does. Mike Auty 2016-02-23 10:16:27 +00:00
  • 1fd8eecebd Ensure we take into account ignored/NX bits when DTB finding. Mike Auty 2016-02-23 10:15:50 +00:00
  • 9dbae9b84a Update for PAE image, rather than a second intel image. This one's private though. Mike Auty 2016-02-22 09:18:03 +00:00
  • 61d45c2c36 Add another demonstration image with handily the same system process offset, to demonstrate selecting PAE or 32bit. Mike Auty 2016-02-22 01:54:53 +00:00
  • 644a028ee4 Fix up the dtbfinder output a little. Mike Auty 2016-02-22 01:54:19 +00:00
  • 7ba06d0448 If we've tried scanning for the DTB, and we don't find in other arches, remove them as possibilities. Mike Auty 2016-02-22 01:47:09 +00:00
  • 187325f74e Convert the dtbfinding code into a standalone tool and remove the dtbfinder.py. Mike Auty 2016-02-22 01:46:36 +00:00
  • ff11f27c75 Fix up the automagic dtb finder to visit internal tree nodes, and to set the right variable! Mike Auty 2016-02-22 01:05:50 +00:00
  • 0298df3569 Convert visitors to HierarchicalVisitors, keeping a stack of children's results for the dependency resolver. Mike Auty 2016-02-22 01:05:16 +00:00
  • ba9eb0716a Make output on requirement nodes a little more readable. Mike Auty 2016-02-22 01:03:41 +00:00
  • bacc8c5539 Move to a HierarchicalVisitor pattern. Mike Auty 2016-02-22 01:02:29 +00:00
  • a123572701 Add in debugging tools for the dependency tree. Mike Auty 2016-02-21 01:24:34 +00:00
  • 665ba8946b Fix a logic error in the resolver that meant it might not visit every node. Mike Auty 2016-02-21 01:19:42 +00:00
  • c6a3c2d6b1 Add in the automagic and allow mid-deptree resolution (without trying to re-fulfill already populated requirements). Mike Auty 2016-02-21 00:42:04 +00:00
  • 9d7e777c28 Fix up the validity class and enable short_circuiting. Mike Auty 2016-02-21 00:17:44 +00:00
  • 01ac22bac2 Ensure that the success or failure does not affect the ability for a visitor to change the shortcircuiting. Mike Auty 2016-02-20 23:35:16 +00:00
  • a9ff081da5 Fix a few bugs and re-add a visitor pattern for traversing the tree. Mike Auty 2016-02-20 23:01:41 +00:00
  • 71b540f6db Draft up a system to tag the configuration tree with useful information based on the context so far. Mike Auty 2016-02-20 21:36:12 +00:00
  • 1e8c55bfdd Remove all the visitor pattern stuff, that's likely to bloat rather than help. Mike Auty 2016-02-20 21:35:31 +00:00
  • ba2083fc7c Refactor the RequirementTreeNode to put it in the interfaces file. Mike Auty 2016-02-20 21:35:05 +00:00
  • da7774ee92 Refactor and add in a node type for multiple requirements. Lays the groundwork for the hierarchical visitor pattern. Mike Auty 2016-02-20 20:19:36 +00:00
  • eab75146db Document the tests a little better. Mike Auty 2016-02-17 09:12:17 +00:00
  • 8d27260662 Apply initial attempt at an algorithm to narrow down to the DTB to the most privileged process (the top level table with the least user-accessible subchildren). Mike Auty 2016-02-16 10:51:22 +00:00
  • 35e2c4a247 Add in rudimentary string support for pslist, consider changing it to user an obejct_class rather than casting. Mike Auty 2016-02-14 02:51:48 +00:00
  • d7aefdce28 Add a comment explaining why we don't truncate strings on \x00. Mike Auty 2016-02-14 02:50:37 +00:00
  • 0ef389dec9 Tidy up Bytes and String to require all the appropriate parameters. Mike Auty 2016-02-14 02:49:28 +00:00
  • 86526fa9ad Separate out the object_info to make debugging easier in future. Mike Auty 2016-02-14 01:43:28 +00:00
  • 9c1dbf88e2 Change Bytes to not require a struct_format, since we generate it from the length parameter. Mike Auty 2016-02-14 01:43:09 +00:00
  • 9c9183feb2 API change: Alter cast to accept object parameters rather than inheriting (which usually will be wrong). Mike Auty 2016-02-14 01:40:25 +00:00
  • a8828d7185 Add Strings and Bytes to the native structure code. Mike Auty 2016-02-13 17:18:23 +00:00
  • a1f127940d Fix up the test_rig to work with a previous API change. Mike Auty 2016-02-13 17:17:45 +00:00
  • 34b8671ce3 Refactor basic to extensions for windows additions. Mike Auty 2016-02-13 17:17:10 +00:00
  • 66e526ab66 Do all the DTB checks in one pass. Mike Auty 2016-02-11 20:53:46 +00:00
  • 3fbc78b38c Fix up the renderer (and stop masking issues by printing in the generator). Mike Auty 2016-02-11 09:23:58 +00:00
  • d37163d881 Add in python minimum requirement checks. Mike Auty 2016-02-10 07:35:04 +00:00
  • 89252b8bef Get rid of potential DTBs with bad page bits (still need to find out what those mean). Mike Auty 2016-02-09 21:09:54 +00:00
  • a9ddf61e49 Push new DTB finder tests for pae, 32bit and 64bit. Mike Auty 2016-02-09 20:35:47 +00:00
  • 370a49a267 Add in a trivial renderer for testing the output system. Mike Auty 2016-02-09 10:14:53 +00:00
  • bca8dc486d Allow sequences rather than just lists for TreeGrid yields. Mike Auty 2016-02-09 10:14:13 +00:00
  • 85487b4a02 Add in initial efforts at x64 dtb finding using the self-referential pointer. Mike Auty 2016-02-09 00:20:55 +00:00
  • 03cb131260 Add a priority ordering for testing layers (high priority trumps lower priority). Mike Auty 2016-01-21 00:06:39 +01:00
  • a3d685c93a Ensure layers aren't provided more parameters than they need (in case the parameters were meant for a different potential provider. Mike Auty 2016-01-16 22:20:42 +00:00
  • 139a6b610e Add in an appropriate requirement for BufferLayers. Mike Auty 2016-01-16 22:20:10 +00:00
  • f197b43346 Tidy up the requirements and fudge the code to use only the virtual address space for now. Mike Auty 2016-01-16 22:02:20 +00:00
  • 211bbbe5f6 Ensure that symbol space providers correctly provision the space. Mike Auty 2016-01-16 22:00:56 +00:00
  • 590304ed1f Improve debugging in the dependency resolver. Mike Auty 2016-01-16 22:00:16 +00:00
  • 78cd3c84c0 Add in a NativeSymbolTable validator. Mike Auty 2016-01-16 21:38:00 +00:00
  • 84815d204e Refactor and clarify exactly what the dependency resolver's doing. Mike Auty 2016-01-16 21:05:24 +00:00