 gleeda
|
b21f34d138
|
removing uneeded code
|
2014-06-25 17:50:07 -04:00 |
|
|
gleeda
|
975165cc58
|
adding a 32bit pointer object. we need this in order to use 32bit pointers on 64bit systems
|
2014-06-25 17:39:50 -04:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
mike.auty@gmail.com
|
fab28bfd7d
|
Fix typo in infrequently used dependency code, see issue 410.
|
2013-04-18 19:04:53 +00:00 |
|
|
iMHLv2
|
eb23bbbeec
|
replace the obj.Profile.metadata decorators from classproperty/classmethod to just property. this makes profiles objects/instances whose metadata can change dynamically, as is required for setting mac major/minor versions
|
2013-04-04 03:49:45 +00:00 |
|
|
iMHLv2
|
c9db15bc05
|
revert some accidental changes introduced in r3296
|
2013-04-04 02:42:42 +00:00 |
|
|
iMHLv2
|
975d20ee0c
|
change the number of arguments convert.py takes from 4 to 3. the 4th argument does nothing
|
2013-04-04 02:34:47 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
mike.auty@gmail.com
|
d6bf3b6837
|
Revert "Minor pylint."
This reverts commit 851653bf948b5035df112ee81afb7d792987fd45.
|
2012-10-17 00:15:40 +00:00 |
|
|
mike.auty@gmail.com
|
cbe9a3357b
|
Minor pylint.
|
2012-10-16 23:54:46 +00:00 |
|
|
iMHLv2
|
cf87e729cf
|
mask the upper bits for all 64 bit pointers. change the KDBG.PsActiveProcessHead and KDBG.PsLoadedModuleList to pointers to _LIST_ENTRY instead of usnsigned long long so the list heads will be truncated as well
|
2012-08-10 16:35:51 +00:00 |
|
|
mike.auty@gmail.com
|
c20ea55646
|
Catch InvalidOffsetErrors gracefully. Fixes issue 280.
|
2012-07-08 13:16:33 +00:00 |
|
|
mike.auty@gmail.com
|
6887750a98
|
Print the reason for a NoneObject in the NoneObject representation itself.
|
2012-07-01 16:27:17 +00:00 |
|
|
mike.auty@gmail.com
|
18a6841950
|
Ensure NoneObjects always display as strings, no matter the input format code.
|
2012-07-01 16:27:09 +00:00 |
|
|
mike.auty@gmail.com
|
ea4c153baa
|
Add a note to allow VolatilityMagic objects to be proxied when they're numeric.
|
2012-06-10 12:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
c44e9dda4c
|
Now that we're testing non-equality as not equality, rather than object address similarity, we need to make sure we can handle objects that aren't equal (like None).
|
2012-06-04 17:09:02 +00:00 |
|
|
mike.auty@gmail.com
|
1c84b7bf22
|
Add in testing fix for issue 265, converting integers to longs to reduce integer boundary issues.
|
2012-06-03 18:12:59 +00:00 |
|
|
mike.auty@gmail.com
|
c2c48f4fe0
|
Add in the complementary __ne__ operator for __eq__ in BaseObjects. This will not affect anything inheritted from NativeTypes, so the only changes should be != comparisons for arrays and CType objects.
|
2012-05-26 10:01:25 +00:00 |
|
|
mike.auty@gmail.com
|
3c59274c6a
|
Revert "cast native types to int() before bitmasking in Pointer.__eq__. see issue #148"
This reverts commit 9decc3540f5fdca754c5621cbf238f70e48726a7.
|
2012-05-25 22:26:19 +00:00 |
|
|
iMHLv2
|
8e5e28b2e1
|
cast native types to int() before bitmasking in Pointer.__eq__. see issue #148
|
2012-05-25 15:43:52 +00:00 |
|
|
mike.auty@gmail.com
|
1a78b0bdf3
|
Move FormatSpec in preparation of making more use of it.
|
2012-05-22 08:25:52 +00:00 |
|
|
mike.auty@gmail.com
|
2e8090cd56
|
Revert issue190 changes mistakenly applied to trunk.
|
2012-05-19 14:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
a49566ec5c
|
Move FormatSpec in preparation of making more use of it.
|
2012-05-19 14:38:08 +00:00 |
|
|
iMHLv2
|
ce2aab1f2d
|
mask upper 16 bits in Pointer.__eq__. patch kpcrscan for x64 profiles. fixes issue #184.
|
2012-05-08 23:13:38 +00:00 |
|
|
mike.auty@gmail.com
|
9f36c32f6f
|
Fix a subtle pointer check that wasn't using the native_vm.
|
2012-03-21 10:19:05 +00:00 |
|
|
mike.auty@gmail.com
|
8d9f367011
|
Make the NoneObject string warnings easier to identify.
|
2012-03-21 09:40:09 +00:00 |
|
|
mike.auty@gmail.com
|
4513238497
|
Allow lookups on pointers to lookup on the dereferenced object.
|
2012-03-19 21:57:34 +00:00 |
|
|
mike.auty@gmail.com
|
e5c2571bf7
|
Ensure writes to ctype members don't raise an exception even after they succeeded.
|
2012-03-12 00:20:21 +00:00 |
|
|
mike.auty@gmail.com
|
883e05d96c
|
Enable individual writing of array elements.
|
2012-03-12 00:20:08 +00:00 |
|
|
mike.auty@gmail.com
|
f9326d1619
|
Fix up array indexing to accept negative positions.
|
2012-03-12 00:20:02 +00:00 |
|
|
mike.auty@gmail.com
|
e5aa86d908
|
Merge branch 'local/noregistry' into local/trunk
|
2012-03-08 23:39:19 +00:00 |
|
|
mike.auty@gmail.com
|
691738f55d
|
Add in slight fix when using the deprecated add_types function, since merge_overlays can't merge a raw vtypes dictionary.
|
2012-03-05 22:10:14 +00:00 |
|
|
mike.auty@gmail.com
|
20acde45bd
|
Add in abstract function for ProfileModifications, to make the code more explicit.
|
2012-02-29 20:58:30 +00:00 |
|
|
iMHLv2
|
fedf32fd7a
|
expose BaseObject._vol_theType through BaseObject.obj_type. see issue #216
|
2012-02-22 14:35:18 +00:00 |
|
|
mike.auty@gmail.com
|
a5c61cf540
|
Add in better coments regarding the profile cyclic dependency.
|
2012-02-20 22:47:38 +00:00 |
|
|
mike.auty@gmail.com
|
e3e089b096
|
Merge the newprofile branch into trunk.
|
2012-02-18 10:33:47 +00:00 |
|
|
mike.auty@gmail.com
|
f65aad2b9a
|
Move from __getattribute__ to __getattr__ for speed and simplicity reasons.
|
2012-01-23 14:26:46 +00:00 |
|
|
mike.auty@gmail.com
|
ab55aab699
|
Fix up indenting in obj,py.
|
2012-01-21 11:29:59 +00:00 |
|
|
mike.auty@gmail.com
|
217fa6e682
|
Allow for object aliasing, as used in KTHREAD.ServiceTable = self.spare0. I'm concerned this may get abused horribly in the future, but I can only hope that it won't...
|
2012-01-20 17:50:34 +00:00 |
|
|
mike.auty@gmail.com
|
77c26c721b
|
Rework handles to remove large VolatilityMagic tables, and tidy up unnecessary structures (_OBJECT_HEADER_NAME_INFORMATION).
|
2012-01-20 04:58:53 +00:00 |
|
|
iMHLv2
|
02a1cddf7a
|
fix a bad format() bug in obj.py when instantiating NoneObject
|
2012-01-09 04:11:31 +00:00 |
|
|
mike.auty@gmail.com
|
c71e3b7be4
|
Add in a default memory_model for profiles.
|
2012-01-04 20:53:20 +00:00 |
|
|
mike.auty@gmail.com
|
7b22e259c2
|
Not sure how this crept bad in, looks like I made a bad commit.
|
2012-01-02 17:40:46 +00:00 |
|
|
mike.auty@gmail.com
|
4bd5bab0e1
|
Since dereferencing may be using a different AS now (native_vm), we should check that the offset's valid.
|
2012-01-01 01:19:22 +00:00 |
|
|
mike.auty@gmail.com
|
602353c533
|
Consolidate the dereference_as functions, and pylint one line.
|
2012-01-01 01:19:11 +00:00 |
|
|
mike.auty@gmail.com
|
a2771c5e4c
|
Rename nativevm to native_vm to improve readability and fix muscle-memory typos.
|
2011-12-30 15:37:51 +00:00 |
|
|
mike.auty@gmail.com
|
1a567aa284
|
Fix typo made in the recent nativevm patch.
|
2011-12-29 19:52:35 +00:00 |
|