 Mike Auty
|
3bab0af2fb
|
Add very minor optimizations of not reconstructing the long/longlong structures on each read, as suggested by bcostanzo in pull request #88.
|
2014-11-25 17:27:48 +00:00 |
|
|
iMHLv2
|
68819e930e
|
fix linux elf AS to not falsely trigger - by asserting on the number of runs
|
2014-10-14 13:52:22 -05:00 |
|
|
iMHLv2
|
3ac46e50e0
|
these address spaces don't need to define self.runs, that is done in AbstractRunBasedMemory
|
2014-09-18 00:55:19 -05:00 |
|
|
gleeda
|
be6055d879
|
fixing spaces
|
2014-08-15 17:00:43 -04:00 |
|
|
AAron Walters
|
e617e5fe0e
|
read_long_long_phys: check to make sure addr is not None: Issue #53
|
2014-08-04 12:15:24 -04:00 |
|
|
AAron Walters
|
c7dd766250
|
Added a new address space to support Win8 Bitmap crash files
|
2014-08-03 15:42:47 -04:00 |
|
|
AAron Walters
|
ed6e9c858c
|
Added a new assertion to filter unsupported types (win8)
|
2014-08-03 15:30:39 -04:00 |
|
|
iMHLv2
|
ef2619ee77
|
make all run based address spaces writeable. without it, the higher level support in IA32, IA32PAE, and AMD64 for writing has no effect
|
2014-07-06 16:19:52 -05:00 |
|
|
iMHLv2
|
fa3a6618d3
|
Revert "make the virtual box and qemu address spaces writeable"
This reverts commit fe7f87d59c.
|
2014-07-06 16:15:10 -05:00 |
|
|
iMHLv2
|
fe7f87d59c
|
make the virtual box and qemu address spaces writeable
|
2014-07-06 14:35:00 -05:00 |
|
|
iMHLv2
|
9a9815c9e7
|
closes #9 remove the CR dependency on vmware metadata files
|
2014-06-19 16:45:44 -05:00 |
|
|
iMHLv2
|
9235aa226d
|
two small patches to vmware meta address space and vmwareinfo
|
2014-06-17 15:10:45 -05:00 |
|
|
iMHLv2
|
bc2ecc48ce
|
better fixes to the hpak extract / decompress function
|
2014-06-16 12:27:31 -05:00 |
|
|
iMHLv2
|
7d09076cc8
|
update hpakextract plugin
|
2014-06-09 22:53:49 +01:00 |
|
|
Andrew
|
791ac1b373
|
Mac - make pmem address space check run after coredump ones
|
2014-04-27 03:03:17 -05:00 |
|
|
Andrew
|
c5f806bec7
|
Mac - add support for osxpmems elf format
|
2014-04-27 03:00:13 -05:00 |
|
|
Andrew C
|
e65de417f1
|
Mac - remove macho vtype info from macho address space file
|
2014-04-25 22:42:55 -05:00 |
|
|
Andrew C
|
b4f8af0dff
|
Mac - remove redundant vtype
|
2014-04-25 20:14:18 -04:00 |
|
|
iMHLv2
|
8d69390eff
|
update the VMware address space names to better reflect their purpose
|
2014-03-13 23:26:21 -05:00 |
|
|
iMHLv2
|
35d6bdbc22
|
fix the vmdm paths on windows
|
2014-03-13 22:57:14 -05:00 |
|
|
iMHLv2
|
9bf62c7420
|
extend VMEMAddressSpace to support vmsn
|
2014-03-13 19:06:09 -05:00 |
|
|
iMHLv2
|
e028dad6f4
|
fixing the vmware split address space
|
2014-03-13 18:57:59 -05:00 |
|
|
iMHLv2
|
a9975dd286
|
add the first draft of Sebastien Bourdon-Richard's vmware vmem/vmss split address space
|
2014-03-11 10:48:36 -05:00 |
|
|
iMHLv2
|
bb1fd5aada
|
fix some invalid assertions in the vmware address space (is not None vs != None) which caused the AS to appear successful when it really failed. also make get_tag a static method so it can be easily accessed from other AS
|
2014-03-11 10:48:17 -05:00 |
|
|
iMHLv2
|
f51cdaeae3
|
extend support of the qemu address space to elf32 core dumps...involves adding elf32_note to the linux types
|
2014-03-11 10:43:23 -05:00 |
|
|
iMHLv2
|
0c4a5e1d4b
|
replace vboxelf with elfcoredump, it now supports qemu elf core dumps as well. thanks to Espen Olsen and Justin Capella
|
2014-03-10 22:16:36 -05:00 |
|
|
iMHLv2
|
80d0640449
|
Fixed large memory PAE bug that was reintroduced during address space cleanup.
Thanks to Steven Adair for the bug report and test samples.
|
2014-03-10 14:57:15 -05:00 |
|
|
iMHLv2
|
79042c90a0
|
Add new generic-elf api, update vboxelf to work with it, add linux_library_list
https://github.com/iMHLv2/voldb/commit/04477c868e28307995fde709a6ad54395
b006366
|
2014-01-17 19:28:20 -06:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
58c9574e22
|
sync with 2.3.1 from trunk
|
2013-10-31 11:06:08 -04:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
5541b6fc68
|
catch overflow error in FileAddressSpace.read - win8 PDE points back within the same page, pulls incorrect value
|
2013-10-07 18:33:48 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
7ec287b705
|
Cleaned up stale references to unused/deprecated functionality for cacheing page tables
|
2013-10-24 14:06:09 +00:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
atcuno
|
8c25507f69
|
Linux - switch a minor status information from debug.warning to debug.debug in arm.py
|
2013-09-25 15:45:40 +00:00 |
|
|
iMHLv2
|
e7e70c0e8e
|
small update to the patch started in r3486
|
2013-09-23 16:02:37 +00:00 |
|
|
iMHLv2
|
f10cfa6238
|
prevent a backtrace when trying to zread a file address space whose address is invalid. we can't call len() on None
|
2013-09-23 15:51:58 +00:00 |
|
|
awalters
|
61568df6f4
|
Added extra checks for NoneObjects and negative addresses. Fixes issue 427.
|
2013-06-12 17:25:11 +00:00 |
|
|
iMHLv2
|
5f1b1fe92f
|
the assertion in AbstractWritablePagedMemory.write() needs to be the same as AbstractDiscreteAllocMemory._read()
|
2013-05-29 13:39:09 +00:00 |
|
|
awalters
|
2fc448b7fa
|
This patch finishes the code clean up and consolidation started in r3405 and r3413 (no need for two intel address spaces).
|
2013-05-17 19:48:19 +00:00 |
|
|
iMHLv2
|
a759aa6ed2
|
Cleaning up and consolidating the IA32 and AMD64 address spaces
|
2013-05-14 20:21:18 +00:00 |
|
|
iMHLv2
|
2c25c71601
|
the paged.py file didn't make it in r3405
|
2013-05-13 18:08:27 +00:00 |
|
|
iMHLv2
|
948149037e
|
this patch changes inheritance with address spaces. amd64 and ARM no longer inherit from intel, which didn't make sense to begin with. vmware, virtualbox, and crash (and several others) are now run based address spaces instead of base address spaces. AS that are not purely virtual (like amd64 and intel) should not have a vtop(), rather we use a common translate(). patch mostly written by ikelos and aaron, tested by MHL
|
2013-05-13 14:33:43 +00:00 |
|
|
iMHLv2
|
61c9cf6e79
|
reorganize the logic in intel.py regarding skip_as_check and the valid AS check. it was breaking on mac process address space
|
2013-04-09 19:00:32 +00:00 |
|
|
iMHLv2
|
ae66d8a300
|
apply the Fail Closed/AMDValidAS patch
|
2013-04-09 14:14:55 +00:00 |
|
|
awalters
|
8795c76f16
|
Fixes issue 350
|
2013-04-08 22:10:22 +00:00 |
|
|
gleeda
|
a5ef83eb99
|
patch to imageinfo and hibernation file address space to default to zread on unreadable data
|
2013-04-08 20:24:53 +00:00 |
|
|
iMHLv2
|
6621c3a206
|
add the machoinfo plugin
|
2013-04-06 15:26:58 +00:00 |
|
|
iMHLv2
|
1deb080521
|
add zread and get_available_addresses to MachOAddressSpace, they're required for finding the DTB on 10.8 Mountain Lion
|
2013-04-04 23:24:49 +00:00 |
|