 mike.auty@gmail.com
|
d6bf3b6837
|
Revert "Minor pylint."
This reverts commit 851653bf948b5035df112ee81afb7d792987fd45.
|
2012-10-17 00:15:40 +00:00 |
|
|
mike.auty@gmail.com
|
cbe9a3357b
|
Minor pylint.
|
2012-10-16 23:54:46 +00:00 |
|
|
iMHLv2
|
cf87e729cf
|
mask the upper bits for all 64 bit pointers. change the KDBG.PsActiveProcessHead and KDBG.PsLoadedModuleList to pointers to _LIST_ENTRY instead of usnsigned long long so the list heads will be truncated as well
|
2012-08-10 16:35:51 +00:00 |
|
|
mike.auty@gmail.com
|
c20ea55646
|
Catch InvalidOffsetErrors gracefully. Fixes issue 280.
|
2012-07-08 13:16:33 +00:00 |
|
|
mike.auty@gmail.com
|
6887750a98
|
Print the reason for a NoneObject in the NoneObject representation itself.
|
2012-07-01 16:27:17 +00:00 |
|
|
mike.auty@gmail.com
|
18a6841950
|
Ensure NoneObjects always display as strings, no matter the input format code.
|
2012-07-01 16:27:09 +00:00 |
|
|
mike.auty@gmail.com
|
ea4c153baa
|
Add a note to allow VolatilityMagic objects to be proxied when they're numeric.
|
2012-06-10 12:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
c44e9dda4c
|
Now that we're testing non-equality as not equality, rather than object address similarity, we need to make sure we can handle objects that aren't equal (like None).
|
2012-06-04 17:09:02 +00:00 |
|
|
mike.auty@gmail.com
|
1c84b7bf22
|
Add in testing fix for issue 265, converting integers to longs to reduce integer boundary issues.
|
2012-06-03 18:12:59 +00:00 |
|
|
mike.auty@gmail.com
|
c2c48f4fe0
|
Add in the complementary __ne__ operator for __eq__ in BaseObjects. This will not affect anything inheritted from NativeTypes, so the only changes should be != comparisons for arrays and CType objects.
|
2012-05-26 10:01:25 +00:00 |
|
|
mike.auty@gmail.com
|
3c59274c6a
|
Revert "cast native types to int() before bitmasking in Pointer.__eq__. see issue #148"
This reverts commit 9decc3540f5fdca754c5621cbf238f70e48726a7.
|
2012-05-25 22:26:19 +00:00 |
|
|
iMHLv2
|
8e5e28b2e1
|
cast native types to int() before bitmasking in Pointer.__eq__. see issue #148
|
2012-05-25 15:43:52 +00:00 |
|
|
mike.auty@gmail.com
|
1a78b0bdf3
|
Move FormatSpec in preparation of making more use of it.
|
2012-05-22 08:25:52 +00:00 |
|
|
mike.auty@gmail.com
|
2e8090cd56
|
Revert issue190 changes mistakenly applied to trunk.
|
2012-05-19 14:42:45 +00:00 |
|
|
mike.auty@gmail.com
|
a49566ec5c
|
Move FormatSpec in preparation of making more use of it.
|
2012-05-19 14:38:08 +00:00 |
|
|
iMHLv2
|
ce2aab1f2d
|
mask upper 16 bits in Pointer.__eq__. patch kpcrscan for x64 profiles. fixes issue #184.
|
2012-05-08 23:13:38 +00:00 |
|
|
mike.auty@gmail.com
|
9f36c32f6f
|
Fix a subtle pointer check that wasn't using the native_vm.
|
2012-03-21 10:19:05 +00:00 |
|
|
mike.auty@gmail.com
|
8d9f367011
|
Make the NoneObject string warnings easier to identify.
|
2012-03-21 09:40:09 +00:00 |
|
|
mike.auty@gmail.com
|
4513238497
|
Allow lookups on pointers to lookup on the dereferenced object.
|
2012-03-19 21:57:34 +00:00 |
|
|
mike.auty@gmail.com
|
e5c2571bf7
|
Ensure writes to ctype members don't raise an exception even after they succeeded.
|
2012-03-12 00:20:21 +00:00 |
|
|
mike.auty@gmail.com
|
883e05d96c
|
Enable individual writing of array elements.
|
2012-03-12 00:20:08 +00:00 |
|
|
mike.auty@gmail.com
|
f9326d1619
|
Fix up array indexing to accept negative positions.
|
2012-03-12 00:20:02 +00:00 |
|
|
mike.auty@gmail.com
|
e5aa86d908
|
Merge branch 'local/noregistry' into local/trunk
|
2012-03-08 23:39:19 +00:00 |
|
|
mike.auty@gmail.com
|
691738f55d
|
Add in slight fix when using the deprecated add_types function, since merge_overlays can't merge a raw vtypes dictionary.
|
2012-03-05 22:10:14 +00:00 |
|
|
mike.auty@gmail.com
|
20acde45bd
|
Add in abstract function for ProfileModifications, to make the code more explicit.
|
2012-02-29 20:58:30 +00:00 |
|
|
iMHLv2
|
fedf32fd7a
|
expose BaseObject._vol_theType through BaseObject.obj_type. see issue #216
|
2012-02-22 14:35:18 +00:00 |
|
|
mike.auty@gmail.com
|
a5c61cf540
|
Add in better coments regarding the profile cyclic dependency.
|
2012-02-20 22:47:38 +00:00 |
|
|
mike.auty@gmail.com
|
e3e089b096
|
Merge the newprofile branch into trunk.
|
2012-02-18 10:33:47 +00:00 |
|
|
mike.auty@gmail.com
|
f65aad2b9a
|
Move from __getattribute__ to __getattr__ for speed and simplicity reasons.
|
2012-01-23 14:26:46 +00:00 |
|
|
mike.auty@gmail.com
|
ab55aab699
|
Fix up indenting in obj,py.
|
2012-01-21 11:29:59 +00:00 |
|
|
mike.auty@gmail.com
|
217fa6e682
|
Allow for object aliasing, as used in KTHREAD.ServiceTable = self.spare0. I'm concerned this may get abused horribly in the future, but I can only hope that it won't...
|
2012-01-20 17:50:34 +00:00 |
|
|
mike.auty@gmail.com
|
77c26c721b
|
Rework handles to remove large VolatilityMagic tables, and tidy up unnecessary structures (_OBJECT_HEADER_NAME_INFORMATION).
|
2012-01-20 04:58:53 +00:00 |
|
|
iMHLv2
|
02a1cddf7a
|
fix a bad format() bug in obj.py when instantiating NoneObject
|
2012-01-09 04:11:31 +00:00 |
|
|
mike.auty@gmail.com
|
c71e3b7be4
|
Add in a default memory_model for profiles.
|
2012-01-04 20:53:20 +00:00 |
|
|
mike.auty@gmail.com
|
7b22e259c2
|
Not sure how this crept bad in, looks like I made a bad commit.
|
2012-01-02 17:40:46 +00:00 |
|
|
mike.auty@gmail.com
|
4bd5bab0e1
|
Since dereferencing may be using a different AS now (native_vm), we should check that the offset's valid.
|
2012-01-01 01:19:22 +00:00 |
|
|
mike.auty@gmail.com
|
602353c533
|
Consolidate the dereference_as functions, and pylint one line.
|
2012-01-01 01:19:11 +00:00 |
|
|
mike.auty@gmail.com
|
a2771c5e4c
|
Rename nativevm to native_vm to improve readability and fix muscle-memory typos.
|
2011-12-30 15:37:51 +00:00 |
|
|
mike.auty@gmail.com
|
1a567aa284
|
Fix typo made in the recent nativevm patch.
|
2011-12-29 19:52:35 +00:00 |
|
|
mike.auty@gmail.com
|
7df6910986
|
Move across the obj.py changes that didn't make it from the svn rebase.
|
2011-12-29 13:50:11 +00:00 |
|
|
mike.auty@gmail.com
|
40ad0e59ae
|
Convert _vol_offsetlayer into obj_nativevm.
|
2011-12-29 13:35:59 +00:00 |
|
|
mike.auty@gmail.com
|
c318153737
|
Add in the all-important proper VM for dereferencing as a different type.
|
2011-12-29 13:35:43 +00:00 |
|
|
mike.auty@gmail.com
|
a36b41dd84
|
Remove old _member support in favour of @property handling.
|
2011-12-29 13:25:32 +00:00 |
|
|
mike.auty@gmail.com
|
ad3d4fc6fe
|
Add in better NoneObject support, and return NoneObject for failed reads in intel/legacyintel. Fixes issue 57.
|
2011-12-19 23:02:10 +00:00 |
|
|
mike.auty@gmail.com
|
5215cbcf42
|
Add in scudette's fix for NoneObject strings, and clean out unused code/comments. Fixes issue 139.
|
2011-10-02 22:31:38 +00:00 |
|
|
mike.auty@gmail.com
|
b12ae5b0ad
|
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
|
2011-10-01 16:19:51 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|