Skip to content

Latest commit

 

History

History
146 lines (115 loc) · 3.51 KB

API_CHANGES.md

File metadata and controls

146 lines (115 loc) · 3.51 KB

API Changes

When an addition to the existing API is made, the minor version is bumped. When an API feature or function is removed or changed, the major version is bumped.

2.25.0

Pointer class now supports get_raw_value(). KTIMER no longer supports get_raw_dpc().

2.24.0

Support encoding parameter for objects.utility.array_to_string

2.23.0

Add support for windows GUI classes and OS distinguishers. Add a symbol_table_name for ExecutiveObject.get_object_header()/

2.22.0

Linux net constants added. Network objects moved to separate versionable module.

2.21.0

uuid method added to linux.extensions.

2.20.0

NM_TYPES_DESC constants added to linux. latch_tree_root and kernel_symbol added to linux extensions. Linux module class additions:

  • get_module_address_boundaries
  • section_typetab Linux task_struct class additions:
  • get_address_space_layer
  • state Linux bpf_prog class additions:
  • bpf_jit_binary_hdr_address

2.19.0

Introduction of Modules versionable linux extension module. Deprecation of some LinuxUtilities functions relating to modules.

2.18.0

Addition of scatterlist linux extension.

2.17.0

The addition of a types member to SymbolInterface

2.16.0

Addition of TAINT_FLAG constants, TaintFlag dataclass Addition of linux tainting versionable module

2.15.0

Addition of convert_fourcc_code to LinuxUtilities class

2.14.0

No significant changes (part of the 2.16.0 PR which took time in development)

2.13.0

Linux task object extension addition of getppid

2.12.0

Changes to the Intel layer to support PROT_NONE pages.

2.11.0

Addition of get_type method to windows CM_KEY_NODE registry structure

2.10.0

No significant API changes (CLI changes to the JSONL text renderer)

2.9.0

No significant API changes (change to call linux.LinuxUtilities.get_module_from_volobj_type to get the kernel)

2.8.0

Addition of the BinOrAbsent, HexOrAbsent, HexBytesOrAbsent and MultiTypeDataOrAbsent data type renderers

2.7.0

Addition of is_valid, get_create_time and get_exit_time to ETHREAD structure

2.6.0

No significant changes (again, the version got bump twice in the PR straight to 2.7.0)

2.5.0

Add in support for specifying a type override for object_from_symbol

2.4.0

Add a get_size() method to Windows VAD structures and fix several off-by-one issues when calculating VAD sizes.

2.3.1

Update in the windows _EPROCESS.owning_process method to support Windows Vista and later versions.

2.3.0

Add in child_template to template class

2.2.0

Changes to linux core calls

2.1.0

Add in the linux task.get_threads method to the API.

2.0.3

Add in the windows DEVICE_OBJECT.get_attached_devices and DRIVER_OBJECT.get_devices methods to the API.

2.0.2

Fix the behaviour of the offsets returned by the PDB scanner.

2.0.0

Remove the symbol_shift mechanism, where symbol tables could alter their own symbols. Symbols from a symbol table are now always the offset values. They can be added to a Module and when symbols are requested from a Module they are shifted by the module's offset to get an absolute offset. This can be done with Module.get_absolute_symbol_address or as part of Module.object_from_symbol(absolute = False, ...).

1.2.0

  • Added support for module collections
  • Added context.modules
  • Added ModuleRequirement
  • Added get_symbols_by_absolute_location