Refactored scanners to use a common interface for selection of scanning regions.

Refactored scanners to use a common interface for selection of scanning regions.

* Added typed argument parsing for plugins.

* Fixes for the netscan plugin - it was not showing the Owner field properly since it did not switch to the kernel's profile.

R=amoser@google.com

Committed: 7af9fc4645f202712e3a9ac0512330bba1c98d06

[scudette, 2016-04-29 06:26:13]

Started to refactor the scanner framework to use a common scanner class which
controls the scanning regions. All scanning plugins now can control exactly
which kind of address spaces to scan.

Also added a simple yara scanner which just scans the physical address space.
This helps when we dont have a profile.

[amoser, 2016-04-30 00:06:51]

LGTM

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/common/search.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/common/search.py:267: with renderer.start():
This looks a bit weird to me, "with" should already imply that you want to
"start".

This is maybe not for this CL I feel it would be better to have only one
starting point, __enter__. What do you think?

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/guess_profile.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/guess_profile.py:400: KERNEL_PATH =
[r"C:\Windows\SysNative\ntoskrnl.exe",
PATHS now?

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/windows/common.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/windows/common.py:672: start=0, end=2**64,
Should this constant come from self.session.kernel_address_space.end()?

[scudette, 2016-05-02 23:50:31]

Committed patchset #5 (id:80001) manually as
7af9fc4645f202712e3a9ac0512330bba1c98d06 (presubmit successful).

[scudette, 2016-05-03 00:33:46]

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/common/search.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/common/search.py:267: with renderer.start():
On 2016/04/30 00:06:51, amoser wrote:
> This looks a bit weird to me, "with" should already imply that you want to
> "start".
> 
> This is maybe not for this CL I feel it would be better to have only one
> starting point, __enter__. What do you think?

I think either will work actually but the bare "with" semantics does not allow
to pass any parameters like plugin name and kwargs:

with renderer:
    ....

The main renderer which uses this is the json renderer which can be started and
stopped multiple time in order to run several plugins in a row (this is done in
GRR).

Alternatively we could just call renderer.start() but then we must remember to
call renderer.end() which the __exit__() does for us.

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/guess_profile.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/guess_profile.py:400: KERNEL_PATH =
[r"C:\Windows\SysNative\ntoskrnl.exe",
On 2016/04/30 00:06:51, amoser wrote:
> PATHS now?

Done.

This is mainly here to support acquisition with winpmem because that is a 32 bit
program so it stores the kernel in sysnative instead.

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
File rekall-core/rekall/plugins/windows/common.py (right):

https://codereview.appspot.com/299810043/diff/40001/rekall-core/rekall/plugin...
rekall-core/rekall/plugins/windows/common.py:672: start=0, end=2**64,
On 2016/04/30 00:06:51, amoser wrote:
> Should this constant come from self.session.kernel_address_space.end()?

Done.