Mike Auty
64c139095f
Renderers: Add in very rudimentary renderer options
...
This allows the CLI to expose options that the renderers can offer.
These options are limited (string, int, bool and bytes), so no lists
or choices, etc.
Each renderer's options are also global options, meaning they're always
present (although grouped). There's two ways of handling this:
a) Prefix each option with the renderer's name, duplicate options are
unique
b) Deduplicate options with duplicate names and prefix 'renderer'
The current choice is a) because b) might confuse people that an option
which only applied to one renderer would be available for all, but
comes with the inconvenience that users must adapt the option name for
those that are duplicated with the same meaning.
This is at least functional and extendable in the future but still a bit
clunky. We could have brought the entire configuration mechanism into
play, but each renderer would require a context and a config_path and
so on, meaning massive overkill and a non-addition-only API change.
2020-11-01 22:51:39 +00:00
Mike Auty
1d8081e409
Plugins: Fix exception thrown in handles
...
Fixes #368
2020-11-01 14:50:48 +00:00
Mike Auty
e9c753cfc7
Automagic: Optimize windows layer construction
2020-11-01 00:11:34 +00:00
Mike Auty
46f6ee2eae
Automagic: Ensure progress percentages complete
2020-10-31 23:32:17 +00:00
Mike Auty
47ff37b07b
Plugins: Make layerwiter more configurable
...
This adds support for dumping multiple layers at once, listing available
layers and selects the highest non-mapped layer. Mapping is specified
in the metadata and currently is only applied to intel layers.
2020-10-31 23:30:22 +00:00
Mike Auty
dbd00b9759
Plugins: Fix paths read by isfinfo
2020-10-31 21:26:26 +00:00
Mike Auty
7a36628e48
Extensions: Meaningful error for failed inet_ntop
2020-10-31 11:47:38 +00:00
Mike Auty
31ff6ce482
Plugins: Bump isfinfo framework version
2020-10-30 16:11:35 +00:00
Mike Auty
c622ee4897
Plugins: Bump framework version for banners
2020-10-30 14:59:01 +00:00
Mike Auty
ea629591ef
Plugins: Make open method clearer to use
...
This highlights that the FileHandler class can also be seen as a method
similar to open, and it removes unnecessary context managers, allowing
plugins to close files as they wish (they must, however, remember to
close the file for it to be committed).
2020-10-29 09:43:16 +00:00
Mike Auty
0e596c2112
Windows: Minor additions based on the framework bump
2020-10-29 09:43:16 +00:00
Mike Auty
5e8788bb2d
Windows: Fix an issue from the rebase
2020-10-29 09:43:16 +00:00
Mike Auty
95d3de9317
Windows: Convert psscan to the new file interface
2020-10-29 09:43:16 +00:00
Mike Auty
29cb430a72
Codebase: Apply yapf clean-up across the codebase
2020-10-29 09:43:16 +00:00
Mike Auty
f58c115727
Windows: Fix up rebase issues
2020-10-29 09:43:16 +00:00
Mike Auty
375fc64773
Windows: Ensure the appropriate versions are correct
2020-10-29 09:43:16 +00:00
Mike Auty
d554ae0218
Windows: Resolve file_handler type confusion
2020-10-29 09:43:16 +00:00
Mike Auty
c44074c685
Windows: Fix pslist copypasta typo
2020-10-29 09:43:16 +00:00
Mike Auty
616f7e5d96
Windows: Fix up modules dumping
2020-10-29 09:43:16 +00:00
Mike Auty
b703210024
Windows: Refactor names of FileInterfaces
2020-10-29 09:43:16 +00:00
Mike Auty
3bd462720b
Windows: Minor typos with the last patch
2020-10-29 09:43:16 +00:00
Mike Auty
56266f97de
Windows: Fix up rebased malfind and vadinfo
2020-10-29 09:43:16 +00:00
Mike Auty
032c6b0ac7
Windows: Make more use of plugin.open
2020-10-29 09:43:16 +00:00
Mike Auty
7cadbf32d4
Windows: Update dumping code from commit to close
2020-10-29 09:43:16 +00:00
Mike Auty
e8fb8c929c
Plugins: Introduce FileHandlerInterface
2020-10-29 09:43:16 +00:00
Mike Auty
bbc2ac0018
Plugins: Bump required_framework_version and yapf
2020-10-29 09:43:16 +00:00
Mike Auty
4400c43903
Codebase: Yapf across the whole codebase
2020-10-27 01:06:24 +00:00
Mike Auty
91005e05c7
Windows: Ensure pe is always imported from extensions
...
Fixes #366
2020-10-27 01:02:50 +00:00
Andrew Case and ikelos
0f60250e4f
Add missing requirements specification
2020-10-24 23:12:57 +01:00
Andrew Case and ikelos
b5d50c055b
Add the Mac kevents plugin
2020-10-24 23:12:57 +01:00
Andrew Case and ikelos
1c709aa09c
Add mac_vfsevents
2020-10-24 23:12:10 +01:00
Andrew Case and ikelos
13ad03f49e
Add plugins for enumerate of mac kauth listeners and scopes
2020-10-24 23:11:37 +01:00
Mike Auty
c53655e40c
Poolscanner: Infomasks can be 0
2020-10-18 01:07:36 +01:00
Mike Auty
82b3477613
Objects: Prevent recursion on uninitialized objects
...
Adds in guards to prevent attribute access if the object hasn't been
initalized correctly (for example from pickling or deepcopy).
Fixes #358 .
2020-10-18 00:22:09 +01:00
iMHLv2 and ikelos
0d4075355a
refs #332 catch invalid address exceptions when reading DllBase
2020-10-07 23:16:14 +01:00
Mike Auty
7e63ed4815
Plugins: Allow None types in the configuration tree as values
2020-10-03 22:02:40 +01:00
memoryforensics1 and ikelos
b17a9e1977
Update __init__.py
2020-10-03 21:45:37 +01:00
memoryforensics1 and ikelos
ce22fc59fa
Update __init__.py
2020-10-03 21:45:37 +01:00
memoryforensics1 and ikelos
b2aaf53d86
Fix XP buges for privileges and environment_variables
2020-10-03 21:45:37 +01:00
Mike Auty
4c633f3ee9
Windows: Add PointerCount check to improve poolscanning
2020-10-01 09:06:19 +01:00
Mike Auty
640f2584e4
Windows: Reduce complexity by using built-in inet_ntop
2020-09-24 01:20:37 +01:00
Mike Auty
dc8bec199f
Windows: Minor formatting and typing improvements
2020-09-24 01:01:51 +01:00
Mike Auty
b07ce5bd38
Crash64: Add support for type 0x01 to crashdump64
2020-09-23 20:28:23 +01:00
Mike Auty
577c4acec3
Layers: Crash64 improve logging
2020-09-23 20:28:23 +01:00
Mike Auty
c4ff2da9be
Layers: Fix context cloning infinite loop with crashdumps
2020-09-23 20:28:23 +01:00
Mike Auty
31e251e108
Layers: Initial crashdump64 implementation
2020-09-23 20:28:23 +01:00
iMHLv2 and ikelos
8baf13d3e3
refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps
2020-09-23 19:27:37 +01:00
memoryforensics1 and ikelos
9048c04aa4
envars plugin
...
parse environment variables
2020-09-22 20:03:19 +01:00
Mike Auty
c436882f4d
Windows: Fix up the sids JSON slightly
2020-09-22 19:49:34 +01:00
memoryforensics1 and ikelos
0f34c82b6c
Update privileges.py
2020-09-22 19:49:01 +01:00
Mike Auty