Mike Auty
29cb430a72
Codebase: Apply yapf clean-up across the codebase
2020-10-29 09:43:16 +00:00
Mike Auty
bbc2ac0018
Plugins: Bump required_framework_version and yapf
2020-10-29 09:43:16 +00:00
Andrew Case and ikelos
e58e55b433
Update code for better variable names and minor version bump
2020-09-16 17:35:49 +01:00
Andrew Case and ikelos
afe39eee1b
Add new method for safe walking of generic list heads. Convert pslist to use it.
2020-09-16 17:35:49 +01:00
Mike Auty
73f3c217bd
Mac/Linux: Remove unnecessary imports
2020-08-18 09:15:13 +01:00
Mike Auty
90d347714c
Mac: Correct patch ordering
2020-08-18 09:10:16 +01:00
Mike Auty
15da1f5253
Plugins: Update pidlist_pid_hash_table to a pslist method
2020-08-14 22:39:40 +01:00
Mike Auty
833cfc5607
Plugins: Update the docstring for pslist_sessions code
2020-08-14 22:30:34 +01:00
Mike Auty
08b8564802
Plugins: Update pslist_sessions to be a different process lister
2020-08-14 22:30:34 +01:00
Mike Auty
667329e2fd
Mac: Fix pslist pid_filter function
2020-07-23 02:02:01 +01:00
Mike Auty
9295f41586
Plugins: Convert existing plugins over to use a list for PIDs
2020-07-23 02:02:01 +01:00
Mike Auty
a173f12fce
Plugins: Normalize InvalidAddress exception handling
2020-07-18 16:38:49 +01:00
Mike Auty
43ae291815
Plugins: Add back in the checks because the filter might trip them
2020-07-18 16:38:49 +01:00
Mike Auty
73ad2bcd4e
Plugins: Since procs have been instantiated, checks aren't needed
2020-07-18 16:38:49 +01:00
Mike Auty
d15b23aa19
Plugins: Fix pslist_method inconsistencies
2020-07-18 16:38:49 +01:00
Mike Auty
7673dd8d2d
Mac: Consolidate methods of listing processes
...
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing. At the moment, the default (first in the method list)
is chosen. An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).
If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
2020-07-18 16:38:49 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Andrew Case
2d7bc99d6a
Mac - make pslist smear resistant
2019-09-26 21:57:48 -05:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
71bb54379b
Refactor the plugin versioning to be simpler to define.
2019-08-27 21:08:29 +01:00
Mike Auty
47c349e240
Add plugin requirements for all plugins.
2019-08-27 21:08:29 +01:00
Mike Auty
5db6ade2ea
Change object_type parameter for object_from_symbol.
2019-08-14 20:50:42 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
cdbe0306f0
Fix the nullfilter for mac process lists.
2019-03-03 14:57:34 +00:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Andrew Case and ikelos
92adf4ffd0
switch mac_pslist to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
189c8786f1
Rename filt to filter_func (because we value clarity over brevity) and another small fix.
2018-12-19 22:46:33 +00:00
Mike Auty
2a3b7348be
Add in minor changes and remove the duplicate plugins for mac.
2018-12-19 01:01:53 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
35ad2325a8
Move all core plugins over to framework/plugins.
...
This should have no impact functionality-wise.
The statistics plugin was left out a) as an example and b) because it
was committed by mistake in the first place and was never meant to be a
real plugin.
2018-12-16 13:40:15 +00:00
Mike Auty