Mike Auty
eaa8391b22
Scanning: switch to ThreadPool for threading.
2019-12-29 23:45:26 +00:00
Mike Auty
348ac4e41b
Layers: Remove while true Take 2.
2019-12-11 20:04:30 +00:00
Mike Auty
a8a467a0c3
Revert "Layers: Remove (horrible, horrible) uses of while true in the codebase (my bad)"
...
This reverts commit a963938e11
2019-12-11 19:56:29 +00:00
Mike Auty
a963938e11
Layers: Remove (horrible, horrible) uses of while true in the codebase (my bad)
2019-12-11 19:42:10 +00:00
Mike Auty
83a8afba6b
Objects: Simplify get_symbol_table to get_symbol_table_name.
2019-12-04 23:41:27 +00:00
Mike Auty
fa26dbf659
Yarascan: Make generic yarascan just scan kernel memory.
2019-12-04 23:17:10 +00:00
Mike Auty
f34958a16d
Poolscanner: Add necessary exception handling.
2019-12-04 22:11:42 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Michael Ligh and ikelos
d0f9cf9a2f
refs #139 use _EPROCESS.ControlFlowGuardEnabled to distinguish between windows 10 <= 15063 versus >= 16299
2019-12-04 21:19:19 +00:00
Mike Auty
1eea645da0
EPROCESS: Wrap get_peb functions in error handlers
2019-12-04 21:13:19 +00:00
Mike Auty
17247426d8
pdbconv: Avoid more name-collisions
...
Previously we allow name-collisions for types with name <anonymouos-tag>
so this has now been resolved, as well as descending too deeply down the
type to tree determine the size of array occassionally.
2019-12-04 20:04:22 +00:00
xabiugarte and ikelos
35abb343da
Raise exception instead of return None
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
3545ab7746
Fixes on pydoc, types, exception catching
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
c9520dc37f
Remove extra line
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
11d3d304ba
Refactor get_peb functionality in EPROCESS
2019-12-04 20:02:31 +00:00
xabiugarte and ikelos
a6944f7a06
Add InitOrder and MemOrder functions to EPROCESS
2019-12-04 20:02:31 +00:00
Mike Auty
af3b3e305f
Timeliner: Report progress on which plugin is being run.
2019-12-04 17:25:33 +00:00
xabiugarte and ikelos
949a2a2ddc
Change unsigned long long by pointer
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
8da9d90c19
Small fix on EPROCESS is_valid
2019-12-02 13:07:04 +00:00
xabiugarte and ikelos
1123ed074d
Tiny fix in EPROCESS.is_valid
2019-12-02 13:07:04 +00:00
Mike Auty
b6d807ff51
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
2019-11-27 11:30:14 +00:00
Mike Auty
1f4498be37
MultiRegExScanner: Results are always bytes and never strings
2019-11-27 11:30:14 +00:00
Mike Auty
af43e506fb
Elf64Layer: Fix typo in exception message.
2019-11-27 11:30:14 +00:00
Mike Auty
b0b868d79c
Typing: General typing fixes across the tree
2019-11-27 11:30:14 +00:00
Mike Auty
d29cd776ec
Layers: Fixing multiprocessing typing issue.
2019-11-27 11:30:14 +00:00
Mike Auty
0e016797bb
Typing: Change signatures to co-variant Mapping from Dict
2019-11-27 11:30:14 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
06c4a6dcc7
pdbconv: Swap the suffix ordering to make the less common option second.
2019-11-20 20:04:14 +00:00
Mike Auty
9928b40afb
pdbconv: ResourceAccessor now logs the written file
2019-11-20 20:04:14 +00:00
Mike Auty
2d3cceda46
ResourceAccessor: Warn and retry without validation on certificate failure
2019-11-20 20:04:14 +00:00
Mike Auty
cb41c5e960
Pdbconv: Switch pdb downloading to resource accessing
2019-11-20 20:04:14 +00:00
Mike Auty
9334add1fc
ResourceAccessor: Fix downloading progress indicator.
2019-11-20 20:04:14 +00:00
Mike Auty
22fd48516e
ResourceAccessor: Improve typing information
2019-11-20 20:04:14 +00:00
Mike Auty
d7b996ff85
ResourceAccessor: Only list the handlers once.
2019-11-20 20:04:14 +00:00
Mike Auty
249c3ec223
Svcscan: Ensure or later checks are done in order.
...
Relates to issue 139.
2019-11-18 20:57:34 +00:00
Mike Auty
dc5420df55
Stackers: Give the vmware stacker an ordering.
2019-11-16 12:58:38 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
1f0e81a898
layers: Stackers are sorted by stack_order not layer priorities.
2019-11-16 12:53:56 +00:00
Mike Auty
19d46563ae
layers: Fix up the maths around scanning chunks
2019-11-13 21:44:13 +00:00
Mike Auty
ca8099e7d7
layers: Improve scanning of layered chunks
...
Previously, for segmented layers, no chunk larger than a full segment
was scanned. Now, we combine contiguous segments up to
scanner.chunk_size (or until a non-present segment) in order to scan it.
This may be slightly slower (by concatting the data together) but gives
results of hits across page boundaries (the point of the scanning
capability), whereas previously each page was scanned individually.
2019-11-13 21:44:13 +00:00
Mike Auty
0f9c6a7362
vmware layer: Fix up a typo.
2019-11-13 19:58:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
40fcdf9469
exceptions: SymbolErrors now contain specific information
2019-11-13 19:27:00 +00:00
Mike Auty
ce3f4fb134
CLI: Initial attempt to standardize exception output
2019-11-13 19:27:00 +00:00
doomedraven and ikelos
4543b0af33
Update vaddump.py
2019-11-13 18:54:19 +00:00
doomedraven and ikelos
97f670ec79
simplify vad dump to be used by other plugins
2019-11-13 18:54:19 +00:00
Mike Auty
648cded5e1
Objects: Fix incorrect Bitfield maths
...
Turns out that #133 exposed a mistake in how we were using the end_bit
field (and it should have been picked up in review, my bad).
Essentially we were masking based on the length of the end_bit after
*already* shifting by the start_bit. We should mask then shift, not the
other way around.
May well fix issue #135 (pdb generation will have been affected by
this).
2019-11-13 16:48:14 +00:00
Mike Auty