Commit Graph
78 Commits
Author SHA1 Message Date
Mike Auty a85f6f80f8 Linux automagic: Add support for more recent init_top_pgt symbol. 2019-11-22 22:40:52 +00:00
Mike Auty dcf5b1f68c Stackers: Update the stack orders to try quick header check layers first 2019-11-16 12:53:56 +00:00
Mike Auty 211ad0d524 Remove useless calls to validate. 2019-09-26 15:58:22 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00
Mike Auty 9cde94bceb Change the license blurb on all files. 2019-08-27 23:11:00 +01:00
Mike Auty be27aab8ae Refactor symbol to object_type (so it doesn't shadow builtin type). 2019-08-14 20:50:42 +01:00
Mike Auty 5362e2094e Initial attempt at cleaning up the API
Context.object accepts a template or a string name (and now a type
flag).  Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).

The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty afdd8b657e Fix memory problems with banner_caches.
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required.  As the cache builders are separate at the
moment, we previously ran banner searches without any banners.  This was
bad.  It inflated memory hugely and killed the buildbot.

We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Andrew Caseandikelos 731447000d avoid use of _context in extension 2018-12-27 22:41:03 +00:00
Mike Auty 4308245499 Revert "prevent double shifting of ASLR slides"
This reverts commit 2655fd1666.
2018-12-20 15:40:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Andrew Case 2655fd1666 prevent double shifting of ASLR slides 2018-12-19 11:12:58 -06:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 6e43d0bab4 Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it). 2018-12-13 15:56:24 +00:00
Mike Auty 5135215c62 Do some tidying and renaming. 2018-12-13 15:56:24 +00:00
Mike Auty 7a462d5f85 Refactor out the shared symbol cache/finder code from linux and mac. 2018-12-13 15:56:24 +00:00
Mike Auty 55286f04cb Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat. 2018-12-13 15:56:24 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty 918653e398 Convert aslr_mask_symbol_table to more parameterized form. 2018-12-08 17:55:13 +00:00
Mike Auty 3f2f3cd2f3 Add a reminder to fix up the API in this place. 2018-12-03 21:52:29 +00:00
Mike Auty e27ba8d089 Fix up naming for objects/symbols_utility imports. 2018-11-08 00:48:38 +00:00
Mike Auty ac0f1a2cd0 Fix up a remaining typo, and two typing questions. 2018-11-08 00:19:17 +00:00
Mike Auty db7320e426 Bulk lint and a couple of typos fixed. 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos c6ca2666b6 Update aslr calculation to correctly handle physical shifts and also to cache results 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 625952680a mass convert hasattr -> has_member 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos b868f41c95 Fix get_path_file call 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 6254538371 Properly use expeption type 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos a015e69b84 Update the use of symbols and objects class and add comments about dentry traversal 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos a8adf4eaea Fix find_aslr for swapper isgnature and throwing exception instead of returning None 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 98e472e211 major updates and new plugins 2018-11-08 00:19:17 +00:00
Mike Auty d829028a36 Apply various type annotation/bug fixes. 2018-10-05 00:16:42 +01:00
Mike Auty 701c56558b Fix a typo from the big refactor in commit 190ffaf2. 2018-09-28 12:51:55 +01:00
Mike Auty 00a118a06a Reduce return results from find_requirements. 2018-09-23 22:24:44 +01:00
Mike Auty 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). 2018-09-20 16:14:57 +01:00
Mike Auty abee0f8de7 Change the ASLR finding code to return no shift values (and log when it's found none). 2018-09-03 21:48:16 +01:00
Mike Auty 0c46da22c3 Readd the check to ensure we don't stack on top of an existing Intel layer. 2018-09-02 19:03:39 +01:00
Mike Auty 7f966901cf Ensure the dtb can't get specified from an earlier run around the loop. 2018-09-02 18:28:59 +01:00
Mike Auty c1dc36a327 Fix up the breakage from the preivous commit. 2018-09-02 18:27:28 +01:00
Mike Auty 29f1a0f216 Change the default state for stacking to ensure layer isn't set unless successful. 2018-09-02 17:42:55 +01:00
Mike Auty 3a6b4ad35c Add in the has_member method for objects and templates. 2018-08-29 22:54:56 +01:00
Mike Auty ffa54c45eb Fix linux invalid keyword argument bug. 2018-06-20 22:15:42 +01:00
Mike Auty 113c23a66d Last of the typing fix-ups. 2018-06-04 23:55:38 +01:00
Mike Auty 9512cbe9eb Commit metadata changeset.
Layers now accept metadata dictionaries (and chain/stack them on top of
those from lower layers).  Metadata can only be set at construction
time, and the metadata dictionary is readonly.  The hope is this will
make enumerating metadata keys across the codebase simpler.

The current metadata items that layers hold is:

architecture (Unknown | Intel32 | Intel64)
os (Unknown | Windows | Linux)
pae (bool)
page_map_offset (int)

This patchset may develop further to help enumerate all of these
(through a registration/reporting system).
2018-04-26 12:48:14 +01:00