Mike Auty
f34958a16d
Poolscanner: Add necessary exception handling.
2019-12-04 22:11:42 +00:00
Mike Auty
386f94d9ee
Pool: Make object_header type checking the plugin's responsibility.
2019-12-04 22:11:42 +00:00
Mike Auty
8691c68604
Pool: Refactor pool extension to its own file.
2019-12-04 22:11:42 +00:00
Mike Auty
b6d807ff51
Poolscanner: Document the typing issue of python3.5's IntEnum over IntFlag
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
b99ace86fb
Tidy up exceptions to be more accurate.
2019-11-13 19:58:14 +00:00
Mike Auty
23b14b772a
Poolscanner: Fix error in index checking.
2019-11-09 00:17:07 +00:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
d2b892cf94
Fix up docstring errors in documentation build
2019-09-19 23:00:37 +01:00
Mike Auty
1f9605abf7
Revert "Fix warnings when generated documentation."
...
This actually broke autodoc generation and wasn't accurate. The
documentation warnings may have to stay for now.
This reverts commit 37e13321f9
2019-09-17 18:32:44 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
03bc3d927d
Improve the name of a handles exposed function.
2019-09-08 13:22:42 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
71bb54379b
Refactor the plugin versioning to be simpler to define.
2019-08-27 21:08:29 +01:00
Mike Auty
47c349e240
Add plugin requirements for all plugins.
2019-08-27 21:08:29 +01:00
Mike Auty
37e13321f9
Fix warnings when generated documentation.
2019-08-18 18:30:44 +01:00
Mike Auty
57510803d5
Fix up an issue when removing PoolHeaderSymbolTable.
2019-08-18 01:19:34 +01:00
Mike Auty
1082429aab
Don't use a separate symbol table class just to add a class override.
2019-08-17 23:20:46 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
fbeab3608c
Make we raise if the _POOL_HEADER type doesn't exist.
2019-08-08 01:09:56 +01:00
Mike Auty
253ce69fc9
Refactor poolscanner layer to move more into the parallel scanner.
2019-08-07 18:37:56 +01:00
Mike Auty
9ed1a5a5b6
The header is not dependent on the constraint, so only construct it once.
2019-08-07 16:33:13 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
ef28a9b733
Apparently, it wasn't in 3.5, but it throws type-checking errors
...
Python3.6 introduced it, but annoying the type-checker realizes that
we're using it like any int (ie, A | B) and throws a wobbly. Really
want to see the back of python3.5...
Revert "IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen."
This reverts commit 17a0e1eac8
2019-06-28 15:31:59 +01:00
Mike Auty
17a0e1eac8
IntFlag is in python-3.5 by default, it's just if the enum34 package is installed that problems happen.
2019-06-28 15:29:40 +01:00
Analyst and ikelos
a90f3ed1a7
fixup an instance of is_windows_7 in poolscanner
2019-05-29 14:46:22 +01:00
Mike Auty
4ff137bc18
Fix up a is_windows_8_or_later call.
2019-05-29 14:46:22 +01:00
Mike Auty
38f249aef2
Change the os-distguisher to make it more flexible.
2019-05-29 14:46:22 +01:00
Mike Auty
867edc9501
Add in the os-distinguisher code.
2019-05-29 14:46:22 +01:00
Dave Lassalle and ikelos
61f9173bb6
initial hivescan plugin
2019-04-27 14:02:07 +01:00
Mike Auty
5b8645bd1f
Revert IntFlag change until we drop python 3.5 support.
2019-04-05 22:56:36 +01:00
Mike Auty
87bf1da424
Don't use mutable defaults.
2019-04-05 14:50:39 +01:00
Mike Auty
fa94ef3271
Use the flag type for flags.
2019-04-05 14:49:44 +01:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Analyst
fb36db098e
add the modscan plugin
2019-03-04 11:02:53 -06:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
b1c3ecfa17
add mutantscan
2019-02-27 12:49:50 -06:00
Mike Auty
b335b2320d
Minor performance fix for PE extension and yapf of poolscanner.
2019-02-18 00:07:19 +00:00
Michael Ligh and ikelos
12fe297c80
builtin_constraints() returns all constraints by default
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
f34cd01b09
small style change for readability
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
33f3f4372c
parameterize generate_pool_scan() - let plugins choose which contraints to use
...
plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
c1341e6278
refactor poolscanner to be leveraged by other plugins. add psscan
2019-02-07 09:08:32 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Michael Ligh and ikelos
d23e6474ce
reference windows metadata & PE values from ISF as the primary method of determining OS version
2019-02-06 21:11:20 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty