Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Mike Auty
19f908b075
Rejig pdbscan to find potential offsets then check them.
...
Originally we found physical offsets for pdbs that matched,
then found potential offsets and tested them against each other.
Now, we find the potential offsets and then look for pdbs at that offset
(technically within a 4Mb block after the start). The scanning is quick
(probably quicker than scanning the whole physical space) and should
catch most pdbs unless they're splayed out in virtual memory.
2019-01-01 01:14:34 +00:00
Mike Auty
bb872863f9
Try to slightly clean up table rendering in the CLI.
2018-12-30 17:17:15 +00:00
Mike Auty
afdd8b657e
Fix memory problems with banner_caches.
...
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required. As the cache builders are separate at the
moment, we previously ran banner searches without any banners. This was
bad. It inflated memory hugely and killed the buildbot.
We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Mike Auty
ac57e62807
Output the requirement description when it can't be fulfilled.
2018-12-29 00:41:20 +00:00
Andrew Case and ikelos
92adf4ffd0
switch mac_pslist to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
b77d638ead
switch mac_lsmod to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
1845fe9ec5
update syscall to use new API correctly
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
f8fab3a71d
switch mac_trustedbsd to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
9eeac53d8d
add mac_check_syscall
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
984615ebba
fix plugins for new API
2018-12-27 22:41:03 +00:00
Andrew Case and ikelos
731447000d
avoid use of _context in extension
2018-12-27 22:41:03 +00:00
Andrew Case and ikelos
2a0aec8104
switch linux_lsmod to absolute_symbol_addresses interface
2018-12-27 22:41:03 +00:00
Mike Auty
59d3f2b8ee
Clean up an unecessary import.
2018-12-25 16:48:15 +00:00
Mike Auty
2bbb3f7878
Fix up issue identified by atcuno.
2018-12-20 15:46:42 +00:00
Mike Auty
ecdc89a282
Fix a stupid typo.
2018-12-20 15:46:42 +00:00
Mike Auty
67c9c7e097
Add in fix for absolute symbol offsets within modules.
2018-12-20 15:46:42 +00:00
Mike Auty
4308245499
Revert "prevent double shifting of ASLR slides"
...
This reverts commit 2655fd1666
2018-12-20 15:40:53 +00:00
Mike Auty
d676d29c8b
Remove author lines with permission.
...
So that we don't get contributions that include author lines remove any
that exist currently in the code. We need to figure out how we're going
to support attribution, probably through an AUTHORS file, but definitely
not peppering the code.
2018-12-20 09:16:35 +00:00
Mike Auty
065808c648
Minor fix to the setup.py file.
2018-12-20 00:18:22 +00:00
Mike Auty
928ec87e17
Further minor README fixes.
2018-12-20 00:17:28 +00:00
Mike Auty
27a0dcc80f
Minor white-text fixing and a single typo in the README.
2018-12-20 00:11:51 +00:00
Mike Auty
e4fcc12654
Slight license reformatting for clarity.
2018-12-20 00:11:05 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e3ab3b1c8f
Make certain methods protected, otherwise they should be classmethods.
2018-12-19 22:48:16 +00:00
Mike Auty
189c8786f1
Rename filt to filter_func (because we value clarity over brevity) and another small fix.
2018-12-19 22:46:33 +00:00
Mike Auty
70e8204113
Fix up linux version of mmap_iter property to get_mmap_iter.
2018-12-19 22:38:43 +00:00
Mike Auty
39634893d6
Reformat with yapf and change filter to filt.
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
989e8643e9
add mac_bash
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
06cd454913
add mac_trustedbsd
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
ab877b3907
move plugins into proper directory
2018-12-19 19:43:56 +00:00
Mike Auty
af8719d299
Keep a separate list of resolve symbols, in case they share the name of a type.
2018-12-19 19:43:27 +00:00
Mike Auty
eb2b96e0ad
Reorder the sanitization to ensure booleans are stored as bools.
2018-12-19 19:41:46 +00:00
Mike Auty
d4cc02025c
Add in sanitization to prevent volatility objects leaking into the configuration data.
2018-12-19 18:54:48 +00:00
Andrew Case
2655fd1666
prevent double shifting of ASLR slides
2018-12-19 11:12:58 -06:00
Mike Auty
2a3b7348be
Add in minor changes and remove the duplicate plugins for mac.
2018-12-19 01:01:53 +00:00
Andrew Case and ikelos
7b3420f5b7
updated mac_psaux to report requirements correctly and remove stale debug print
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
6d582a8a68
remove while 1 and broad exception catching
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
19d39e53ff
add docstrings for malfind
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
a98995aa4e
remove unnecesary calls to int()
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
1dba08c005
remove try/except block that should have been removed originally
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
8f213a95d7
vol_class -> CPPObject
2018-12-19 00:54:51 +00:00
Mike Auty
857c970125
Update typing to match master.
2018-12-19 00:54:51 +00:00
Mike Auty
1322ebd44f
More minor cleanup.
2018-12-19 00:54:51 +00:00
Mike Auty
3a2d3c604f
Tidying. Renaming variables to avoid shadowing of classes, etc.
2018-12-19 00:54:51 +00:00
Mike Auty
c5ebf91915
Yapf reformat of the patches.
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
6aac0571e6
add support for objective C classes in OSX and json format
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
12e470ab55
add malfind plugin part 2 (extension update)
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
5ab483a0c3
add malfind plugin
2018-12-19 00:54:51 +00:00
Andrew Case and ikelos
002ced1b5d
add mac_pslist
2018-12-19 00:54:51 +00:00
Mike Auty