 Matt Tresslerandikelos
|
0452f69f82
|
created keyboard_notifiers
|
2020-08-03 16:30:09 +01:00 |
|
|
Mike Auty
|
f5f9ee7292
|
Linux: Fix plugin case and re-run yapf
|
2020-07-31 00:28:21 +01:00 |
|
|
Mike Auty
|
ccd9a2836c
|
Windows.info: Refactor windows.info as classmethods
|
2020-07-30 23:25:47 +01:00 |
|
|
Matt Tresslerandikelos
|
8beac1d67d
|
fixed bug causing no output when tty_check is run
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
71dc85ade5
|
removed debugging print statements
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
34ff856a79
|
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
355c25fefb
|
added parameter type to generate_kernel_handler_info
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
ddec0d482d
|
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
b9f5450ac3
|
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
|
2020-07-30 23:24:23 +01:00 |
|
|
mtresslerandikelos
|
d61034bca8
|
Removed unnecessary code from tty_check.py
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
314b6aa2c6
|
added some documentation
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
44911bf54a
|
Fixed tty_check not finding the ttyhook module
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
512cc8b451
|
fixed some formatting for tty_check.py
|
2020-07-30 23:24:23 +01:00 |
|
|
Matt Tresslerandikelos
|
ec8e9161bf
|
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
|
2020-07-30 23:24:23 +01:00 |
|
|
Mike Auty
|
03877ef2ec
|
Core: Maintain 3.5.3 compatibility
|
2020-07-30 22:27:26 +01:00 |
|
|
Mike Auty
|
b04fd7c9bd
|
Objects: Update enumeration method to is_valid_choice
|
2020-07-29 20:25:34 +01:00 |
|
|
Mike Auty
|
180eee569f
|
Objects: Add a convenience function for validating enum values
|
2020-07-29 20:25:34 +01:00 |
|
|
Mike Auty
|
bbaf4f22d6
|
Plugins: Remove unnecessary dependency for yarascan
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
a5ecae29cc
|
Configuration: Improve the VersionableInterface documentation
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
3eb463475b
|
Core: Refactor versioning and associated requirements
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
2c39489790
|
Yarascan: Move most of yarascanning into a versionable plugin
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
|
2020-07-29 20:18:03 +01:00 |
|
|
Mike Auty
|
faaa3bf6d8
|
Caching: Only cache remote files
|
2020-07-28 21:03:16 +01:00 |
|
|
Mike Auty
|
123e9bc8a3
|
Registry: Fix error message
|
2020-07-28 20:49:53 +01:00 |
|
|
Mike Auty
|
54b62709d1
|
Hashdump: Reformat and convert to proper byte handling
|
2020-07-28 20:49:27 +01:00 |
|
|
Andrew Case
|
dec13f5082
|
Linux - stash the Linux kernel virtual address
|
2020-07-28 13:16:40 -05:00 |
|
|
Jack Wengerandikelos
|
465a7ca6ad
|
Added documentation and logging
|
2020-07-28 17:59:57 +01:00 |
|
|
Jack Wengerandikelos
|
72bc40ee69
|
added hashdump
|
2020-07-28 17:59:57 +01:00 |
|
|
Andrew Caseandikelos
|
75d4390255
|
Remove extra debug prints
|
2020-07-28 17:00:20 +01:00 |
|
|
Mike Auty
|
8481406488
|
Linux: Support stashing the KASLR
|
2020-07-28 17:00:20 +01:00 |
|
|
Mike Auty
|
a4b50d183d
|
Mac: Stash the verified ASLR shift and improve logging
|
2020-07-28 17:00:20 +01:00 |
|
|
Andrew Caseandikelos
|
f6a1b28424
|
First attempt and better DTB and ASLR validation. Debugging statements left in.
|
2020-07-28 17:00:20 +01:00 |
|
|
Mike Auty
|
13e36ec58a
|
Core: Rerun yapf across the codebase.
|
2020-07-28 16:57:48 +01:00 |
|
|
Mike Auty
|
cbd40db053
|
Linux: Restore accidentally dropped kobject definition
|
2020-07-28 16:53:24 +01:00 |
|
|
xabiugarteandMike Auty
|
fedd9c5519
|
Fixes on coding style
|
2020-07-28 16:46:43 +01:00 |
|
|
xabiugarteandMike Auty
|
01dea6f3a8
|
Add elf parsing and symbol retrieval for linux kernel modules
|
2020-07-28 16:46:40 +01:00 |
|
|
Mike Auty
|
a980374eb8
|
Automagic: Fix issue in recent refactor
|
2020-07-28 11:15:16 +01:00 |
|
|
Mike Auty
|
61563350b3
|
Linux/Mac: Refactor *nix Utilities classes
|
2020-07-28 11:15:16 +01:00 |
|
|
Mike Auty
|
dc1e5064c9
|
Framework: Move cache_clear function to the framework
|
2020-07-26 22:57:33 +01:00 |
|
|
Mike Auty
|
8e6e966fb9
|
Requirements: Attempt to fix issue with python3.5
|
2020-07-23 02:23:31 +01:00 |
|
|
Mike Auty
|
667329e2fd
|
Mac: Fix pslist pid_filter function
|
2020-07-23 02:02:01 +01:00 |
|
|
Mike Auty
|
9295f41586
|
Plugins: Convert existing plugins over to use a list for PIDs
|
2020-07-23 02:02:01 +01:00 |
|
|
Mike Auty
|
31600254b9
|
Codebase: Apply yapf across the codebase.
|
2020-07-23 01:31:41 +01:00 |
|
|
mtresslerandikelos
|
79cf041283
|
Update check_modules.py
Removed unnecessary header info. A symbol table without the module_kset struct will now raise a TypeError
|
2020-07-21 23:00:52 +01:00 |
|
|
Matt Tresslerandikelos
|
4092bdb5de
|
changed from windows to linux line endings
|
2020-07-21 23:00:52 +01:00 |
|
|
Matt Tresslerandikelos
|
82a6b23669
|
Completed linux_check_modules. Added kobject extension as needed for check_module plugin
|
2020-07-21 23:00:52 +01:00 |
|
|
Andrew Caseandikelos
|
ef97c672e3
|
Check for invalid vnode pointers before processing path
|
2020-07-18 17:06:50 +01:00 |
|
|
Mike Auty
|
a173f12fce
|
Plugins: Normalize InvalidAddress exception handling
|
2020-07-18 16:38:49 +01:00 |
|
|
Mike Auty
|
43ae291815
|
Plugins: Add back in the checks because the filter might trip them
|
2020-07-18 16:38:49 +01:00 |
|
|
Mike Auty
|
73ad2bcd4e
|
Plugins: Since procs have been instantiated, checks aren't needed
|
2020-07-18 16:38:49 +01:00 |
|
|
Mike Auty
|
d15b23aa19
|
Plugins: Fix pslist_method inconsistencies
|
2020-07-18 16:38:49 +01:00 |
|