Mike Auty
08b8564802
Plugins: Update pslist_sessions to be a different process lister
2020-08-14 22:30:34 +01:00
Andrew Case and ikelos
93e16a7151
add pslist_sessions plugin
2020-08-14 22:30:34 +01:00
Mike Auty
595a94304d
Strings: Small bugfix as pointed out by AsafEitani
2020-08-13 10:32:56 +01:00
Mike Auty
f3fd67abb2
Plugins: Update the recent plugins copyright date.
2020-08-12 22:37:47 +01:00
Mike Auty
289afd504b
Plugins: Minor clarifications and cleanups
2020-08-12 21:00:24 +01:00
Steffi Keene and ikelos
76d6764e81
cleanups
2020-08-12 20:56:15 +01:00
Steffi Keene and ikelos
5166bcbe95
Memdump and memmap running/tested with grrcon-0a7030d.imh
2020-08-12 20:56:15 +01:00
Steffi Keene and ikelos
2e765c7d70
working with grrcon-
2020-08-12 20:56:15 +01:00
Steffi Keene and ikelos
1c58043004
memdump running but not tested
2020-08-12 20:56:15 +01:00
Steffi Keene and ikelos
1472048b41
testing memmap
2020-08-12 20:56:15 +01:00
AsafEitani and ikelos
f7b456a703
Update strings.py
2020-08-12 14:57:57 +01:00
AsafEitani and ikelos
67c515f38d
Improved strings efficiency
...
1. Replaced readlines() with readline() to prevent loading the entire strings file to memory all at once.
2. Added process callback to indicate the progression.
3. Converted the re.compile of strings parse_line to global in order to prevent compilation for each line.
4. Changed the regex to not include the trailing newline (\n)
2020-08-12 14:57:57 +01:00
Matt Tressler and ikelos
2467e3986d
added address mask to fix issue with kernel tracking
2020-08-06 18:12:42 +01:00
Matt Tressler and ikelos
eb2d7715ce
fixed poor variable name, removed unnecessary code
2020-08-06 18:12:42 +01:00
Matt Tressler and ikelos
8f7171ac5f
fix copyright year
2020-08-06 18:12:42 +01:00
Matt Tressler and ikelos
d7619d6170
created linux_check_idt; plugin currently is not finding the module names for each entry in idt table
2020-08-06 18:12:42 +01:00
Mike Auty
0b392f5186
Windows: Add a version to the info plugin now its got classmethods
2020-08-05 11:47:04 +01:00
Mike Auty
2166834d87
Timeliner: Actually make use of the TextIoWrapper
2020-08-03 20:36:40 +01:00
Mike Auty
cbea698ab0
Timeliner: Sort results and provide a filter
...
Sorts the results (as stated). Note that user interfaces may decide to
sort their results in an order of their choosing.
Also added a parameter that can be provided multiple times to only allow
plugins that match (any of) the parameters provided.
2020-08-03 20:13:25 +01:00
Mike Auty
a339fd0783
Linux: Fix keyboard_notifiers copyright year
2020-08-03 17:05:41 +01:00
Mike Auty
556c880c90
Codebase: Ensure all conversions to bytes handle unicode
...
All conversions using `latin-1` have been converted to
`raw_unicode_escape` which is like `latin-1`, but handles unicode
characters appropriately (with a `\u` prefix).
Since this is like `latin-1` it should have no impact on things that ran
previously, but those that would fail with a unicode error now will
present an encoded unicode string. There may be situations where the
binary representation of unicode would be better (timeliner file
output?), but those can be changed when/if it's determined necessary.
Fixes #274 .
2020-08-03 16:53:48 +01:00
Mike Auty
ff32383f82
Yapf: Minor reformats for recent plugins
2020-08-03 16:33:10 +01:00
Matt Tressler and ikelos
0452f69f82
created keyboard_notifiers
2020-08-03 16:30:09 +01:00
Mike Auty
f5f9ee7292
Linux: Fix plugin case and re-run yapf
2020-07-31 00:28:21 +01:00
Mike Auty
ccd9a2836c
Windows.info: Refactor windows.info as classmethods
2020-07-30 23:25:47 +01:00
Matt Tressler and ikelos
34ff856a79
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ddec0d482d
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
b9f5450ac3
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
2020-07-30 23:24:23 +01:00
mtressler and ikelos
d61034bca8
Removed unnecessary code from tty_check.py
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
314b6aa2c6
added some documentation
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
44911bf54a
Fixed tty_check not finding the ttyhook module
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
512cc8b451
fixed some formatting for tty_check.py
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ec8e9161bf
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
2020-07-30 23:24:23 +01:00
Mike Auty
bbaf4f22d6
Plugins: Remove unnecessary dependency for yarascan
2020-07-29 20:18:03 +01:00
Mike Auty
3eb463475b
Core: Refactor versioning and associated requirements
2020-07-29 20:18:03 +01:00
Mike Auty
2c39489790
Yarascan: Move most of yarascanning into a versionable plugin
...
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
2020-07-29 20:18:03 +01:00
Mike Auty
54b62709d1
Hashdump: Reformat and convert to proper byte handling
2020-07-28 20:49:27 +01:00
Jack Wenger and ikelos
465a7ca6ad
Added documentation and logging
2020-07-28 17:59:57 +01:00
Jack Wenger and ikelos
72bc40ee69
added hashdump
2020-07-28 17:59:57 +01:00
Mike Auty
13e36ec58a
Core: Rerun yapf across the codebase.
2020-07-28 16:57:48 +01:00
Mike Auty
61563350b3
Linux/Mac: Refactor *nix Utilities classes
2020-07-28 11:15:16 +01:00
Mike Auty
667329e2fd
Mac: Fix pslist pid_filter function
2020-07-23 02:02:01 +01:00
Mike Auty
9295f41586
Plugins: Convert existing plugins over to use a list for PIDs
2020-07-23 02:02:01 +01:00
Mike Auty
31600254b9
Codebase: Apply yapf across the codebase.
2020-07-23 01:31:41 +01:00
mtressler and ikelos
79cf041283
Update check_modules.py
...
Removed unnecessary header info. A symbol table without the module_kset struct will now raise a TypeError
2020-07-21 23:00:52 +01:00
Matt Tressler and ikelos
82a6b23669
Completed linux_check_modules. Added kobject extension as needed for check_module plugin
2020-07-21 23:00:52 +01:00
Mike Auty
a173f12fce
Plugins: Normalize InvalidAddress exception handling
2020-07-18 16:38:49 +01:00
Mike Auty
43ae291815
Plugins: Add back in the checks because the filter might trip them
2020-07-18 16:38:49 +01:00
Mike Auty
73ad2bcd4e
Plugins: Since procs have been instantiated, checks aren't needed
2020-07-18 16:38:49 +01:00
Mike Auty
d15b23aa19
Plugins: Fix pslist_method inconsistencies
2020-07-18 16:38:49 +01:00
Mike Auty