Andrew Case and ikelos
0ccb1f82e6
Change copyright year and plugin doc strings
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
4799e8551e
Add process listing through examination of the process group hash table
2020-07-18 16:38:49 +01:00
Mike Auty
fb467332c6
Plugins: Yapf reformat linux check_creds plugin
2020-07-18 15:36:30 +01:00
mtressler and ikelos
8f1b338996
Update check_creds.py
...
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
2020-07-18 15:29:30 +01:00
mtressler and ikelos
8071ebbebb
End of file cut off
2020-07-18 15:29:30 +01:00
Matt Tressler and ikelos
55d1d48fac
Created linux_check_creds plugin
2020-07-18 15:29:30 +01:00
Jan and ikelos
e5d51eb9b7
adds dynamic length of pool header alignments
2020-07-17 18:07:23 +01:00
Mike Auty
af1b8c03e7
Renderer: Rename StrLike to MultiTypeData
2020-07-16 19:44:18 +01:00
Dave Lassalle and ikelos
42a97dd10c
Registry: handle ints, multi strings, and binary data with StrLike
2020-07-16 19:44:18 +01:00
Mike Auty
ecddc40781
Printkey: Bump the required framework version due to the API changes.
2020-07-16 19:44:18 +01:00
Mike Auty
a5fc7323ec
Registry: Don't make assumptions about the default
2020-07-16 19:44:18 +01:00
Mike Auty
5571f19b09
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
626712324a
FrameworkInfo: List LayerStackers
2020-07-16 11:17:51 +01:00
Mike Auty
1b774bc69d
Yarascan: Bump plugin to include rule name (issue/PR #253 )
...
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
2020-07-13 10:52:04 +01:00
Mike Auty
07ddbb60f7
Linux: Don't forget the pslist pid parameter
2020-07-11 10:32:15 +01:00
Andrew Case
2427a7c988
Linux - add an explicit version to lsmod
2020-07-10 15:41:25 -05:00
Michael Ligh and ikelos
87ff6dd87c
refs #200 raise ValueError if an object doesn't have a name
2020-07-01 20:51:22 +01:00
Mike Auty
888b432667
Mac: Fix an error decoding bad UTF-8 values
...
Closes #228 .
2020-06-28 01:07:16 +01:00
Mike Auty
0ffe318cb0
Project: Update copyright headers for files added in 2020.
2020-06-10 21:13:37 +01:00
Mike Auty
d3ba947a56
Mac: Fix case names of certain plugins
...
Closes #201 .
2020-06-10 21:02:16 +01:00
Mike Auty
c134cf6eca
Timeliner: Improve the option name
2020-06-10 20:33:04 +01:00
Mike Auty
1fe9cbd51d
timeliner: Add the bodyfile output requirement switch to the plugin
2020-06-10 20:33:04 +01:00
Mike Auty
32fb2364a1
Timeliner: Ensure blank lines aren't printed.
2020-06-10 20:33:04 +01:00
Mike Auty
fc27efc252
Add in body-file output support.
2020-06-10 20:33:04 +01:00
Mike Auty
5921671b38
timeliner: Yield as soon as we have output
2020-06-10 20:33:04 +01:00
Mike Auty
b9d0cf17e3
Fix the output of exceptions with timeliner.
2020-06-10 20:33:04 +01:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
37f40ed184
Linux: Fix a rebase error
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
superponible and ikelos
69be2157fb
fix typo
2020-05-27 23:16:18 +01:00
superponible and ikelos
48e33c2b98
create property for HiveGenerator invalid member
2020-05-27 23:16:18 +01:00
Mike Auty
a0da5fef83
Issue #186 : Rebase and apply yapf
2020-05-27 23:16:18 +01:00
superponible and ikelos
36c19735ee
issue #186 - hivelist with new hivescan/bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
002758c7f2
issue #186 - hivescan and hivelist with bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
a21ab89019
issue #186 - add bigpools plugin
2020-05-27 23:16:18 +01:00
superponible and ikelos
054d144f9b
issue #186 - walk forward, backward, scan if needed
2020-05-27 23:16:18 +01:00
superponible and ikelos
a4301afe22
issue #186 - skip type check on CMHIVE
2020-05-27 23:16:18 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
edecd64703
Yarascan: Fixes #209 by returning matched strings
2020-04-14 23:45:08 +01:00
Mike Auty
15d26ce415
Linux: Remove parameters that are unnecessary/removed.
2020-04-10 22:38:21 +01:00
Mike Auty
01ef78db11
Fix a typo in the last commit
2020-04-10 22:19:24 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Andrew Case and ikelos
719cd0d476
Move module gathering into generator
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Michael Ligh
d5bdf9633d
refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type
2020-04-07 09:22:52 -05:00
Mike Auty
bd2a382d88
CLI & windows.handles: Improve exception handling
2020-03-16 22:34:03 +00:00
Mike Auty
b8bc0f0ed6
mac.netstat: Fix up typing and interface imports
2020-03-12 19:53:51 +00:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
