Analyst
224ea8ee2a
add the filescan plugin
2019-02-27 08:46:39 -06:00
Mike Auty
26ae324050
Add in attempt at name demangling for symbols.
2019-02-27 11:26:24 +00:00
Mike Auty
2b001fad4d
Make sure we get 4 ints, not 8 shorts.
2019-02-26 23:02:34 +00:00
Mike Auty
72c4deaf66
Revamp the ip address conversion code and reformat mac files.
2019-02-26 22:59:21 +00:00
Mike Auty
b1537f0789
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
2019-02-26 22:25:46 +00:00
Mike Auty
03eddbfb74
Fix missing imports removed by the rebase.
2019-02-26 22:25:15 +00:00
Andrew Case and ikelos
451f73bfe2
change generic.GenericIntelProcess -> objects.Struct
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
75a6113369
remove another int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
7d15a1667e
remove int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
932246e11e
remove header on netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c9adc6a0fa
remove usage of old string methods
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c5cc88b245
actually add mac_netstat plugin
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
6d2a5fbfaa
add mac_netstat and supporting networking code
2019-02-26 22:20:33 +00:00
Mike Auty
d8413efc1d
Add in further ignoring of the 0xf7 unicode character.
2019-02-25 22:51:41 +00:00
Mike Auty
e0d2edbca1
Remove ord for unsigned int and don't cast int objects to ints.
2019-02-24 23:56:34 +00:00
Michael Ligh
d68b94965c
catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue()
2019-02-24 17:14:28 -06:00
Analyst
63787acb50
fix the handling of TypeInfo after 9b488f8
2019-02-24 15:24:37 -06:00
Mike Auty
b335b2320d
Minor performance fix for PE extension and yapf of poolscanner.
2019-02-18 00:07:19 +00:00
Mike Auty
6b3eef4083
Additional optimization by extracting the struct calls from the intel translation methods.
2019-02-14 23:42:06 +00:00
Mike Auty
7b06480d7e
Major speed-up for bulk scanning of images.
2019-02-14 22:14:32 +00:00
Mike Auty
b6e3b8c5cc
Add in minor optimizations.
2019-02-14 21:23:43 +00:00
Mike Auty
4e8c8a7232
Fix issues with SymbolRequirement refactoring.
2019-02-11 22:30:22 +00:00
Michael Ligh and ikelos
12fe297c80
builtin_constraints() returns all constraints by default
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
f34cd01b09
small style change for readability
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
33f3f4372c
parameterize generate_pool_scan() - let plugins choose which contraints to use
...
plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
c1341e6278
refactor poolscanner to be leveraged by other plugins. add psscan
2019-02-07 09:08:32 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Michael Ligh and ikelos
d23e6474ce
reference windows metadata & PE values from ISF as the primary method of determining OS version
2019-02-06 21:11:20 +00:00
Mike Auty
df41a0cf50
Fix up Vad extensions now that Chars are ints rather than bytes.
2019-02-06 21:08:52 +00:00
Mike Auty
9b488f89fd
Make the default python-type for Chars an int rather than a bytes.
2019-02-06 21:06:12 +00:00
Mike Auty
0a13942cd7
Add a missing property keyword for the metadata method.
2019-02-06 17:46:07 +00:00
Mike Auty
71fb77f624
Remove the mis-committed print statements. 5;)
2019-02-06 09:14:03 +00:00
Michael Ligh
f61fba8e00
the vad end should be the last byte in the last page (i.e. ending in 0xfff)
2019-02-05 21:05:17 -06:00
Mike Auty
4c2a29ae01
Convert to ruamel.yaml and allow \x7f characters, since llvm sometimes outputs them.
2019-01-27 18:20:59 +00:00
Mike Auty
35451e3514
Initial attempt at supporting symbols from llvm-8.
2019-01-25 01:35:36 +00:00
Mike Auty
43cc7b836c
Fix small typo in llvm2json utility.
2019-01-25 01:35:00 +00:00
Mike Auty
fcd77b4c5f
Update the documentation to support the wrapper with autodoc-typehints.
2019-01-21 22:10:18 +00:00
Mike Auty
db63b2b345
Add support for directly running llvm-pdbutil.
2019-01-21 01:24:16 +00:00
Mike Auty
2080d5625f
Update llvm2json with metadata and a command line parser.
2019-01-21 01:15:40 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
1071dca087
Add in a rudimentary (read ugly) convertor for llvm pdb2yaml files.
...
This will need some help from @npetroni in places, but produces
close-to-identical JSON files for pdbs.
It does not yet produce metadata, base_types, or any symbols (since
they aren't exported by llvm-pdbutil's pdb2yaml) or base_types.
Ideally all of those can be fixed over time, but the symbols will
require changing llvm. 5:(
2019-01-20 00:10:06 +00:00
Mike Auty
6baf21486b
Ensure the failures are sorted for volshell as they are in the CLI.
2019-01-18 12:38:12 +00:00
Mike Auty
ed795f7e33
Provide better failure responses for TranslationLayerRequirements and SymbolRequirements.
...
Improves issue #59 .
2019-01-18 12:19:31 +00:00
Mike Auty
0ee335237a
Improve the protection of empty regular expressions (improves issue #61 ).
2019-01-18 11:27:24 +00:00
Mike Auty
3078141352
Fix typing for python < 3.6.1.
2019-01-03 01:34:04 +00:00
Mike Auty
b13fcb186c
Improve typing issues.
2019-01-03 01:13:53 +00:00
Mike Auty
8838099845
Don't hard code the error levels for logging.
2019-01-03 00:40:36 +00:00
Mike Auty
6bb927ebfa
Fix up terminology to ensure we only refer to layers not spaces.
2019-01-03 00:40:13 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Mike Auty
19f908b075
Rejig pdbscan to find potential offsets then check them.
...
Originally we found physical offsets for pdbs that matched,
then found potential offsets and tested them against each other.
Now, we find the potential offsets and then look for pdbs at that offset
(technically within a 4Mb block after the start). The scanning is quick
(probably quicker than scanning the whole physical space) and should
catch most pdbs unless they're splayed out in virtual memory.
2019-01-01 01:14:34 +00:00
Analyst