Matt Tressler and ikelos
34ff856a79
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
355c25fefb
added parameter type to generate_kernel_handler_info
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ddec0d482d
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
b9f5450ac3
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
44911bf54a
Fixed tty_check not finding the ttyhook module
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ec8e9161bf
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
2020-07-30 23:24:23 +01:00
Andrew Case
dec13f5082
Linux - stash the Linux kernel virtual address
2020-07-28 13:16:40 -05:00
Andrew Case and ikelos
75d4390255
Remove extra debug prints
2020-07-28 17:00:20 +01:00
Mike Auty
8481406488
Linux: Support stashing the KASLR
2020-07-28 17:00:20 +01:00
Mike Auty
a4b50d183d
Mac: Stash the verified ASLR shift and improve logging
2020-07-28 17:00:20 +01:00
Andrew Case and ikelos
f6a1b28424
First attempt and better DTB and ASLR validation. Debugging statements left in.
2020-07-28 17:00:20 +01:00
Mike Auty
a980374eb8
Automagic: Fix issue in recent refactor
2020-07-28 11:15:16 +01:00
Mike Auty
61563350b3
Linux/Mac: Refactor *nix Utilities classes
2020-07-28 11:15:16 +01:00
Mike Auty
79d44edd37
Automagic: Don't hide errors from manual stacker setting
2020-07-16 11:17:29 +01:00
Mike Auty
4cccbc2f69
Automagic: Fix os_chooser method
...
Two issues found:
* the plugin hierarchy always start volatility.plugins, so we need
to go to index 2.
* the layers weren't loaded at the time the stacker list was generated
so all other stackers failed.
2020-07-02 19:33:32 +01:00
Mike Auty
55dd1c6c2c
Automagic: Fix bad default parameter
2020-07-02 19:33:32 +01:00
Mike Auty
16c2ddb837
Automagic: Change stackers to including an exclusion list
2020-07-02 19:33:32 +01:00
Mike Auty
33d1c696e5
Automagic: Allow stackers to be configurable
2020-07-02 19:33:32 +01:00
Mike Auty
944bf2174f
Automagic: Split out the stacker code
2020-07-01 20:30:31 +01:00
Mike Auty
cf988944b9
Linux: Correct the ASLR for pre-masking (KASLR is still incorrect)
2020-06-23 16:56:40 +01:00
Hanno Heinrichs and ikelos
deb2b78312
Clear symbol cache after ASLR computation on Linux.
2020-06-23 16:45:22 +01:00
Hanno Heinrichs and ikelos
30226d2bdd
Fix find_aslr() function invocation for Linux.
2020-06-23 16:10:05 +01:00
Mike Auty
ede5ba07aa
Symbols: Apply symbol_masking option to IntermediateSymbolTables
2020-06-10 19:39:20 +01:00
Mike Auty
085ccc47e0
SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic
2020-06-10 19:39:20 +01:00
Mike Auty
573590878a
SymbolTable: Rework symbol_shift so it's part of the config
2020-06-10 19:39:20 +01:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
204657648a
Linux: Narrow in on a particular symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
94426ad313
Automagic: Ensure all layers can be reconstructed
2020-05-10 19:30:58 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
4587de356d
Fix issue with cleaning the symbol cache
2020-05-02 01:16:06 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
