Matt Tressler and ikelos
34ff856a79
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ddec0d482d
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
b9f5450ac3
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
2020-07-30 23:24:23 +01:00
mtressler and ikelos
d61034bca8
Removed unnecessary code from tty_check.py
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
314b6aa2c6
added some documentation
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
44911bf54a
Fixed tty_check not finding the ttyhook module
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
512cc8b451
fixed some formatting for tty_check.py
2020-07-30 23:24:23 +01:00
Matt Tressler and ikelos
ec8e9161bf
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
2020-07-30 23:24:23 +01:00
Mike Auty
61563350b3
Linux/Mac: Refactor *nix Utilities classes
2020-07-28 11:15:16 +01:00
Mike Auty
9295f41586
Plugins: Convert existing plugins over to use a list for PIDs
2020-07-23 02:02:01 +01:00
Mike Auty
31600254b9
Codebase: Apply yapf across the codebase.
2020-07-23 01:31:41 +01:00
mtressler and ikelos
79cf041283
Update check_modules.py
...
Removed unnecessary header info. A symbol table without the module_kset struct will now raise a TypeError
2020-07-21 23:00:52 +01:00
Matt Tressler and ikelos
82a6b23669
Completed linux_check_modules. Added kobject extension as needed for check_module plugin
2020-07-21 23:00:52 +01:00
Mike Auty
fb467332c6
Plugins: Yapf reformat linux check_creds plugin
2020-07-18 15:36:30 +01:00
mtressler and ikelos
8f1b338996
Update check_creds.py
...
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
2020-07-18 15:29:30 +01:00
mtressler and ikelos
8071ebbebb
End of file cut off
2020-07-18 15:29:30 +01:00
Matt Tressler and ikelos
55d1d48fac
Created linux_check_creds plugin
2020-07-18 15:29:30 +01:00
Mike Auty
07ddbb60f7
Linux: Don't forget the pslist pid parameter
2020-07-11 10:32:15 +01:00
Andrew Case
2427a7c988
Linux - add an explicit version to lsmod
2020-07-10 15:41:25 -05:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
37f40ed184
Linux: Fix a rebase error
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
15d26ce415
Linux: Remove parameters that are unnecessary/removed.
2020-04-10 22:38:21 +01:00
Mike Auty
01ef78db11
Fix a typo in the last commit
2020-04-10 22:19:24 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Mike Auty
3f5b96f3c7
Yapf: Clean-up the whole codebase.
2020-01-14 15:44:07 +00:00
Andrew Case and ikelos
3bf3e0601a
Remove earliler trigger of SymbolError
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
a66e1bb6c2
Move symbol catching to generator
2020-01-03 17:50:06 +00:00
Andrew Case and ikelos
65556a2c92
Linux - update handling of kernels that do not have loadable module support
2020-01-03 17:50:06 +00:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty
9ac622afa0
Fix up import style to be consistent.
2019-10-01 23:46:02 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
71bb54379b
Refactor the plugin versioning to be simpler to define.
2019-08-27 21:08:29 +01:00
Mike Auty
47c349e240
Add plugin requirements for all plugins.
2019-08-27 21:08:29 +01:00
Mike Auty
5db6ade2ea
Change object_type parameter for object_from_symbol.
2019-08-14 20:50:42 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Andrew Case and ikelos
984615ebba
fix plugins for new API
2018-12-27 22:41:03 +00:00
Andrew Case and ikelos
2a0aec8104
switch linux_lsmod to absolute_symbol_addresses interface
2018-12-27 22:41:03 +00:00
