Commit Graph
57 Commits
Author SHA1 Message Date
Mike Auty 98624203c4 Add in windows swap-file automagic. 2018-02-11 18:35:40 +00:00
Mike Auty 265182b66b Fix bug that massively broken the wintelstacker, slowing everything else down. 2017-12-13 20:48:52 +00:00
Mike Auty f40fae197d Convert to python3.5 syntax (no local type-annotations). 2017-12-13 20:48:52 +00:00
Mike Auty 6c52e04489 Fix up exception in DTBtests.
The exception was being caused by reading too little data from the
stream.  We now skip it if that happens.
2017-12-13 20:48:52 +00:00
Mike Auty 2cc456e847 Finish off the automagic directory type annotations. 2017-12-13 20:48:52 +00:00
Mike Auty 30059766b6 Plug the WindowsMixin into the automagic. 2017-11-24 12:02:34 +00:00
Mike Auty b7c8c8a058 Improve the docstrings for automagic. 2017-07-29 12:53:35 +01:00
Mike Auty 16b1aca56b Make the WintelHelper documentation accurate again. 2017-05-06 10:56:21 +01:00
Mike Auty 6e9791deb0 Add some more safety checks (to get pycharm off my back) and ensure we don't go round in circles. 2017-05-01 15:59:24 +01:00
Mike Auty 44d8af70e0 Ensure we don't run the DTB finder twice. 2017-05-01 14:34:52 +01:00
Mike Auty e182e44815 Remove all hardcoded PAGE_SIZE variables, and expose more Intel variables. 2017-04-30 22:09:26 +01:00
Mike Auty 149e57afee Change the requirement validation system to return all unsatisfied requirements, to provide more feedback. 2017-01-08 17:26:09 +00:00
Mike Auty 5fe078e487 Adapt Automagic to have requirements, and convert the Stacker's single_location parameter to make use of it. 2016-12-29 15:21:39 +00:00
Mike Auty 88e9786967 Improve the requirements documentation. 2016-12-28 22:33:17 +00:00
Mike Auty aee4349e3c More documentation updates (and minor code cleanups). 2016-12-28 03:20:44 +00:00
Mike Auty bab71d4358 Refactor the progress_callback so it can be used in automagics.
Refactored the location of the progress_callback so that the UI can
specify it and ensure it is used by the automagics process as well as
the plugins themselves.

The progress_callback function has also had an optional description parameter
added, so that it can differentiated in case two scans happen
simultaneously.
2016-12-26 23:45:47 +00:00
Mike Auty 1c85db0c31 Add in multi-processing on TranslationLayer scan method. 2016-12-25 13:45:08 +00:00
Mike Auty d51dd2a992 Add in TODOs for future heuristic enhancements. 2016-12-24 19:45:02 +00:00
Mike Auty 23e61d9756 Add in a little more information to the debug log. 2016-12-22 16:00:46 +00:00
Mike Auty bbabf4db0e Add in a heuristic for finding the correct DTB on recent Win10.
This removes again the single_page_map_offset configuration value,
and requires that a full/correct config be used to supply a manual DTB
value.

The expectation is that the single_page_map_offset feature be
re-introduced but override *all* scanning (so the scanning doesn't take
place even if the stacking does).
2016-12-22 15:44:07 +00:00
Mike Auty d232be2f6e Try to update the generic dtb finder to rule out false positives. 2016-10-01 22:13:42 +01:00
Mike Auty 1a83470993 Convert dtbfinder to a standalone app.
This is in development so that it's clearly not production code
(and should not expect to be supported as such).
2016-09-25 19:33:04 +01:00
Mike Auty 01616af655 Remove comment, it's already been converted. 2016-08-24 01:11:46 +01:00
Mike Auty 546bca1893 Rename the IntelHelper to make it a little more accurate. 2016-08-22 02:28:20 +01:00
Mike Auty 3dc161f9b4 Rework Translation Layers to tie more closely to configurations
This change is quite signficant, and requires that TranslationLayers
get all additional parameters that they need through their requirements.

These are now automatically enumerated and populated on object
construction based on the requirements, so should not require lots of
repetitive filling out of fields.

It does come with the downside that TranslationLayers can only be
contructed with a context (and appropiate config), but TLs in particular
always require a context (to contain the base layer) and blank configs
can be constructed relatively easily (convenience functions can be added
if necessary).

This allows configuration trees to be built up, and their configs
spliced into an existing config (as if it were being loaded from a
file).

Not all ConstructableRequirements use this method, since SymbolTables
(for example) do not have access to the context or config_path in order
to get to any parameters stored in the context's config.  They therefore
are still passed their requirement values as __init__ parameters
instead.
2016-08-22 02:20:10 +01:00
Mike Auty 7648c94083 Add in the intial works at a stacking plugin to emulate volatility 2 address space stacking. 2016-08-22 00:00:21 +01:00
Mike Auty f0cf128bdd Add in the self-referential tests to the standalone component of the windows automagic module. 2016-08-20 16:55:32 +01:00
Mike Auty c38d650819 Add in generic self-referential tests. 2016-08-20 16:54:04 +01:00
Mike Auty 77f295f0a4 Calculate the pointer size, rather than taking it as an argument. 2016-08-20 16:53:36 +01:00
Mike Auty 2467917431 Fix up DTB Finder which was broken in commit eccfb1c2. 5:S 2016-08-20 14:16:02 +01:00
Mike Auty 6712d5dee1 Update the automagic uses to ensure a consistent ordering of the arguments. 2016-08-17 20:38:18 +01:00
Mike Auty db21d4628c Rework importing of interfaces, a little more verbose in the code, but a little less complex to import and name. 2016-08-16 10:54:57 +01:00
Mike Auty e02feed16e Python 3 has a sane super() implementation (no arguments), so convert to using that. 2016-08-14 00:55:02 +01:00
Mike Auty c160698465 Add in comment concerning when the dtb finder fails. 2016-08-01 00:39:49 +01:00
Mike Auty cb1b226bbb Fix an obvious typo. 2016-07-30 18:38:12 +01:00
Mike Auty 8fc925a920 Remove the obsolete generic scan (it was only generic for 64-bit register size). 2016-07-30 18:38:03 +01:00
Mike Auty eccfb1c247 Conver the individual tests to the scanner framework, and work that into the automagic. 2016-07-30 18:20:14 +01:00
Mike Auty 0a0054e30a Make the logging a bit clearer and remove the print statement. 2016-07-30 02:41:26 +01:00
Mike Auty b92ccd771f Fix up the DTB finder code and stick it all together. 2016-07-30 02:35:40 +01:00
Mike Auty 14c0cc262c Significantly rework the configuration system.
So this is where I ripped out the guts of the dependency tree
and made it a little better defined in some ways, and delayed
populating it in others.  The validate function signature has
changed and I'm still up in the air whether to validate with
True/False or throw/catch exceptions.

So now, configurables have a list of requirements, these are
then bundled into a single requirement and can be passed to
automagic.  Automagic runs a set of things over the deptree
to help build/manage it.  These run in order of priority.

The tree is still built from the top down, but now automagic
can build branch from the bottom up and try and splice them
into the tree where appropriate.  Hopefully this will make it
easier to see follow.
2016-07-29 03:24:52 +01:00
Mike Auty 8e49c66049 Ensure we don't find bogus DTBs, but do still allow non-usr-count DTBs. 2016-02-27 14:11:40 +00:00
Mike Auty 9fce3a4b1f Tidy up the tests and add a bit of error checking to the dtb finder. 2016-02-27 11:53:44 +00:00
Mike Auty b06306f884 Fix reducing the tuple mid sorting. 2016-02-27 01:50:38 +00:00
Mike Auty 445031c880 Unfix the self-referential checker. 2016-02-27 01:43:03 +00:00
Mike Auty 29e75339df Fix the self-referential checker again. 2016-02-27 01:40:01 +00:00
Mike Auty dbcb59e0e9 Fix the self-referential checker. 2016-02-27 01:38:29 +00:00
Mike Auty 8ab1dedd44 Change the output to hide the ordering data, and fix up the standalone tool a little bit. 2016-02-26 20:36:57 +00:00
Mike Auty afd28575ca Re-check constraints when building the tree, in case they change. Also comment on why we don't use that when trimming the possibilties for windows automagic. 2016-02-25 22:03:49 +00:00
Mike Auty d6cc66cb77 Add in self referential checker, should windows change what it does. 2016-02-23 10:16:27 +00:00
Mike Auty 1fd8eecebd Ensure we take into account ignored/NX bits when DTB finding. 2016-02-23 10:15:50 +00:00