Commit Graph
278 Commits
Author SHA1 Message Date
Mike Auty 4e8c8a7232 Fix issues with SymbolRequirement refactoring. 2019-02-11 22:30:22 +00:00
Mike Auty f898dca296 Refactor SymbolRequirement to SymbolTableRequirement for clarity. 2019-02-06 21:26:32 +00:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty b13fcb186c Improve typing issues. 2019-01-03 01:13:53 +00:00
Mike Auty 19f908b075 Rejig pdbscan to find potential offsets then check them.
Originally we found physical offsets for pdbs that matched,
then found potential offsets and tested them against each other.

Now, we find the potential offsets and then look for pdbs at that offset
(technically within a 4Mb block after the start).  The scanning is quick
(probably quicker than scanning the whole physical space) and should
catch most pdbs unless they're splayed out in virtual memory.
2019-01-01 01:14:34 +00:00
Mike Auty afdd8b657e Fix memory problems with banner_caches.
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required.  As the cache builders are separate at the
moment, we previously ran banner searches without any banners.  This was
bad.  It inflated memory hugely and killed the buildbot.

We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Andrew Caseandikelos 731447000d avoid use of _context in extension 2018-12-27 22:41:03 +00:00
Mike Auty 59d3f2b8ee Clean up an unecessary import. 2018-12-25 16:48:15 +00:00
Mike Auty 4308245499 Revert "prevent double shifting of ASLR slides"
This reverts commit 2655fd1666.
2018-12-20 15:40:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Andrew Case 2655fd1666 prevent double shifting of ASLR slides 2018-12-19 11:12:58 -06:00
Mike Auty 7ca5514b83 Remove long-broken convenience code from ConfigurableInterface.
In the dim and distant past, I seemingly thought it a good idea to copy
all the values out of an object's config and into local private
attributes (I guess to avoid config lookups?).  It turns out, it was
always broken because it looking at the root of the config tree, rather
than under the object's specific config settings.

This first turned up as an issue where self._meta_layer was being
overwritten by None in the vmware layer.  Removing this resolved the
issue.
2018-12-17 22:08:24 +00:00
Mike Auty de4fa6df51 Ensure we can see how the stacker is acting. 2018-12-17 17:32:46 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 76e81eb478 Fix up python-3.5 type syntax. 2018-12-17 09:09:34 +00:00
Mike Auty b61ac3bd47 Many more typing fixes. 2018-12-17 01:17:06 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 6e43d0bab4 Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it). 2018-12-13 15:56:24 +00:00
Mike Auty cd7296d64e Fix up based on the recent master refactoring. 2018-12-13 15:56:24 +00:00
Mike Auty 3a2c2b30a9 Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things. 2018-12-13 15:56:24 +00:00
Mike Auty 25fb05c9bf Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address. 2018-12-13 15:56:24 +00:00
Mike Auty 57b2a5bab7 Fix up a rogue classmethod, and ensure we have a separate variable for the new layer. 2018-12-13 15:56:24 +00:00
Mike Auty 5135215c62 Do some tidying and renaming. 2018-12-13 15:56:24 +00:00
Mike Auty 7a462d5f85 Refactor out the shared symbol cache/finder code from linux and mac. 2018-12-13 15:56:24 +00:00
Mike Auty 55286f04cb Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat. 2018-12-13 15:56:24 +00:00
Andrew Caseandikelos 622c86f9ed Add initial mac backend code, with broken DTB finding, along with the pslist plugin 2018-12-13 15:56:24 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty 918653e398 Convert aslr_mask_symbol_table to more parameterized form. 2018-12-08 17:55:13 +00:00
Mike Auty 5a331f9f01 A few remaining changes due to the API aleration. 2018-12-07 01:47:16 +00:00
Mike Auty 341b9b8f9e Add in initial changes for scanner sections. 2018-12-07 01:47:16 +00:00
Mike Auty 3f2f3cd2f3 Add a reminder to fix up the API in this place. 2018-12-03 21:52:29 +00:00
Mike Auty 3900f38262 Remove vestigal trace of NlpDtbFinder. 2018-11-13 11:43:14 +00:00
Mike Auty e27ba8d089 Fix up naming for objects/symbols_utility imports. 2018-11-08 00:48:38 +00:00
Mike Auty ac0f1a2cd0 Fix up a remaining typo, and two typing questions. 2018-11-08 00:19:17 +00:00
Mike Auty db7320e426 Bulk lint and a couple of typos fixed. 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos c6ca2666b6 Update aslr calculation to correctly handle physical shifts and also to cache results 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 625952680a mass convert hasattr -> has_member 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos b868f41c95 Fix get_path_file call 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 6254538371 Properly use expeption type 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos a015e69b84 Update the use of symbols and objects class and add comments about dentry traversal 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos a8adf4eaea Fix find_aslr for swapper isgnature and throwing exception instead of returning None 2018-11-08 00:19:17 +00:00
Andrew Caseandikelos 98e472e211 major updates and new plugins 2018-11-08 00:19:17 +00:00
Mike Auty 813e3ec5eb Remove NLP DTB finder, since it seems most other scanners cover all the bases. 2018-11-07 20:12:24 +00:00
Mike Auty 001d53e768 Rework some code to help with typing. 2018-11-01 11:17:15 +00:00
Mike Auty e3e1c4e00b Initial commit of pyinstaller spec. Some changes to path handling to help. 2018-10-30 23:56:34 +00:00
Mike Auty f76aa66805 Reduce the risk of scanning the entire virtual address space, given we've already found potential kernels. 2018-10-26 22:39:36 +01:00
Mike Auty e9bad27793 Add in kdbg_offset method for pdbscan, and make the module_offset the third choice. 2018-10-26 22:28:09 +01:00