Analyst
b1c3ecfa17
add mutantscan
2019-02-27 12:49:50 -06:00
Mike Auty
8c85d133f0
Update plugins that used create_filter to filter on pids.
2019-02-27 17:39:17 +00:00
Mike Auty
a3dfb9661f
Update create_filter method to actually filter appropriately.
2019-02-27 17:39:17 +00:00
Analyst
d4e12c982d
fix a critical issue determining the names of windows kernel objects from the object header
2019-02-27 10:45:36 -06:00
Analyst
8baafaac7b
add handle offset to the handles plugin output
2019-02-27 10:14:52 -06:00
Analyst
224ea8ee2a
add the filescan plugin
2019-02-27 08:46:39 -06:00
Mike Auty
26ae324050
Add in attempt at name demangling for symbols.
2019-02-27 11:26:24 +00:00
Mike Auty
2b001fad4d
Make sure we get 4 ints, not 8 shorts.
2019-02-26 23:02:34 +00:00
Mike Auty
72c4deaf66
Revamp the ip address conversion code and reformat mac files.
2019-02-26 22:59:21 +00:00
Mike Auty
b1537f0789
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
2019-02-26 22:25:46 +00:00
Mike Auty
03eddbfb74
Fix missing imports removed by the rebase.
2019-02-26 22:25:15 +00:00
Andrew Case and ikelos
451f73bfe2
change generic.GenericIntelProcess -> objects.Struct
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
75a6113369
remove another int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
7d15a1667e
remove int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
932246e11e
remove header on netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c9adc6a0fa
remove usage of old string methods
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c5cc88b245
actually add mac_netstat plugin
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
6d2a5fbfaa
add mac_netstat and supporting networking code
2019-02-26 22:20:33 +00:00
Mike Auty
d8413efc1d
Add in further ignoring of the 0xf7 unicode character.
2019-02-25 22:51:41 +00:00
Mike Auty
e0d2edbca1
Remove ord for unsigned int and don't cast int objects to ints.
2019-02-24 23:56:34 +00:00
Michael Ligh
d68b94965c
catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue()
2019-02-24 17:14:28 -06:00
Analyst
63787acb50
fix the handling of TypeInfo after 9b488f8
2019-02-24 15:24:37 -06:00
Mike Auty
b335b2320d
Minor performance fix for PE extension and yapf of poolscanner.
2019-02-18 00:07:19 +00:00
Mike Auty
6b3eef4083
Additional optimization by extracting the struct calls from the intel translation methods.
2019-02-14 23:42:06 +00:00
Mike Auty
7b06480d7e
Major speed-up for bulk scanning of images.
2019-02-14 22:14:32 +00:00
Mike Auty
b6e3b8c5cc
Add in minor optimizations.
2019-02-14 21:23:43 +00:00
Mike Auty
4e8c8a7232
Fix issues with SymbolRequirement refactoring.
2019-02-11 22:30:22 +00:00
Michael Ligh and ikelos
12fe297c80
builtin_constraints() returns all constraints by default
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
f34cd01b09
small style change for readability
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
33f3f4372c
parameterize generate_pool_scan() - let plugins choose which contraints to use
...
plugins can choose from a list of built-ins or they can create their own and pass them into generate_pool_scan()
2019-02-07 09:08:32 +00:00
Michael Ligh and ikelos
c1341e6278
refactor poolscanner to be leveraged by other plugins. add psscan
2019-02-07 09:08:32 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Michael Ligh and ikelos
d23e6474ce
reference windows metadata & PE values from ISF as the primary method of determining OS version
2019-02-06 21:11:20 +00:00
Mike Auty
df41a0cf50
Fix up Vad extensions now that Chars are ints rather than bytes.
2019-02-06 21:08:52 +00:00
Mike Auty
9b488f89fd
Make the default python-type for Chars an int rather than a bytes.
2019-02-06 21:06:12 +00:00
Mike Auty
0a13942cd7
Add a missing property keyword for the metadata method.
2019-02-06 17:46:07 +00:00
Mike Auty
71fb77f624
Remove the mis-committed print statements. 5;)
2019-02-06 09:14:03 +00:00
Michael Ligh
f61fba8e00
the vad end should be the last byte in the last page (i.e. ending in 0xfff)
2019-02-05 21:05:17 -06:00
Mike Auty
4c2a29ae01
Convert to ruamel.yaml and allow \x7f characters, since llvm sometimes outputs them.
2019-01-27 18:20:59 +00:00
Mike Auty
35451e3514
Initial attempt at supporting symbols from llvm-8.
2019-01-25 01:35:36 +00:00
Mike Auty
43cc7b836c
Fix small typo in llvm2json utility.
2019-01-25 01:35:00 +00:00
Mike Auty
fcd77b4c5f
Update the documentation to support the wrapper with autodoc-typehints.
2019-01-21 22:10:18 +00:00
Mike Auty
db63b2b345
Add support for directly running llvm-pdbutil.
2019-01-21 01:24:16 +00:00
Mike Auty
2080d5625f
Update llvm2json with metadata and a command line parser.
2019-01-21 01:15:40 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
1071dca087
Add in a rudimentary (read ugly) convertor for llvm pdb2yaml files.
...
This will need some help from @npetroni in places, but produces
close-to-identical JSON files for pdbs.
It does not yet produce metadata, base_types, or any symbols (since
they aren't exported by llvm-pdbutil's pdb2yaml) or base_types.
Ideally all of those can be fixed over time, but the symbols will
require changing llvm. 5:(
2019-01-20 00:10:06 +00:00
Mike Auty
6baf21486b
Ensure the failures are sorted for volshell as they are in the CLI.
2019-01-18 12:38:12 +00:00
Mike Auty
ed795f7e33
Provide better failure responses for TranslationLayerRequirements and SymbolRequirements.
...
Improves issue #59 .
2019-01-18 12:19:31 +00:00
Mike Auty
0ee335237a
Improve the protection of empty regular expressions (improves issue #61 ).
2019-01-18 11:27:24 +00:00
Mike Auty
3078141352
Fix typing for python < 3.6.1.
2019-01-03 01:34:04 +00:00
Analyst