Mike Auty
73ad2bcd4e
Plugins: Since procs have been instantiated, checks aren't needed
2020-07-18 16:38:49 +01:00
Mike Auty
d15b23aa19
Plugins: Fix pslist_method inconsistencies
2020-07-18 16:38:49 +01:00
Mike Auty
7673dd8d2d
Mac: Consolidate methods of listing processes
...
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing. At the moment, the default (first in the method list)
is chosen. An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).
If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
0ccb1f82e6
Change copyright year and plugin doc strings
2020-07-18 16:38:49 +01:00
Andrew Case and ikelos
4799e8551e
Add process listing through examination of the process group hash table
2020-07-18 16:38:49 +01:00
Mike Auty
fb467332c6
Plugins: Yapf reformat linux check_creds plugin
2020-07-18 15:36:30 +01:00
mtressler and ikelos
8f1b338996
Update check_creds.py
...
changed behavior of plugin with it is run with a bad symbol table. Instead of a vollog.error, a TypeError exception is raised with information as to why it was raised.
Also removed unnecessary header info.
2020-07-18 15:29:30 +01:00
mtressler and ikelos
8071ebbebb
End of file cut off
2020-07-18 15:29:30 +01:00
Matt Tressler and ikelos
55d1d48fac
Created linux_check_creds plugin
2020-07-18 15:29:30 +01:00
Jan and ikelos
e5d51eb9b7
adds dynamic length of pool header alignments
2020-07-17 18:07:23 +01:00
Mike Auty
af1b8c03e7
Renderer: Rename StrLike to MultiTypeData
2020-07-16 19:44:18 +01:00
Dave Lassalle and ikelos
42a97dd10c
Registry: handle ints, multi strings, and binary data with StrLike
2020-07-16 19:44:18 +01:00
Mike Auty
ecddc40781
Printkey: Bump the required framework version due to the API changes.
2020-07-16 19:44:18 +01:00
Mike Auty
a5fc7323ec
Registry: Don't make assumptions about the default
2020-07-16 19:44:18 +01:00
Mike Auty
5571f19b09
Registry: Move StringLike from conversion to StrLike format_hint.
2020-07-16 19:44:18 +01:00
Mike Auty
626712324a
FrameworkInfo: List LayerStackers
2020-07-16 11:17:51 +01:00
Mike Auty
1b774bc69d
Yarascan: Bump plugin to include rule name (issue/PR #253 )
...
In order to try to version control the scanner, a version number was
added to the yarascan plugin along with a method for calling the
scanner.
2020-07-13 10:52:04 +01:00
Mike Auty
07ddbb60f7
Linux: Don't forget the pslist pid parameter
2020-07-11 10:32:15 +01:00
Andrew Case
2427a7c988
Linux - add an explicit version to lsmod
2020-07-10 15:41:25 -05:00
Michael Ligh and ikelos
87ff6dd87c
refs #200 raise ValueError if an object doesn't have a name
2020-07-01 20:51:22 +01:00
Mike Auty
888b432667
Mac: Fix an error decoding bad UTF-8 values
...
Closes #228 .
2020-06-28 01:07:16 +01:00
Mike Auty
0ffe318cb0
Project: Update copyright headers for files added in 2020.
2020-06-10 21:13:37 +01:00
Mike Auty
d3ba947a56
Mac: Fix case names of certain plugins
...
Closes #201 .
2020-06-10 21:02:16 +01:00
Mike Auty
c134cf6eca
Timeliner: Improve the option name
2020-06-10 20:33:04 +01:00
Mike Auty
1fe9cbd51d
timeliner: Add the bodyfile output requirement switch to the plugin
2020-06-10 20:33:04 +01:00
Mike Auty
32fb2364a1
Timeliner: Ensure blank lines aren't printed.
2020-06-10 20:33:04 +01:00
Mike Auty
fc27efc252
Add in body-file output support.
2020-06-10 20:33:04 +01:00
Mike Auty
5921671b38
timeliner: Yield as soon as we have output
2020-06-10 20:33:04 +01:00
Mike Auty
b9d0cf17e3
Fix the output of exceptions with timeliner.
2020-06-10 20:33:04 +01:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
37f40ed184
Linux: Fix a rebase error
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
superponible and ikelos
69be2157fb
fix typo
2020-05-27 23:16:18 +01:00
superponible and ikelos
48e33c2b98
create property for HiveGenerator invalid member
2020-05-27 23:16:18 +01:00
Mike Auty
a0da5fef83
Issue #186 : Rebase and apply yapf
2020-05-27 23:16:18 +01:00
superponible and ikelos
36c19735ee
issue #186 - hivelist with new hivescan/bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
002758c7f2
issue #186 - hivescan and hivelist with bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
a21ab89019
issue #186 - add bigpools plugin
2020-05-27 23:16:18 +01:00
superponible and ikelos
054d144f9b
issue #186 - walk forward, backward, scan if needed
2020-05-27 23:16:18 +01:00
superponible and ikelos
a4301afe22
issue #186 - skip type check on CMHIVE
2020-05-27 23:16:18 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
edecd64703
Yarascan: Fixes #209 by returning matched strings
2020-04-14 23:45:08 +01:00
Mike Auty
15d26ce415
Linux: Remove parameters that are unnecessary/removed.
2020-04-10 22:38:21 +01:00
Mike Auty
01ef78db11
Fix a typo in the last commit
2020-04-10 22:19:24 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Andrew Case and ikelos
719cd0d476
Move module gathering into generator
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Michael Ligh
d5bdf9633d
refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type
2020-04-07 09:22:52 -05:00
Mike Auty
bd2a382d88
CLI & windows.handles: Improve exception handling
2020-03-16 22:34:03 +00:00
Mike Auty