This adds the windowstations, desktops, and deskscan plugins, and
removes the gui.py plugin file that was stubbed out in the introductory
work for the effort.
It also adds a new method to the poolscanner class, but does not bump
the poolscanner version number since there is already a major version
number bump going into this PR.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the Windows pool extension with a new get_name() method,
and changes the method signature for another. We'll need to figure out
if there is a good way to version extension classes.
Deskscan requires this in order to use get_name with an alternate
(non-kernel) symbol table.
This updates all plugins that both depend on PEDump and won't require
breaking changes of their own. They now call the updated method
signature, and have their pedump requirement version bumped
appropriately.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates PEDump to use the latest version of PsList, updates the
dependency version number, changes one of it's own method signatures to
facilitate the pslist change, and does a major bump of its own version
number.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates all dependents on windows.pslist.PsList that could be
updated without breaking interface changes of their own to use the
latest windows.pslist.PsList plugin version with a simplified method
signature
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows.consoles.Consoles plugin to use the updated
hivelist method signature, changing one of its own method signatures as
required and doing a major version bump of its own.
Plugins that depend on consoles also have their method calls changed,
and their dependency versions bumped.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the debugregisters and suspended threads plugins' threads
requirement with the latest major version bump.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows.threads plugin with a method signature change:
`module_name` is now `kernel_module_name` for clarity.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the PESymbols plugin to use the latest changes from pslist
and modules. This required breaking interface changes of its own
(altered method signatures) and so receives its own major version bump.
Dependents of PESymbols that _don't_ require any breaking changes have
their method calls and version requirement numbers updated here as well.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the ssdt, truecrypt, drivermodule, driverirp, and verinfo
plugins to use the new method signatures from the Modules plugin, and
updates the requirement version numbers as well.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the ShimcacheMem plugins with the version bumps on the
modules and pslist requirements, updates the corresponding method calls,
and does a major version bump of its own due to a required breaking
method signature change.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the ScheduledTasks plugin with an updated hivelist
requirement version number, changes the corresponding method call, and
does a major version bump of its own due to a changed parameter name.
Co-authored-by: Andrew Case <andrew@dfir.org>
This fixes a simple InvalidAddressException traceback by just catching
the exception on the member access and continuing.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the netstat plugin to use the new method signature in the
modules plugin; however, this requires a breaking change of its own
which is done here as well. The major version is bumped accordingly;
this plugin has no dependents that require updates at this time.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the svcdiff plugin to use the latest changes from svclist
and svcscan, updating the requirement version numbers, and giving itself
a major version bump due to a changed method signature.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows SvcScan plugin with the latest changes from
hivelist/pslist, fixing up method calls and bumping requirement version
numbers. In order to use the new method signatures, breaking changes
were required to the svscan public methods, so a major version bump has
been added.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the svclist plugin with breaking changes to its public
methods in order to update calls to the svcscan methods. Both
requirement and plugin version numbers have been updated accordingly
here.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the orphan kernel threads plugin to use the latest changes
from the modules plugin, updating method signatures and bumping the
requirement version number. This required breaking interface changes in
the plugin itself, so the major version number has been bumped.
Co-authored-by: Andrew Case <andrew@dfir.org>
This uses the latest changes from windows.pslist, updated the
requirement version number. It also required breaking changes of its
own, so the Strings version number has been given a major version bump
as well.
Co-authored-by: Andrew Case <andrew@dfir.org>
This update the unhooked system calls plugin to use the latest changes
from pslist, updating the requirement version numbers and bumping its
own major version number due to a changed method signature.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the threads version number to the latest (2.0.0) and adds a
missing plugin requirement for thrdscan.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the poolscanner plugin with an additional method,
`generate_pool_scan_extended`, and does the corresponding minor version
bump.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the Windows Amcache plugin to use the latest changes in
Windows HiveList. It requires a major version bump of its own due to a
breaking method signature change, and is therefore in its own commit.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates all plugins that depend on windows.hivelist.HiveList to use
the updated method signature, and bumps their dependency version
accordingly.
Co-authored-by: Andrew Case <andrew@dfir.org>
This simplifies the `build_module_collection` signature to take a single
`kernel_module_name` parameter instead of `layer_name` and
`symbol_table_name` parameters, both of which would only ever belong to
the kernel anyway. This will prevent future confusion for consumers of
this method.
Co-authored-by: Andrew Case <andrew@dfir.org>
This cleans up the APIs for some methods in the modscan/modules plugins
that currently take separate symbol_table_name and layer_name
parameters, when it really makes more sense to just pass in the context
and the kernel module name.
It also updates the pslist plugin requirement version, and uses the
updated method signatures.
Co-authored-by: Andrew Case <andrew@dfir.org>
This adds a new classmethod, `list_processes_from_kernel`, updates the
`list_processes` method signature to use only the kernel module name and
the context instead of splitting information about the kernel between
the layer_name and symbol_table_name paramters, and does a major version
number increase on the plugin.
Also updates the documentation to reflect pslist method signature
change.
Co-authored-by: Andrew Case <andrew@dfir.org>
David McDonald