Mike Auty
944bf2174f
Automagic: Split out the stacker code
2020-07-01 20:30:31 +01:00
Mike Auty
cf988944b9
Linux: Correct the ASLR for pre-masking (KASLR is still incorrect)
2020-06-23 16:56:40 +01:00
Hanno Heinrichs and ikelos
deb2b78312
Clear symbol cache after ASLR computation on Linux.
2020-06-23 16:45:22 +01:00
Hanno Heinrichs and ikelos
30226d2bdd
Fix find_aslr() function invocation for Linux.
2020-06-23 16:10:05 +01:00
Mike Auty
ede5ba07aa
Symbols: Apply symbol_masking option to IntermediateSymbolTables
2020-06-10 19:39:20 +01:00
Mike Auty
085ccc47e0
SymbolTableRequirement: Do a merry dance around ASLR shifts in automagic
2020-06-10 19:39:20 +01:00
Mike Auty
573590878a
SymbolTable: Rework symbol_shift so it's part of the config
2020-06-10 19:39:20 +01:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
204657648a
Linux: Narrow in on a particular symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
94426ad313
Automagic: Ensure all layers can be reconstructed
2020-05-10 19:30:58 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
4587de356d
Fix issue with cleaning the symbol cache
2020-05-02 01:16:06 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
31ddbaaa2e
Typing: Fix python3 format string/byte output issues
2019-11-27 11:30:14 +00:00
Mike Auty
a85f6f80f8
Linux automagic: Add support for more recent init_top_pgt symbol.
2019-11-22 22:40:52 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Mike Auty
373442ac24
pdbscan: Fix up permission error creating directories
2019-11-04 10:57:30 +00:00
xabiugarte and ikelos
bdee51fef0
Check progress_callback is not None before call
...
Followed the same approach as in
volatility/framework/symbols/windows/pdbconv.py
2019-10-23 09:56:55 +01:00
Mike Auty
71e082f25f
Ensure the layers are loaded on layer stacker run, not just when a layer is stacked.
2019-10-07 01:52:58 +01:00
Mike Auty
d3f1a396da
Handle JSON errors when caching banners.
2019-10-04 22:50:25 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
066a4e64f2
Minor fix for construct_layers.
2019-09-26 21:16:46 +01:00
Mike Auty
ae010a2390
Improve log levels and distribution of messages.
2019-09-26 21:16:12 +01:00
Mike Auty
211ad0d524
Remove useless calls to validate.
2019-09-26 15:58:22 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
dad88692b8
Minor improvements for pyinstaller packages.
2019-09-21 21:06:05 +01:00
Mike Auty
fc2ee7e401
Improve plugin category detection for systems such as volshell.
2019-09-16 11:36:43 +01:00
Mike Auty
421af88c29
Classmethod make_subconfig so other classmethods can use it.
2019-09-08 14:50:48 +01:00
Mike Auty
10ea65a236
Remove unnecessary imports.
2019-09-08 14:19:58 +01:00
Mike Auty
ffc7682d61
Ensure that layers are automatically imported when needed.
2019-09-08 14:13:28 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty