Mike Auty
888b432667
Mac: Fix an error decoding bad UTF-8 values
...
Closes #228 .
2020-06-28 01:07:16 +01:00
Mike Auty
0ffe318cb0
Project: Update copyright headers for files added in 2020.
2020-06-10 21:13:37 +01:00
Mike Auty
d3ba947a56
Mac: Fix case names of certain plugins
...
Closes #201 .
2020-06-10 21:02:16 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Andrew Case and ikelos
719cd0d476
Move module gathering into generator
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Mike Auty
b8bc0f0ed6
mac.netstat: Fix up typing and interface imports
2020-03-12 19:53:51 +00:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
5a99d35a9e
update timer code
2020-02-12 19:56:37 +00:00
Andrew Case and ikelos
29cc435b5e
update sysctl v2
2020-02-12 19:17:19 +00:00
Mike Auty
3f5b96f3c7
Yapf: Clean-up the whole codebase.
2020-01-14 15:44:07 +00:00
Mike Auty
fda64dde95
Mac tasks: Swap the shortcircuiting order
2020-01-13 14:13:37 +00:00
Andrew Case and ikelos
d7f5a13c46
Mac - properly check for broken proc pointers
2020-01-03 19:42:18 +00:00
Mike Auty
face38436e
layers: Fix up uses of is_valid.
2019-11-12 09:09:51 +00:00
Mike Auty
73aa73f30e
Ensure we test None using is rather than ==.
2019-11-03 22:46:20 +00:00
atcuno
545376d725
Mac - update trustedbsd
2019-10-17 15:30:13 -04:00
Mike Auty
10a379b0ee
Make 'import as' consistent and ensure proper plugin dependencies.
2019-10-02 01:25:03 +01:00
Mike Auty
9ac622afa0
Fix up import style to be consistent.
2019-10-01 23:46:02 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Andrew Case and ikelos
bf29e23e1c
add updated mac ifconfig support
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
2a98227306
Mac - have pstree inherit from tasks
2019-09-26 23:11:26 -05:00
Andrew Case
b1d07396a0
Mac - have psaux inherit from tasks
2019-09-26 23:08:33 -05:00
Andrew Case
49c4ae2aa4
Mac - have bash inherit from tasks
2019-09-26 23:05:49 -05:00
Andrew Case
a6e7c7a919
Mac - have malfind inherit from tasks
2019-09-26 23:01:37 -05:00
Andrew Case
7339c12eaa
Mac - have proc maps inherit from tasks
2019-09-26 22:52:45 -05:00
Andrew Case
3af593c16a
Mac - switch netstat to inherit from tasks
2019-09-26 22:07:41 -05:00
Andrew Case
2d7bc99d6a
Mac - make pslist smear resistant
2019-09-26 21:57:48 -05:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
35dbdfc69d
Add in PluginRequirement for proc_maps plugin.
2019-08-27 23:35:19 +01:00
Mike Auty
a9853eca50
Fix the copyright headers (and yapf) in the mac plugins.
2019-08-27 23:34:06 +01:00
Andrew Case and ikelos
6b4c13089d
add mac_proc_maps
2019-08-27 23:31:01 +01:00
Andrew Case and ikelos
07ece011a3
Add mac_tasks
2019-08-27 23:28:51 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
71bb54379b
Refactor the plugin versioning to be simpler to define.
2019-08-27 21:08:29 +01:00
Mike Auty
47c349e240
Add plugin requirements for all plugins.
2019-08-27 21:08:29 +01:00
Mike Auty
c0f650ba78
Ensure Mac plugins are documented and add complex tasks documentation.
2019-08-18 22:35:34 +01:00
Mike Auty
5db6ade2ea
Change object_type parameter for object_from_symbol.
2019-08-14 20:50:42 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty