Mike Auty
c7ea30b059
Core: Add in framework version check for plugins
2020-06-02 00:08:01 +01:00
Mike Auty
c870add8e4
Framework: Ensure we don't bother over importing or spamming the log
2020-05-31 02:28:53 +01:00
superponible and ikelos
69be2157fb
fix typo
2020-05-27 23:16:18 +01:00
superponible and ikelos
48e33c2b98
create property for HiveGenerator invalid member
2020-05-27 23:16:18 +01:00
Mike Auty
a0da5fef83
Issue #186 : Rebase and apply yapf
2020-05-27 23:16:18 +01:00
superponible and ikelos
36c19735ee
issue #186 - hivelist with new hivescan/bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
002758c7f2
issue #186 - hivescan and hivelist with bigpools
2020-05-27 23:16:18 +01:00
superponible and ikelos
a21ab89019
issue #186 - add bigpools plugin
2020-05-27 23:16:18 +01:00
superponible and ikelos
054d144f9b
issue #186 - walk forward, backward, scan if needed
2020-05-27 23:16:18 +01:00
superponible and ikelos
e969f44471
issue #186 - _CMHIVE.is_valid()
2020-05-27 23:16:18 +01:00
superponible and ikelos
a4301afe22
issue #186 - skip type check on CMHIVE
2020-05-27 23:16:18 +01:00
superponible and ikelos
0de87e5bce
fix off by one and loop counters
2020-05-27 23:14:26 +01:00
Mike Auty
94426ad313
Automagic: Ensure all layers can be reconstructed
2020-05-10 19:30:58 +01:00
Mike Auty
6e91349c73
Documentation: Add in information about creating layers.
2020-05-09 02:07:08 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Mike Auty
4587de356d
Fix issue with cleaning the symbol cache
2020-05-02 01:16:06 +01:00
Mike Auty
edecd64703
Yarascan: Fixes #209 by returning matched strings
2020-04-14 23:45:08 +01:00
Mike Auty
15d26ce415
Linux: Remove parameters that are unnecessary/removed.
2020-04-10 22:38:21 +01:00
Mike Auty
01ef78db11
Fix a typo in the last commit
2020-04-10 22:19:24 +01:00
Mike Auty
8935e4dd19
Fix up linuxutils to use symbol_tables rather than hard coded values
2020-04-10 22:12:03 +01:00
Andrew Case and ikelos
719cd0d476
Move module gathering into generator
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Michael Ligh
d5bdf9633d
refs #204 fix modscan, _LDR_DATA_TABLE_ENTRY is not an executive object and doesn't have an object_type
2020-04-07 09:22:52 -05:00
Mike Auty
2cd6a9478f
Intermed: Resolve unintended change of length to size and issue with anonymous checking
2020-04-03 00:00:57 +01:00
Mike Auty
be1faa91a5
Initial attempt at resolving anonymoous fields.
2020-03-26 13:32:30 +00:00
Mike Auty
bd2a382d88
CLI & windows.handles: Improve exception handling
2020-03-16 22:34:03 +00:00
Mike Auty
b8bc0f0ed6
mac.netstat: Fix up typing and interface imports
2020-03-12 19:53:51 +00:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
640afdda2c
Layers: Add in NonLinear Segmented layers
2020-03-04 20:29:42 +00:00
Mike Auty
a745503b72
Layers: Make the linear/non-linear changes minimal
2020-03-04 20:29:42 +00:00
Mike Auty
df804928b5
Layers: Alter the decode method to take data directly
2020-03-04 20:29:42 +00:00
Mike Auty
87dc98655b
Layers: Fix up an intel inaccuracy in mapping sizes
2020-03-04 20:29:42 +00:00
Mike Auty
e089314898
Layers: Add pad option to the decode/encode steps
2020-03-04 20:29:42 +00:00
Mike Auty
ca9d7075d3
Layers: Refactor the decode/encode methods
2020-03-04 20:29:42 +00:00
Mike Auty
77be83edc4
Layers: Change mapping signature to return domain length
2020-03-04 20:29:42 +00:00
Mike Auty
a2ac55ba0b
Wintel: Reorder the DTB tests
...
Reorder the DTB tests, since 64-bits have more to match and are likely
more common these days. We've had an instance where a 32-bit DTB was
detected because of a self-referential pointer over a 64-bit DTB leading
to an inaccessible image.
This fixes issue #193 .
2020-03-04 20:28:52 +00:00
Mike Auty
7c260ce4bd
Crashdump: Ensure the number of runs is reflected in the array length
2020-02-29 18:47:34 +00:00
Tamas K Lengyel and ikelos
6a6cf37b02
pdbconv: save _imp functions in JSON
2020-02-14 09:20:15 +00:00
Andrew Case and ikelos
a60bef3283
Mac - update queue walking code
2020-02-12 21:04:23 +00:00
Andrew Case and ikelos
5a99d35a9e
update timer code
2020-02-12 19:56:37 +00:00
Michael Ligh and ikelos
4c7f2a3762
catch InvalidAddressException when traversing left and right child VADs (triggered on terminated processes)
2020-02-12 19:19:27 +00:00
Andrew Case and ikelos
ab42f0941c
Add sysctl docstrings and return types
2020-02-12 19:17:19 +00:00
Andrew Case and ikelos
29cc435b5e
update sysctl v2
2020-02-12 19:17:19 +00:00
Mike Auty
7873a65999
Procdump: Don't loop through twice without good reason.
2020-02-12 19:07:24 +00:00
Mike Auty
920b85743b
Revert "Automagic: Add excessive debugging to symbol cache"
...
This reverts commit db8ba4029c
2020-01-30 01:58:07 +00:00
Mike Auty
c4829ccca3
Caching: Add clear-cache option (except hashcaches)
2020-01-30 01:57:48 +00:00
Mike Auty
db8ba4029c
Automagic: Add excessive debugging to symbol cache
2020-01-30 01:34:30 +00:00
Mike Auty
6e38727ffe
Mac: Refactor/optimize repeated code.
2020-01-28 01:37:21 +00:00
Mike Auty