Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
35dbdfc69d
Add in PluginRequirement for proc_maps plugin.
2019-08-27 23:35:19 +01:00
Mike Auty
a9853eca50
Fix the copyright headers (and yapf) in the mac plugins.
2019-08-27 23:34:06 +01:00
Andrew Case and ikelos
6b4c13089d
add mac_proc_maps
2019-08-27 23:31:01 +01:00
Andrew Case and ikelos
07ece011a3
Add mac_tasks
2019-08-27 23:28:51 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
71bb54379b
Refactor the plugin versioning to be simpler to define.
2019-08-27 21:08:29 +01:00
Mike Auty
47c349e240
Add plugin requirements for all plugins.
2019-08-27 21:08:29 +01:00
Mike Auty
c0f650ba78
Ensure Mac plugins are documented and add complex tasks documentation.
2019-08-18 22:35:34 +01:00
Mike Auty
5db6ade2ea
Change object_type parameter for object_from_symbol.
2019-08-14 20:50:42 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Andrew Case
2a8a1523e5
Mac - add lsof plugin
2019-05-29 14:49:55 -05:00
Andrew Case
600af7299b
Mac - add check_sysctl plugin
2019-05-29 14:06:51 -05:00
Andrew Case
15e546c23c
Mac - add check_trap_table
2019-05-28 22:01:28 -05:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
cdbe0306f0
Fix the nullfilter for mac process lists.
2019-03-03 14:57:34 +00:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty
b1537f0789
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
2019-02-26 22:25:46 +00:00
Andrew Case and ikelos
75a6113369
remove another int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
7d15a1667e
remove int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
932246e11e
remove header on netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c5cc88b245
actually add mac_netstat plugin
2019-02-26 22:20:33 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Andrew Case and ikelos
92adf4ffd0
switch mac_pslist to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
b77d638ead
switch mac_lsmod to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
1845fe9ec5
update syscall to use new API correctly
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
f8fab3a71d
switch mac_trustedbsd to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
9eeac53d8d
add mac_check_syscall
2018-12-27 22:43:19 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e3ab3b1c8f
Make certain methods protected, otherwise they should be classmethods.
2018-12-19 22:48:16 +00:00
Mike Auty
189c8786f1
Rename filt to filter_func (because we value clarity over brevity) and another small fix.
2018-12-19 22:46:33 +00:00
Mike Auty
39634893d6
Reformat with yapf and change filter to filt.
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
989e8643e9
add mac_bash
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
06cd454913
add mac_trustedbsd
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
ab877b3907
move plugins into proper directory
2018-12-19 19:43:56 +00:00
Mike Auty
2a3b7348be
Add in minor changes and remove the duplicate plugins for mac.
2018-12-19 01:01:53 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
35ad2325a8
Move all core plugins over to framework/plugins.
...
This should have no impact functionality-wise.
The statistics plugin was left out a) as an example and b) because it
was committed by mistake in the first place and was never meant to be a
real plugin.
2018-12-16 13:40:15 +00:00
Mike Auty