 Michael Lighandikelos
|
a76d71a7dc
|
move the functionality for getting an object's type into the _OBJECT_HEADER extension
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
8acbe8bba3
|
Refactor conversion code from objects.utility to a conversion module in renderers.
|
2018-12-12 23:39:10 +00:00 |
|
|
Mike Auty
|
1a5c9d3af8
|
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
|
2018-12-12 23:38:01 +00:00 |
|
|
Mike Auty
|
f57bfa5738
|
Prepare core plugins for moving into the framework namespace.
|
2018-12-09 13:32:32 +00:00 |
|
|
Mike Auty
|
323ea0f348
|
Add in the timeliner interface to the linux bash plugin.
|
2018-12-08 18:26:45 +00:00 |
|
|
Mike Auty
|
b5d532555c
|
Convert the adhoc scanner into a layer scanner using sections.
|
2018-12-08 18:21:39 +00:00 |
|
|
Mike Auty
|
649a39a13d
|
Change time_as_integer from a property to get_time_as_integer method.
|
2018-12-08 18:00:44 +00:00 |
|
|
Mike Auty
|
918653e398
|
Convert aslr_mask_symbol_table to more parameterized form.
|
2018-12-08 17:55:13 +00:00 |
|
|
Mike Auty
|
378820bf23
|
More 'inheritance' fixes.
|
2018-12-08 17:45:28 +00:00 |
|
|
Mike Auty
|
780c5d2646
|
Avoid 'inheritance' issues with requirements.
|
2018-12-08 17:43:28 +00:00 |
|
|
Mike Auty
|
f1780bc547
|
Use constants.BANG (plus pycharm autoreformat).
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
dc91a16a2f
|
update check syscall
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
ade6aa1e74
|
update check_afinfo for write member
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
9d9b68eaa3
|
have check_afinfo not inherit from lsmod
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
8705fb3047
|
update time_object to get_time_object
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
0e7b6b6702
|
Updated hist_entry type and references, add bash plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
36131d01bb
|
Add check_afinfo plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
72798d3187
|
Add linux system call checking plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Mike Auty
|
5a331f9f01
|
A few remaining changes due to the API aleration.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
341b9b8f9e
|
Add in initial changes for scanner sections.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
5b3a81de05
|
Ensure the yarascan generator returns rows.
|
2018-12-01 20:48:53 +00:00 |
|
|
Mike Auty
|
185d4ccdc2
|
Fix issue with yara scans not accepting binary data.
|
2018-12-01 20:32:08 +00:00 |
|
|
Mike Auty
|
db7320e426
|
Bulk lint and a couple of typos fixed.
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
542a062779
|
Update how the modules list address is found
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
7aa729f4b7
|
add typing import to pslist
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
af496d4741
|
update lsof to print name properly
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
98e472e211
|
major updates and new plugins
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
63e9cd4604
|
initial set of Linux plugins and extensions for ikelos review
|
2018-11-08 00:19:17 +00:00 |
|
|
Mike Auty
|
36cc973d6d
|
Fix up minor typo in the plugin help.
|
2018-11-04 22:43:46 +00:00 |
|
|
Mike Auty
|
e6711f580d
|
Add required poolheader types and change the PoolHeaderSymbolTable to match the inheritted constructor signature.
|
2018-10-24 19:31:22 +01:00 |
|
|
Mike Auty
|
ff3bae0804
|
Fix up typing information.
|
2018-10-14 23:03:58 +01:00 |
|
|
Mike Auty
|
df57ee5045
|
Fix minor typo in poolscanner logic (thanks mypy!).
|
2018-10-10 15:32:28 +01:00 |
|
|
Mike Auty
|
e500e87fc6
|
Add in type annotations for the poolscanner plugin.
|
2018-10-05 00:20:44 +01:00 |
|
|
Mike Auty
|
d829028a36
|
Apply various type annotation/bug fixes.
|
2018-10-05 00:16:42 +01:00 |
|
|
Mike Auty
|
2943ae1dc6
|
Fix up another exception gone rogue.
|
2018-10-04 02:13:40 +01:00 |
|
|
Mike Auty
|
f044569613
|
Fix up catching the wrong exception type (and the lack of context).
|
2018-10-04 02:07:33 +01:00 |
|
|
Mike Auty
|
d6b60149a1
|
Update poolscanner to use the new symbol_table_is_64bit function.
|
2018-10-03 23:36:54 +01:00 |
|
|
Mike Auty
|
77a894b224
|
Convert 64bit checks to a symbol utility function.
|
2018-10-03 23:36:28 +01:00 |
|
|
Mike Auty
|
09f12a2126
|
Add in most of the code required for poolscanning goodness. @imhlv2 to fix the tests.
|
2018-10-03 22:03:29 +01:00 |
|
|
Mike Auty
|
6a79d803dc
|
Fix up timeliner to produce files rather than writing them directly.
|
2018-10-03 21:31:36 +01:00 |
|
|
Mike Auty
|
c0b7376226
|
Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist.
|
2018-09-30 17:00:25 +01:00 |
|
|
Mike Auty
|
de3bfad135
|
Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError.
|
2018-09-28 12:44:19 +01:00 |
|
|
Mike Auty
|
fc0d2bcf10
|
Support recording the configuration data for timeliner.
|
2018-09-24 01:06:28 +01:00 |
|
|
Mike Auty
|
059edd56c8
|
Convert timeliner to use the plugin runner.
|
2018-09-24 00:52:17 +01:00 |
|
|
Mike Auty
|
6c938869db
|
Refactor timeliner to clarify when automagic happens.
|
2018-09-23 18:19:23 +01:00 |
|
|
Mike Auty
|
569bc97bc2
|
Fix up the use of native_layer_name in the poolscanning code.
|
2018-09-16 15:31:50 +01:00 |
|
|
Mike Auty
|
5add8ea078
|
Remove the obsolete FIXME.
|
2018-09-15 15:23:43 +01:00 |
|
|
Michael Lighandikelos
|
fffdd253ae
|
use renderers.NotApplicableValue() for the poolscanner plugin's name field
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
0baa0ecdf5
|
Update the poolscanner to take care of multiple constraints with the same tag.
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
9d6055d2ba
|
add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks
|
2018-09-15 15:22:38 +01:00 |
|