Commit Graph
100 Commits
Author SHA1 Message Date
Mike Auty ff32383f82 Yapf: Minor reformats for recent plugins 2020-08-03 16:33:10 +01:00
mtresslerandikelos 2e6dc851d3 removed extra whitespace 2020-08-03 16:30:09 +01:00
Matt Tresslerandikelos 0452f69f82 created keyboard_notifiers 2020-08-03 16:30:09 +01:00
Mike Auty f5f9ee7292 Linux: Fix plugin case and re-run yapf 2020-07-31 00:28:21 +01:00
Matt Tresslerandikelos 34ff856a79 Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 355c25fefb added parameter type to generate_kernel_handler_info 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ddec0d482d added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos b9f5450ac3 added docs to automagic methods, fixed missing return types, changed parameters to be more specific 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos 44911bf54a Fixed tty_check not finding the ttyhook module 2020-07-30 23:24:23 +01:00
Matt Tresslerandikelos ec8e9161bf created tty_check.py; edited automagic/linux.py to add kernel tracking abilities 2020-07-30 23:24:23 +01:00
Andrew Case dec13f5082 Linux - stash the Linux kernel virtual address 2020-07-28 13:16:40 -05:00
Mike Auty 8481406488 Linux: Support stashing the KASLR 2020-07-28 17:00:20 +01:00
Mike Auty a980374eb8 Automagic: Fix issue in recent refactor 2020-07-28 11:15:16 +01:00
Mike Auty 61563350b3 Linux/Mac: Refactor *nix Utilities classes 2020-07-28 11:15:16 +01:00
Mike Auty 16c2ddb837 Automagic: Change stackers to including an exclusion list 2020-07-02 19:33:32 +01:00
Mike Auty 33d1c696e5 Automagic: Allow stackers to be configurable 2020-07-02 19:33:32 +01:00
Mike Auty cf988944b9 Linux: Correct the ASLR for pre-masking (KASLR is still incorrect) 2020-06-23 16:56:40 +01:00
Hanno Heinrichsandikelos 30226d2bdd Fix find_aslr() function invocation for Linux. 2020-06-23 16:10:05 +01:00
Mike Auty a6cd344e22 Automagic: Refactor ASLR finding for all symbol_finder using OSes 2020-06-10 19:39:20 +01:00
Mike Auty 204657648a Linux: Narrow in on a particular symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 2748ce32d8 Initial attempts at cloning a symbol table 2020-06-10 19:39:20 +01:00
Mike Auty 8935e4dd19 Fix up linuxutils to use symbol_tables rather than hard coded values 2020-04-10 22:12:03 +01:00
Mike Auty a85f6f80f8 Linux automagic: Add support for more recent init_top_pgt symbol. 2019-11-22 22:40:52 +00:00
Mike Auty dcf5b1f68c Stackers: Update the stack orders to try quick header check layers first 2019-11-16 12:53:56 +00:00
Mike Auty 211ad0d524 Remove useless calls to validate. 2019-09-26 15:58:22 +01:00
Mike Auty e0b9d72c84 Update the license URL and LICENSE.txt 2019-09-25 21:44:05 +01:00
Mike Auty 72567e1c50 Yapf-0.28.0 rerun across the whole codebase. 2019-09-21 21:08:23 +01:00
Mike Auty e922cef316 Improve docstrings for all plugins, and reformat all docstrings. 2019-09-07 22:59:54 +01:00
Mike Auty 9cde94bceb Change the license blurb on all files. 2019-08-27 23:11:00 +01:00
Mike Auty be27aab8ae Refactor symbol to object_type (so it doesn't shadow builtin type). 2019-08-14 20:50:42 +01:00
Mike Auty 5362e2094e Initial attempt at cleaning up the API
Context.object accepts a template or a string name (and now a type
flag).  Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).

The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty afdd8b657e Fix memory problems with banner_caches.
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required.  As the cache builders are separate at the
moment, we previously ran banner searches without any banners.  This was
bad.  It inflated memory hugely and killed the buildbot.

We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Andrew Caseandikelos 731447000d avoid use of _context in extension 2018-12-27 22:41:03 +00:00
Mike Auty 4308245499 Revert "prevent double shifting of ASLR slides"
This reverts commit 2655fd1666.
2018-12-20 15:40:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Andrew Case 2655fd1666 prevent double shifting of ASLR slides 2018-12-19 11:12:58 -06:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 6e43d0bab4 Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it). 2018-12-13 15:56:24 +00:00
Mike Auty 5135215c62 Do some tidying and renaming. 2018-12-13 15:56:24 +00:00
Mike Auty 7a462d5f85 Refactor out the shared symbol cache/finder code from linux and mac. 2018-12-13 15:56:24 +00:00
Mike Auty 55286f04cb Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat. 2018-12-13 15:56:24 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty 918653e398 Convert aslr_mask_symbol_table to more parameterized form. 2018-12-08 17:55:13 +00:00
Mike Auty 3f2f3cd2f3 Add a reminder to fix up the API in this place. 2018-12-03 21:52:29 +00:00
Mike Auty e27ba8d089 Fix up naming for objects/symbols_utility imports. 2018-11-08 00:48:38 +00:00