Mike Auty
a4b50d183d
Mac: Stash the verified ASLR shift and improve logging
2020-07-28 17:00:20 +01:00
Andrew Case and ikelos
f6a1b28424
First attempt and better DTB and ASLR validation. Debugging statements left in.
2020-07-28 17:00:20 +01:00
Mike Auty
61563350b3
Linux/Mac: Refactor *nix Utilities classes
2020-07-28 11:15:16 +01:00
Mike Auty
16c2ddb837
Automagic: Change stackers to including an exclusion list
2020-07-02 19:33:32 +01:00
Mike Auty
33d1c696e5
Automagic: Allow stackers to be configurable
2020-07-02 19:33:32 +01:00
Mike Auty
573590878a
SymbolTable: Rework symbol_shift so it's part of the config
2020-06-10 19:39:20 +01:00
Mike Auty
a6cd344e22
Automagic: Refactor ASLR finding for all symbol_finder using OSes
2020-06-10 19:39:20 +01:00
Mike Auty
863b9915c9
Automagic: Refactor mac aslr_finding
2020-06-10 19:39:20 +01:00
Mike Auty
2748ce32d8
Initial attempts at cloning a symbol table
2020-06-10 19:39:20 +01:00
Mike Auty
0c43beb42d
Core: Apply yapf across all files again.
2020-05-05 22:14:33 +01:00
Andrew Case and ikelos
b42dfd614a
Add API for mapping kernel addresses to kernel symbols or a specific kext
2020-04-08 18:17:34 +01:00
Andrew Case and ikelos
7d6d74bc91
Update order of arguments
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
722700d2dc
Add docstrings
2020-03-12 19:47:15 +00:00
Andrew Case and ikelos
7b21e83b07
Mac - convert socket gathering to class method and clean up associated code
2020-03-12 19:47:15 +00:00
Mike Auty
d36545d4c0
Automagic: Fix mac typing signature issues
2019-11-27 11:30:14 +00:00
Mike Auty
dcf5b1f68c
Stackers: Update the stack orders to try quick header check layers first
2019-11-16 12:53:56 +00:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
b4ad15c226
Mac - update lsof to inherit from tasks and be more smear resistant
2019-09-26 21:56:38 -05:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Andrew Case
bc6e63cb19
Mac - skip invaid kaslr shift results
2019-05-28 19:59:14 -05:00
Mike Auty
03eddbfb74
Fix missing imports removed by the rebase.
2019-02-26 22:25:15 +00:00
Andrew Case and ikelos
c9adc6a0fa
remove usage of old string methods
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
6d2a5fbfaa
add mac_netstat and supporting networking code
2019-02-26 22:20:33 +00:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
afdd8b657e
Fix memory problems with banner_caches.
...
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required. As the cache builders are separate at the
moment, we previously ran banner searches without any banners. This was
bad. It inflated memory hugely and killed the buildbot.
We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Mike Auty
4308245499
Revert "prevent double shifting of ASLR slides"
...
This reverts commit 2655fd1666
2018-12-20 15:40:53 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Andrew Case
2655fd1666
prevent double shifting of ASLR slides
2018-12-19 11:12:58 -06:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
b61ac3bd47
Many more typing fixes.
2018-12-17 01:17:06 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
9824538bd9
Numerous pycharm warnings resolved
...
This includes:
* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
d9369001d4
Ensure we can cache the linux/mac banners.
2018-12-13 21:23:59 +00:00
Mike Auty
6e43d0bab4
Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it).
2018-12-13 15:56:24 +00:00
Mike Auty
cd7296d64e
Fix up based on the recent master refactoring.
2018-12-13 15:56:24 +00:00
Mike Auty
3a2c2b30a9
Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things.
2018-12-13 15:56:24 +00:00
Mike Auty
25fb05c9bf
Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address.
2018-12-13 15:56:24 +00:00
Mike Auty
57b2a5bab7
Fix up a rogue classmethod, and ensure we have a separate variable for the new layer.
2018-12-13 15:56:24 +00:00
Mike Auty
5135215c62
Do some tidying and renaming.
2018-12-13 15:56:24 +00:00
Mike Auty
7a462d5f85
Refactor out the shared symbol cache/finder code from linux and mac.
2018-12-13 15:56:24 +00:00
Mike Auty
55286f04cb
Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat.
2018-12-13 15:56:24 +00:00
Andrew Case and ikelos
622c86f9ed
Add initial mac backend code, with broken DTB finding, along with the pslist plugin
2018-12-13 15:56:24 +00:00
Mike Auty