add functionality to:
FILE_OBJECT:
access_string function
EPROCESS:
environment_variables function
new structs:
TOKEN:
get_sids function
privileges funciton
KTHREAD:
get_state function
get_wait_reason function
add functionality to:
FILE_OBJECT:
access_string function
EPROCESS:
environment_variables function
new structs:
TOKEN:
get_sids function
privileges funciton
KTHREAD:
get_state function
get_wait_reason function
Added documentation and logging
added cachedump and lsadump
Fixed requested issues
fixed encoding issues
added requirement
Framework: Move cache_clear function to the framework
Documentation: Document self.config slightly better
Linux/Mac: Refactor *nix Utilities classes
Automagic: Fix issue in recent refactor
Add elf parsing and symbol retrieval for linux kernel modules
Fixes on coding style
Linux: Restore accidentally dropped kobject definition
Core: Rerun yapf across the codebase.
First attempt and better DTB and ASLR validation. Debugging statements left in.
Mac: Stash the verified ASLR shift and improve logging
Linux: Support stashing the KASLR
Remove extra debug prints
added hashdump
Added documentation and logging
Linux - stash the Linux kernel virtual address
Hashdump: Reformat and convert to proper byte handling
Registry: Fix error message
Caching: Only cache remote files
Yarascan: Move most of yarascanning into a versionable plugin
This refactors common yara tasks, so we can use the plugin versioning to
keep track of changes to the YaraScanner class.
Core: Refactor versioning and associated requirements
Configuration: Improve the VersionableInterface documentation
Plugins: Remove unnecessary dependency for yarascan
Objects: Add a convenience function for validating enum values
Objects: Update enumeration method to is_valid_choice
Core: Maintain 3.5.3 compatibility
created tty_check.py; edited automagic/linux.py to add kernel tracking abilities
fixed some formatting for tty_check.py
Fixed tty_check not finding the ttyhook module
added some documentation
Removed unnecessary code from tty_check.py
added docs to automagic methods, fixed missing return types, changed parameters to be more specific
added kernel string to linux constants file; changed automagic methods so that they reconstruct the kernel object within the method for consistancy with other methods
added parameter type to generate_kernel_handler_info
Updated imports to reflect new location of utility class; plugins are no longer outputing anything so commiting for Andrew to take a look at
removed debugging print statements
fixed bug causing no output when tty_check is run
Windows.info: Refactor windows.info as classmethods
Linux: Fix plugin case and re-run yapf
created keyboard_notifiers
removed extra whitespace
Yapf: Minor reformats for recent plugins
Codebase: Ensure all conversions to bytes handle unicode
All conversions using `latin-1` have been converted to
`raw_unicode_escape` which is like `latin-1`, but handles unicode
characters appropriately (with a `\u` prefix).
Since this is like `latin-1` it should have no impact on things that ran
previously, but those that would fail with a unicode error now will
present an encoded unicode string. There may be situations where the
binary representation of unicode would be better (timeliner file
output?), but those can be changed when/if it's determined necessary.
Fixes#274.
Linux: Fix keyboard_notifiers copyright year
Renderers: Fix the pretty renderer when no rows are emitted
Timeliner: Sort results and provide a filter
Sorts the results (as stated). Note that user interfaces may decide to
sort their results in an order of their choosing.
Also added a parameter that can be provided multiple times to only allow
plugins that match (any of) the parameters provided.
Timeliner: Actually make use of the TextIoWrapper
Windows: Add a version to the info plugin now its got classmethods
CLI: Add additional help about 'vol.py plugin --help'
created linux_check_idt; plugin currently is not finding the module names for each entry in idt table
fix copyright year
fixed poor variable name, removed unnecessary code
added address mask to fix issue with kernel tracking
CLI: Revert epilog changes
Update lsadump.py
I'm not sure why your are getting this error since it works fine for me, but this may fix it
This ensures that ReferenceTemplates are not returned from a call to
symbol_space.get_symbol. This is in keeping with the get_type method.
The symbol_space containing all symbol tables has visibility of all
tables and can cross-resolve amongst them. Asking a specific table
for a type may result in a ReferenceTemplate. This feels like a
better solution than having individual tables ask their parent space
to fill in the details of sibling tables.
Fixes#279.
Mike Auty