Commit Graph
292 Commits
Author SHA1 Message Date
Mike Auty f0a13c902e Make changes based on the view (mostly name clarification). 2019-07-30 22:14:19 +01:00
Mike Auty 398c583432 Ensure failed downloads are reported. 2019-07-30 22:14:19 +01:00
Mike Auty 6fc295410f Support progress callbacks and improve pdb downloading. 2019-07-30 22:14:19 +01:00
Mike Auty 3bb113b0a7 Improve documentation and integration. 2019-07-30 22:14:19 +01:00
Mike Auty 272224a1b0 Refactor all references to Context.memory to Context.layers. 2019-07-07 17:42:51 +01:00
Andrew Case bc6e63cb19 Mac - skip invaid kaslr shift results 2019-05-28 19:59:14 -05:00
Mike Auty 4cfde031f6 Additional typing fixes. 2019-05-11 22:57:06 +01:00
Mike Auty a7160dd6b6 Move the PDB downloading code and test for file writability. 2019-04-27 21:06:25 +01:00
Mike Auty 7c16c403d5 Ensure we delete the temorary file even if things go wrong. 2019-04-23 22:43:16 +01:00
Mike Auty 9350f7b88a Don't forget to cleanup. 2019-04-23 00:32:29 +01:00
Mike Auty ac282d01fb Add in initial support at automatic downloading. 2019-04-23 00:16:19 +01:00
Mike Auty 03eddbfb74 Fix missing imports removed by the rebase. 2019-02-26 22:25:15 +00:00
Andrew Caseandikelos c9adc6a0fa remove usage of old string methods 2019-02-26 22:20:33 +00:00
Andrew Caseandikelos 6d2a5fbfaa add mac_netstat and supporting networking code 2019-02-26 22:20:33 +00:00
Mike Auty 4e8c8a7232 Fix issues with SymbolRequirement refactoring. 2019-02-11 22:30:22 +00:00
Mike Auty f898dca296 Refactor SymbolRequirement to SymbolTableRequirement for clarity. 2019-02-06 21:26:32 +00:00
Mike Auty c64ed6a8dd Remove validity checking in favour of static-type checking.
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.

It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty b13fcb186c Improve typing issues. 2019-01-03 01:13:53 +00:00
Mike Auty 19f908b075 Rejig pdbscan to find potential offsets then check them.
Originally we found physical offsets for pdbs that matched,
then found potential offsets and tested them against each other.

Now, we find the potential offsets and then look for pdbs at that offset
(technically within a 4Mb block after the start).  The scanning is quick
(probably quicker than scanning the whole physical space) and should
catch most pdbs unless they're splayed out in virtual memory.
2019-01-01 01:14:34 +00:00
Mike Auty afdd8b657e Fix memory problems with banner_caches.
Since we stack using Mac layers as well as Linux layers, both sets of
banner caches are required.  As the cache builders are separate at the
moment, we previously ran banner searches without any banners.  This was
bad.  It inflated memory hugely and killed the buildbot.

We now bomb out on stacking a Linux or Mac layer unless we have banners
against which to match.
2018-12-30 15:13:10 +00:00
Andrew Caseandikelos 731447000d avoid use of _context in extension 2018-12-27 22:41:03 +00:00
Mike Auty 59d3f2b8ee Clean up an unecessary import. 2018-12-25 16:48:15 +00:00
Mike Auty 4308245499 Revert "prevent double shifting of ASLR slides"
This reverts commit 2655fd1666.
2018-12-20 15:40:53 +00:00
Mike Auty fdc6efc4ad Add in the LICENSE and the README. 2018-12-19 23:55:03 +00:00
Andrew Case 2655fd1666 prevent double shifting of ASLR slides 2018-12-19 11:12:58 -06:00
Mike Auty 7ca5514b83 Remove long-broken convenience code from ConfigurableInterface.
In the dim and distant past, I seemingly thought it a good idea to copy
all the values out of an object's config and into local private
attributes (I guess to avoid config lookups?).  It turns out, it was
always broken because it looking at the root of the config tree, rather
than under the object's specific config settings.

This first turned up as an issue where self._meta_layer was being
overwritten by None in the vmware layer.  Removing this resolved the
issue.
2018-12-17 22:08:24 +00:00
Mike Auty de4fa6df51 Ensure we can see how the stacker is acting. 2018-12-17 17:32:46 +00:00
Mike Auty e65a00894a Minor style tweaks and mass changes across the codebase because of it. 2018-12-17 12:46:14 +00:00
Mike Auty 76e81eb478 Fix up python-3.5 type syntax. 2018-12-17 09:09:34 +00:00
Mike Auty b61ac3bd47 Many more typing fixes. 2018-12-17 01:17:06 +00:00
Mike Auty 19572b6e1e Reformat all python files using yapf with custom volatility style. 2018-12-16 16:50:17 +00:00
Mike Auty 9824538bd9 Numerous pycharm warnings resolved
This includes:

* Better ways of checking empty lists
* Not shadowing builtin functions like filter
* Preventing invalid slash warnings by marking strings as regexps
* Removing unnecessary brackets
* Lowercase variable names
* Adding/updating parameters in docstrings
* Removing unused code (lines not chunks)
* Change in not a member tests
* Changing some methods to static
* Shorting range membership checks
* Missing parameters
* Make some exception handlers more specific
* Don't define a lambda to a variable
* A few more instance checks to help type checkers
2018-12-16 13:21:06 +00:00
Mike Auty 29d41470a4 Mass reformat of typing imports
Relented on the strict import of direct objects/classes for the typing
module only.  Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.

This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty d9369001d4 Ensure we can cache the linux/mac banners. 2018-12-13 21:23:59 +00:00
Mike Auty 6e43d0bab4 Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it). 2018-12-13 15:56:24 +00:00
Mike Auty cd7296d64e Fix up based on the recent master refactoring. 2018-12-13 15:56:24 +00:00
Mike Auty 3a2c2b30a9 Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things. 2018-12-13 15:56:24 +00:00
Mike Auty 25fb05c9bf Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address. 2018-12-13 15:56:24 +00:00
Mike Auty 57b2a5bab7 Fix up a rogue classmethod, and ensure we have a separate variable for the new layer. 2018-12-13 15:56:24 +00:00
Mike Auty 5135215c62 Do some tidying and renaming. 2018-12-13 15:56:24 +00:00
Mike Auty 7a462d5f85 Refactor out the shared symbol cache/finder code from linux and mac. 2018-12-13 15:56:24 +00:00
Mike Auty 55286f04cb Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat. 2018-12-13 15:56:24 +00:00
Andrew Caseandikelos 622c86f9ed Add initial mac backend code, with broken DTB finding, along with the pslist plugin 2018-12-13 15:56:24 +00:00
Mike Auty 1a5c9d3af8 Roll symbols.utility into symbols file until we get enough functions we need to split them out again. 2018-12-12 23:38:01 +00:00
Mike Auty 918653e398 Convert aslr_mask_symbol_table to more parameterized form. 2018-12-08 17:55:13 +00:00
Mike Auty 5a331f9f01 A few remaining changes due to the API aleration. 2018-12-07 01:47:16 +00:00
Mike Auty 341b9b8f9e Add in initial changes for scanner sections. 2018-12-07 01:47:16 +00:00
Mike Auty 3f2f3cd2f3 Add a reminder to fix up the API in this place. 2018-12-03 21:52:29 +00:00
Mike Auty 3900f38262 Remove vestigal trace of NlpDtbFinder. 2018-11-13 11:43:14 +00:00
Mike Auty e27ba8d089 Fix up naming for objects/symbols_utility imports. 2018-11-08 00:48:38 +00:00