Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Andrew Case
2a8a1523e5
Mac - add lsof plugin
2019-05-29 14:49:55 -05:00
Andrew Case
600af7299b
Mac - add check_sysctl plugin
2019-05-29 14:06:51 -05:00
Andrew Case
15e546c23c
Mac - add check_trap_table
2019-05-28 22:01:28 -05:00
Mike Auty
754b3f0bc6
Refactor create_filter to create_pid_filter.
2019-04-18 01:10:07 +01:00
Mike Auty
cdbe0306f0
Fix the nullfilter for mac process lists.
2019-03-03 14:57:34 +00:00
Mike Auty
2aa07596c2
Fix up filtering in mac and remove the last of the filter shadowing.
2019-02-28 09:48:15 +00:00
Mike Auty
c5e2490f40
Make complementary fixes in linux/mac pslist.
...
Filters should take a whole process, so they could be extended to filter
more in the future.
2019-02-27 19:22:37 +00:00
Mike Auty
b1537f0789
Reformat and fix the SymbolRequirement -> SymbolTableRequirement rename.
2019-02-26 22:25:46 +00:00
Andrew Case and ikelos
75a6113369
remove another int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
7d15a1667e
remove int cast from netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
932246e11e
remove header on netstat
2019-02-26 22:20:33 +00:00
Andrew Case and ikelos
c5cc88b245
actually add mac_netstat plugin
2019-02-26 22:20:33 +00:00
Mike Auty
f898dca296
Refactor SymbolRequirement to SymbolTableRequirement for clarity.
2019-02-06 21:26:32 +00:00
Mike Auty
040da46deb
Fix up the descriptions for non-simple requirements.
2019-01-03 00:39:53 +00:00
Andrew Case and ikelos
92adf4ffd0
switch mac_pslist to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
b77d638ead
switch mac_lsmod to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
1845fe9ec5
update syscall to use new API correctly
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
f8fab3a71d
switch mac_trustedbsd to absolute_symbol_addresses interface
2018-12-27 22:43:19 +00:00
Andrew Case and ikelos
9eeac53d8d
add mac_check_syscall
2018-12-27 22:43:19 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e3ab3b1c8f
Make certain methods protected, otherwise they should be classmethods.
2018-12-19 22:48:16 +00:00
Mike Auty
189c8786f1
Rename filt to filter_func (because we value clarity over brevity) and another small fix.
2018-12-19 22:46:33 +00:00
Mike Auty
39634893d6
Reformat with yapf and change filter to filt.
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
989e8643e9
add mac_bash
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
06cd454913
add mac_trustedbsd
2018-12-19 19:43:56 +00:00
Andrew Case and ikelos
ab877b3907
move plugins into proper directory
2018-12-19 19:43:56 +00:00
Mike Auty
2a3b7348be
Add in minor changes and remove the duplicate plugins for mac.
2018-12-19 01:01:53 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
35ad2325a8
Move all core plugins over to framework/plugins.
...
This should have no impact functionality-wise.
The statistics plugin was left out a) as an example and b) because it
was committed by mistake in the first place and was never meant to be a
real plugin.
2018-12-16 13:40:15 +00:00
Mike Auty