Analyst and ikelos
6e4fa57421
move type_classes to dictionaries stored in their modules rather than separate classes (see 81d3293)
2019-07-15 21:16:32 +01:00
Analyst and ikelos
e6ae049d18
add svcscan and associated types
2019-07-15 21:16:32 +01:00
Mike Auty
272224a1b0
Refactor all references to Context.memory to Context.layers.
2019-07-07 17:42:51 +01:00
Mike Auty
81d3293414
Move type_classes to dictionaries stored in their modules rather than separate tables.
2019-05-29 22:14:38 +01:00
Analyst
5120860a60
fix two bugs that prevented poolscanners from working on 2012 samples
...
in 2012, cookie is None and will raise TypeError, so we need to catch that in addition to AttributeError. also, the Session pointer is always in the native layer
2019-03-25 09:51:55 -05:00
Analyst
93e66381ad
use an alignmemt based on the cpu arch, not the pool header size
...
this fixes an issue with pool scanning on win10 32-bit samples, because the size of a pool header increased to 16 bytes, but we still want 8 byte alignment on 32-bit machines
2019-03-20 11:53:26 -05:00
Michael Ligh
2138152b10
fix a bug in psscan on xp images
...
we need to get the kvo using the native_layer_name rather than the layer_name
2019-03-19 11:14:10 -05:00
Mike Auty
372533b234
Improve registry subkey support (now recurses properly).
...
The old code didn't propertly recurse nodes beyond the first layer, and
also skipped entries in the top layer. Now we check the signature to
determine when/how to skip and we recurse down node lists that contain
further node lists.
2019-03-13 00:03:02 +00:00
Analyst
9c4bd556f6
add the symlinkscan plugin
2019-03-07 09:00:19 -06:00
Mike Auty
7904be3fd2
Yapf reformat all files.
2019-03-04 22:11:44 +00:00
Analyst
e1701947f8
add the windows driverscan plugin
2019-03-04 10:37:33 -06:00
Analyst
b1c3ecfa17
add mutantscan
2019-02-27 12:49:50 -06:00
Analyst
d4e12c982d
fix a critical issue determining the names of windows kernel objects from the object header
2019-02-27 10:45:36 -06:00
Mike Auty
e0d2edbca1
Remove ord for unsigned int and don't cast int objects to ints.
2019-02-24 23:56:34 +00:00
Michael Ligh
d68b94965c
catch TypeError in _FILE_OBJECT.file_name_with_device(). this avoids an exception trying to combine a str with renderers.UnreadableValue()
2019-02-24 17:14:28 -06:00
Analyst
63787acb50
fix the handling of TypeInfo after 9b488f8
2019-02-24 15:24:37 -06:00
Mike Auty
b335b2320d
Minor performance fix for PE extension and yapf of poolscanner.
2019-02-18 00:07:19 +00:00
Mike Auty
df41a0cf50
Fix up Vad extensions now that Chars are ints rather than bytes.
2019-02-06 21:08:52 +00:00
Mike Auty
71fb77f624
Remove the mis-committed print statements. 5;)
2019-02-06 09:14:03 +00:00
Michael Ligh
f61fba8e00
the vad end should be the last byte in the last page (i.e. ending in 0xfff)
2019-02-05 21:05:17 -06:00
Mike Auty
c64ed6a8dd
Remove validity checking in favour of static-type checking.
...
This removes the assertions that checked plugin devs didn't do anything
overly bad in favour of using mypy to ensure appropriate type-checking.
It also moves the ProgressCallback typing information to constants in
order to avoid circular imports (since constants doesn't import
anything).
2019-01-20 02:35:49 +00:00
Mike Auty
fdc6efc4ad
Add in the LICENSE and the README.
2018-12-19 23:55:03 +00:00
Mike Auty
e65a00894a
Minor style tweaks and mass changes across the codebase because of it.
2018-12-17 12:46:14 +00:00
Mike Auty
b61ac3bd47
Many more typing fixes.
2018-12-17 01:17:06 +00:00
Mike Auty
19572b6e1e
Reformat all python files using yapf with custom volatility style.
2018-12-16 16:50:17 +00:00
Mike Auty
29d41470a4
Mass reformat of typing imports
...
Relented on the strict import of direct objects/classes for the typing
module only. Typing module components can be directly imported because
it makes the code really painful to read and write otherwise.
This is still in-line with the python style guide adopted from Google at
http://google.github.io/styleguide/pyguide.html section 2.2.
2018-12-16 13:04:22 +00:00
Mike Auty
7502ef7366
Shuffle around registry extensions.
2018-12-14 00:18:57 +00:00
Mike Auty
f41e3e0453
Completely rework the primitive data format system.
2018-12-13 18:33:42 +00:00
Mike Auty
6b480eed56
Fix up PE data construction code.
2018-12-13 18:33:42 +00:00
Mike Auty
dfaaf1e455
Fix up some things missed in the master refactor.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
736a1c6e50
add is_valid() for _FILE_OBJECT and _EPROCESS
2018-12-13 01:16:05 +00:00
Mike Auty
76264cee34
Catch invalid _OBJECT_HEADER objects.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
650a188d51
updates for win8/win10 poolscanning
2018-12-13 01:16:05 +00:00
Mike Auty
fa033b8ab7
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
2018-12-13 01:16:05 +00:00
Mike Auty
eacc45dab6
Ensure POOL_HEADER finds the right object in the right symbol table.
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d653839359
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
d667a68f97
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
2018-12-13 01:16:05 +00:00
Michael Ligh and ikelos
a76d71a7dc
move the functionality for getting an object's type into the _OBJECT_HEADER extension
2018-12-13 01:16:05 +00:00
Mike Auty
8acbe8bba3
Refactor conversion code from objects.utility to a conversion module in renderers.
2018-12-12 23:39:10 +00:00
Mike Auty
1a5c9d3af8
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
2018-12-12 23:38:01 +00:00
Mike Auty
5dea1968bb
Fix up _MMVAD_SHORT context typo.
2018-12-01 16:27:52 +00:00
Mike Auty
e27ba8d089
Fix up naming for objects/symbols_utility imports.
2018-11-08 00:48:38 +00:00
Mike Auty
d799d4edd8
Add additional typing information.
2018-10-11 16:41:59 +01:00
Mike Auty
d829028a36
Apply various type annotation/bug fixes.
2018-10-05 00:16:42 +01:00
Mike Auty
f044569613
Fix up catching the wrong exception type (and the lack of context).
2018-10-04 02:07:33 +01:00
Mike Auty
77a894b224
Convert 64bit checks to a symbol utility function.
2018-10-03 23:36:28 +01:00
Mike Auty
de3bfad135
Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError.
2018-09-28 12:44:19 +01:00
Mike Auty
222b5f14a7
There is no need to cast as ord.
2018-09-16 16:24:34 +01:00
Mike Auty
90d13be9a9
Ensure we pass the native_layer_name whenever constructing a subobject.
2018-09-16 15:59:30 +01:00
Mike Auty
569bc97bc2
Fix up the use of native_layer_name in the poolscanning code.
2018-09-16 15:31:50 +01:00
