 Andrew Caseandikelos
|
dc91a16a2f
|
update check syscall
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
ade6aa1e74
|
update check_afinfo for write member
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
9d9b68eaa3
|
have check_afinfo not inherit from lsmod
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
8705fb3047
|
update time_object to get_time_object
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
0e7b6b6702
|
Updated hist_entry type and references, add bash plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
36131d01bb
|
Add check_afinfo plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
72798d3187
|
Add linux system call checking plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Mike Auty
|
5a331f9f01
|
A few remaining changes due to the API aleration.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
341b9b8f9e
|
Add in initial changes for scanner sections.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
5b3a81de05
|
Ensure the yarascan generator returns rows.
|
2018-12-01 20:48:53 +00:00 |
|
|
Mike Auty
|
185d4ccdc2
|
Fix issue with yara scans not accepting binary data.
|
2018-12-01 20:32:08 +00:00 |
|
|
Mike Auty
|
db7320e426
|
Bulk lint and a couple of typos fixed.
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
542a062779
|
Update how the modules list address is found
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
7aa729f4b7
|
add typing import to pslist
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
af496d4741
|
update lsof to print name properly
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
98e472e211
|
major updates and new plugins
|
2018-11-08 00:19:17 +00:00 |
|
|
Andrew Caseandikelos
|
63e9cd4604
|
initial set of Linux plugins and extensions for ikelos review
|
2018-11-08 00:19:17 +00:00 |
|
|
Mike Auty
|
36cc973d6d
|
Fix up minor typo in the plugin help.
|
2018-11-04 22:43:46 +00:00 |
|
|
Mike Auty
|
e6711f580d
|
Add required poolheader types and change the PoolHeaderSymbolTable to match the inheritted constructor signature.
|
2018-10-24 19:31:22 +01:00 |
|
|
Mike Auty
|
ff3bae0804
|
Fix up typing information.
|
2018-10-14 23:03:58 +01:00 |
|
|
Mike Auty
|
df57ee5045
|
Fix minor typo in poolscanner logic (thanks mypy!).
|
2018-10-10 15:32:28 +01:00 |
|
|
Mike Auty
|
e500e87fc6
|
Add in type annotations for the poolscanner plugin.
|
2018-10-05 00:20:44 +01:00 |
|
|
Mike Auty
|
d829028a36
|
Apply various type annotation/bug fixes.
|
2018-10-05 00:16:42 +01:00 |
|
|
Mike Auty
|
2943ae1dc6
|
Fix up another exception gone rogue.
|
2018-10-04 02:13:40 +01:00 |
|
|
Mike Auty
|
f044569613
|
Fix up catching the wrong exception type (and the lack of context).
|
2018-10-04 02:07:33 +01:00 |
|
|
Mike Auty
|
d6b60149a1
|
Update poolscanner to use the new symbol_table_is_64bit function.
|
2018-10-03 23:36:54 +01:00 |
|
|
Mike Auty
|
77a894b224
|
Convert 64bit checks to a symbol utility function.
|
2018-10-03 23:36:28 +01:00 |
|
|
Mike Auty
|
09f12a2126
|
Add in most of the code required for poolscanning goodness. @imhlv2 to fix the tests.
|
2018-10-03 22:03:29 +01:00 |
|
|
Mike Auty
|
6a79d803dc
|
Fix up timeliner to produce files rather than writing them directly.
|
2018-10-03 21:31:36 +01:00 |
|
|
Mike Auty
|
c0b7376226
|
Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist.
|
2018-09-30 17:00:25 +01:00 |
|
|
Mike Auty
|
de3bfad135
|
Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError.
|
2018-09-28 12:44:19 +01:00 |
|
|
Mike Auty
|
fc0d2bcf10
|
Support recording the configuration data for timeliner.
|
2018-09-24 01:06:28 +01:00 |
|
|
Mike Auty
|
059edd56c8
|
Convert timeliner to use the plugin runner.
|
2018-09-24 00:52:17 +01:00 |
|
|
Mike Auty
|
6c938869db
|
Refactor timeliner to clarify when automagic happens.
|
2018-09-23 18:19:23 +01:00 |
|
|
Mike Auty
|
569bc97bc2
|
Fix up the use of native_layer_name in the poolscanning code.
|
2018-09-16 15:31:50 +01:00 |
|
|
Mike Auty
|
5add8ea078
|
Remove the obsolete FIXME.
|
2018-09-15 15:23:43 +01:00 |
|
|
Michael Lighandikelos
|
fffdd253ae
|
use renderers.NotApplicableValue() for the poolscanner plugin's name field
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
0baa0ecdf5
|
Update the poolscanner to take care of multiple constraints with the same tag.
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
9d6055d2ba
|
add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
f02df7a92e
|
reduce the extra tag_type_map lookup by yielding the constraint from the pool scanner
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
5d20faa0a7
|
work on _POOL_HEADER.get_object()
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
be6a351a11
|
start adding the _POOL_HEADER extension. expand the pool constraints to include processes
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
ce4ed9fea8
|
Add in the start of actual output from the poolscanner.
|
2018-09-15 15:22:38 +01:00 |
|
|
Michael Lighandikelos
|
56a5012a46
|
fix alignment, should offset be optional to context.module()? refactor pool type checks
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
8a5d3b0c1e
|
Initial poolscanning code.
|
2018-09-15 15:22:38 +01:00 |
|
|
Mike Auty
|
00a7f9ce2d
|
Rework the way verinfo works.
|
2018-09-13 00:24:57 +01:00 |
|
|
Mike Auty
|
6dc8b4d517
|
Create a windows.registry category.
|
2018-09-12 22:55:41 +01:00 |
|
|
Mike Auty
|
312e74cd08
|
Improve typing information for verinfo.
|
2018-09-01 22:14:34 +01:00 |
|
|
Mike Auty
|
0550186ed2
|
Fix a couple bugs in moddump.
|
2018-09-01 22:04:51 +01:00 |
|
|
Mike Auty
|
9d05482e50
|
Make sure we appropriately use classmethods now they're in place.
|
2018-08-30 16:40:39 +01:00 |
|