 Mike Auty
|
dfe2f86fe2
|
Lots and lots of typing additions found by an initial monkeytype run.
|
2018-12-13 23:46:37 +00:00 |
|
|
Mike Auty
|
2c72439334
|
Add in protections for the crashdump layer.
|
2018-12-13 22:59:21 +00:00 |
|
|
Mike Auty
|
d9369001d4
|
Ensure we can cache the linux/mac banners.
|
2018-12-13 21:23:59 +00:00 |
|
|
Mike Auty
|
f41e3e0453
|
Completely rework the primitive data format system.
|
2018-12-13 18:33:42 +00:00 |
|
|
Mike Auty
|
6b480eed56
|
Fix up PE data construction code.
|
2018-12-13 18:33:42 +00:00 |
|
|
Mike Auty
|
9949809198
|
Fix a minor typo.
|
2018-12-13 18:33:42 +00:00 |
|
|
Mike Auty
|
b533d19f83
|
Refactor the data extraction for primitive types.
|
2018-12-13 18:33:42 +00:00 |
|
|
Mike Auty
|
a78452e361
|
Fix up ugly int128 hack with a slightly nicer hack.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
6e43d0bab4
|
Bring the aslr_mask_symbol_table methods in sync (even though mac never uses it).
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
1341925160
|
Remove unnecessary requirements method.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
cd7296d64e
|
Fix up based on the recent master refactoring.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
3a2c2b30a9
|
Use the virtual_to_physical_address in case of extremely large physical files where the masking might break things.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
25fb05c9bf
|
Fix up Mac double-DTB finding code by address masking the BootPML4 symbol address.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
57b2a5bab7
|
Fix up a rogue classmethod, and ensure we have a separate variable for the new layer.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
5135215c62
|
Do some tidying and renaming.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
7a462d5f85
|
Refactor out the shared symbol cache/finder code from linux and mac.
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
55286f04cb
|
Consolidate identical code into a single symbol cache, add mac automagic list and pycharm reformat.
|
2018-12-13 15:56:24 +00:00 |
|
|
Andrew Caseandikelos
|
622c86f9ed
|
Add initial mac backend code, with broken DTB finding, along with the pslist plugin
|
2018-12-13 15:56:24 +00:00 |
|
|
Mike Auty
|
c9a08603c7
|
Move the get_requirements over to the IntermedSymbols which actually requires the parameter.
|
2018-12-13 01:39:26 +00:00 |
|
|
Mike Auty
|
5e8ba16709
|
Remove the unimplemented hook.
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
dfaaf1e455
|
Fix up some things missed in the master refactor.
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
7c4cb0d291
|
Remove attempts to improve speed that may not help.
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
da2f3b38d3
|
Add in page-table repetition blocking code (helps with windows 10 virtual space).
|
2018-12-13 01:16:05 +00:00 |
|
|
Michael Lighandikelos
|
736a1c6e50
|
add is_valid() for _FILE_OBJECT and _EPROCESS
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
91b2c61803
|
Try to add some optimizations to intel scanning.
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
76264cee34
|
Catch invalid _OBJECT_HEADER objects.
|
2018-12-13 01:16:05 +00:00 |
|
|
Michael Lighandikelos
|
650a188d51
|
updates for win8/win10 poolscanning
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
fa033b8ab7
|
Back out the symbol_table_name parameter, and provide full symbol names in the constraints.
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
eacc45dab6
|
Ensure POOL_HEADER finds the right object in the right symbol table.
|
2018-12-13 01:16:05 +00:00 |
|
|
Michael Lighandikelos
|
d653839359
|
switch Handles.find_cookie() to a classmethod so it can be called from the poolscanner. add typing
|
2018-12-13 01:16:05 +00:00 |
|
|
Michael Lighandikelos
|
d667a68f97
|
switch Handles.list_objects() to a classmethod so it can be called from the poolscanner. pass the type_map into get_object()
|
2018-12-13 01:16:05 +00:00 |
|
|
Michael Lighandikelos
|
a76d71a7dc
|
move the functionality for getting an object's type into the _OBJECT_HEADER extension
|
2018-12-13 01:16:05 +00:00 |
|
|
Mike Auty
|
b148305f76
|
Add in protection for the Lime Layer being unable to read the header.
|
2018-12-12 23:42:31 +00:00 |
|
|
Mike Auty
|
8acbe8bba3
|
Refactor conversion code from objects.utility to a conversion module in renderers.
|
2018-12-12 23:39:10 +00:00 |
|
|
Mike Auty
|
1a5c9d3af8
|
Roll symbols.utility into symbols file until we get enough functions we need to split them out again.
|
2018-12-12 23:38:01 +00:00 |
|
|
Mike Auty
|
f57bfa5738
|
Prepare core plugins for moving into the framework namespace.
|
2018-12-09 13:32:32 +00:00 |
|
|
Mike Auty
|
cf95f6e73e
|
Minor typing fix.
|
2018-12-08 18:41:13 +00:00 |
|
|
Mike Auty
|
b5d532555c
|
Convert the adhoc scanner into a layer scanner using sections.
|
2018-12-08 18:21:39 +00:00 |
|
|
Mike Auty
|
649a39a13d
|
Change time_as_integer from a property to get_time_as_integer method.
|
2018-12-08 18:00:44 +00:00 |
|
|
Mike Auty
|
918653e398
|
Convert aslr_mask_symbol_table to more parameterized form.
|
2018-12-08 17:55:13 +00:00 |
|
|
Andrew Caseandikelos
|
8705fb3047
|
update time_object to get_time_object
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
0e7b6b6702
|
Updated hist_entry type and references, add bash plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
3ab654847e
|
Change NotApplicableValue -> UnparsableValue
|
2018-12-08 17:34:48 +00:00 |
|
|
Andrew Caseandikelos
|
c6e9763e5a
|
Linux - add bash plugin
|
2018-12-08 17:34:48 +00:00 |
|
|
Mike Auty
|
34ed11bfc0
|
Fix up issue with coalescing sections.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
aaeb349a70
|
Remove debugging call.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
4fabb762d2
|
Make some typing fixes and remove specification of the iterator.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
5a331f9f01
|
A few remaining changes due to the API aleration.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
341b9b8f9e
|
Add in initial changes for scanner sections.
|
2018-12-07 01:47:16 +00:00 |
|
|
Mike Auty
|
3f2f3cd2f3
|
Add a reminder to fix up the API in this place.
|
2018-12-03 21:52:29 +00:00 |
|