Mike Auty
eae84fd8e0
Ensure we only stack when needed
...
We shouldn't be stacking unless we're required, so now
we run after the construction phase, and run our own construction
phase is we've changed anything.
2016-12-12 02:06:54 +00:00
Mike Auty
046d1955b5
Ensure that only unfulfilled symbol requirements trigger the pdb scanner.
2016-12-12 02:04:20 +00:00
Mike Auty
b9dbc80baf
Improve logging of automagic actitivies.
2016-12-11 18:16:02 +00:00
Mike Auty
5d15f810e1
Tidy up the config namespace around automagic a little.
2016-12-11 13:58:17 +00:00
Mike Auty
9bb0745b83
Clean up the debug messages for pdbscanning.
2016-12-08 16:29:36 +00:00
Mike Auty
2aebb99ee6
Slightly improve the output and get rid of pointless parameters.
2016-12-08 16:24:59 +00:00
Mike Auty
8a0609e800
Add in a secondary scan to determine the kernel base in randomized kernel base systems.
2016-12-08 16:24:03 +00:00
Mike Auty
482516d93d
Rework the kvo finding code to allow for Win10 kernel base randomization.
2016-12-08 14:56:32 +00:00
Mike Auty
631ae07a26
Insert a check to use valid kernels where a pdb signature is found in multiple locations.
2016-12-08 11:55:46 +00:00
Mike Auty
183ff67699
Attach the kernel virtual offset to intel spaces.
2016-12-07 16:00:31 +00:00
Mike Auty
6cb5d06d6d
Ensure all offsets are normalized to fall within their layer's address range.
2016-12-07 00:07:57 +00:00
Mike Auty
734b9a68b8
Ensure we use math.log correctly.
...
This is unlikely to ever happen (since we use python3)
but still just as well to implement in case something else
similar comes up.
https://www.willmcgugan.com/blog/tech/post/finding-the-first-bit-set-with-python/
2016-12-06 23:40:21 +00:00
Mike Auty
40694ff26c
Add a note about precedence to the pdb loader.
2016-12-06 09:08:51 +00:00
Mike Auty
a064c76628
Ensure we initialize kvo, change the filename format and give human readable feedback on the choice of natives.
2016-12-06 02:44:50 +00:00
Mike Auty
05ae4aa64a
Fix up offset for PAE.
2016-12-04 10:24:33 +00:00
Mike Auty
d8b72cfc14
Add in checks and set the appropriate kernel location for all architectures.
2016-12-04 02:17:11 +00:00
Mike Auty
4121895d4d
Ensure the kernel virtual to physical offset mapping is correct.
2016-12-04 01:21:10 +00:00
Mike Auty
23fd704027
Add in the kernel offset recursion code.
2016-12-04 01:00:37 +00:00
Mike Auty
9a3402ccff
Fix the incorrect signature offset returned.
2016-12-03 21:39:04 +00:00
Mike Auty
70815b0837
Shift the location of the pdbscan prefix/suffix values.
2016-12-02 21:44:23 +00:00
Mike Auty
ed552d20e8
Add in support for lzma compressed json data.
2016-12-02 01:34:07 +00:00
Mike Auty
c86f0ddef4
Add in a very rudimentary kernel PDB finding plugin that identifies and automatically loads the appropriate kernel for the image.
2016-11-27 23:40:19 +00:00
Mike Auty
b2c3c76954
Don't forget the fixes that still need to happen.
2016-11-19 23:41:35 +00:00
Mike Auty
72259008f3
Use the physical layer and improve the output.
...
The physical layer will miss certain patterns, but is an order of
magnitude faster at scanning. The main amount of time spent in scanning
Intel spaces is counting through every page in the address space (32, 40
or 64 bits), not the actual scanning. There's no real way around this
if you want to ensure you get every chunk of virtual memory. Since the
scanner could be stopped after its first hit, this might still be
preferable, but should not be the default (particularly for an automagic
scan).
2016-11-19 23:36:48 +00:00
Mike Auty
38b1c61acc
Remove debugging values from the pdb scanner.
2016-11-18 17:18:50 +00:00
Mike Auty
3c181e940e
Tidy up to use a single method for reading from the context.
2016-11-18 17:18:30 +00:00
Mike Auty
f688af529b
Initial commit of pdb kernel scanning automagic code.
2016-11-18 11:39:55 +00:00
Mike Auty
28fdbbe348
Refactor the pdb names, to make the class more generic.
2016-11-03 00:53:08 +00:00
Mike Auty
df2172754c
Refactor the pdbscanning code so it doesn't sneak into the library accidentally.
2016-11-01 23:32:12 +00:00
Mike Auty
d6039fb899
Initial port of npetroni's pdbscanner (with bugfix for multiple RDRS entries in a single scan chunk).
2016-11-01 02:06:08 +00:00
Mike Auty
667014a1fd
Attempt to standardize error message display.
2016-10-30 17:51:45 +00:00
Mike Auty
f771de3703
Tidy up error messages.
2016-10-30 17:07:48 +00:00
Mike Auty
d232be2f6e
Try to update the generic dtb finder to rule out false positives.
2016-10-01 22:13:42 +01:00
Mike Auty
1a83470993
Convert dtbfinder to a standalone app.
...
This is in development so that it's clearly not production code
(and should not expect to be supported as such).
2016-09-25 19:33:04 +01:00
Mike Auty
fbe3682592
Allow stack functions to return None as a failure response.
2016-08-26 08:29:45 +01:00
Mike Auty
32bdeafa8a
Improve the stacker to append the generated stack configuration into the original context.
2016-08-24 01:31:45 +01:00
Mike Auty
721d5ade3f
Give the LowestLayer a proper name in the interim configs, and ensure it's in the stack.
2016-08-24 01:30:32 +01:00
Mike Auty
04b760ee3e
Increase the priority so this is always run first, and we're going to use the requirement variable.
2016-08-24 01:29:53 +01:00
Mike Auty
01616af655
Remove comment, it's already been converted.
2016-08-24 01:11:46 +01:00
Mike Auty
546bca1893
Rename the IntelHelper to make it a little more accurate.
2016-08-22 02:28:20 +01:00
Mike Auty
3dc161f9b4
Rework Translation Layers to tie more closely to configurations
...
This change is quite signficant, and requires that TranslationLayers
get all additional parameters that they need through their requirements.
These are now automatically enumerated and populated on object
construction based on the requirements, so should not require lots of
repetitive filling out of fields.
It does come with the downside that TranslationLayers can only be
contructed with a context (and appropiate config), but TLs in particular
always require a context (to contain the base layer) and blank configs
can be constructed relatively easily (convenience functions can be added
if necessary).
This allows configuration trees to be built up, and their configs
spliced into an existing config (as if it were being loaded from a
file).
Not all ConstructableRequirements use this method, since SymbolTables
(for example) do not have access to the context or config_path in order
to get to any parameters stored in the context's config. They therefore
are still passed their requirement values as __init__ parameters
instead.
2016-08-22 02:20:10 +01:00
Mike Auty
eb5e3f69de
Ensure we're not importing sub-imports from something else.
2016-08-22 02:01:31 +01:00
Mike Auty
f48ee5ff33
Add in the actual stacking automagic.
2016-08-22 00:06:04 +01:00
Mike Auty
7648c94083
Add in the intial works at a stacking plugin to emulate volatility 2 address space stacking.
2016-08-22 00:00:21 +01:00
Mike Auty
f0cf128bdd
Add in the self-referential tests to the standalone component of the windows automagic module.
2016-08-20 16:55:32 +01:00
Mike Auty
c38d650819
Add in generic self-referential tests.
2016-08-20 16:54:04 +01:00
Mike Auty
77f295f0a4
Calculate the pointer size, rather than taking it as an argument.
2016-08-20 16:53:36 +01:00
Mike Auty
2467917431
Fix up DTB Finder which was broken in commit eccfb1c2. 5:S
2016-08-20 14:16:02 +01:00
Mike Auty
2bd12b834f
Fix minor breakage from the previous reordering of parameters.
2016-08-17 23:25:08 +01:00
Mike Auty
6712d5dee1
Update the automagic uses to ensure a consistent ordering of the arguments.
2016-08-17 20:38:18 +01:00
Mike Auty