Commit Graph

  • 813e3ec5eb Remove NLP DTB finder, since it seems most other scanners cover all the bases. Mike Auty 2018-11-07 20:12:24 +00:00
  • 36cc973d6d Fix up minor typo in the plugin help. Mike Auty 2018-11-04 22:43:46 +00:00
  • 001d53e768 Rework some code to help with typing. Mike Auty 2018-11-01 11:17:15 +00:00
  • 8b7c34c20b Ensure all the schemas, json files and plugins get pulled in. Mike Auty 2018-10-31 17:15:59 +00:00
  • 4629d5c1e2 Ensure we package all the plugins and their data files. Mike Auty 2018-10-31 17:03:58 +00:00
  • f3fce720b1 Don't show errors if there are none. Mike Auty 2018-10-31 17:03:43 +00:00
  • 3d7dc1fb21 Add more debugging for plugin paths. Mike Auty 2018-10-31 00:03:39 +00:00
  • dd33333d89 Make sure volshell is in sync. Mike Auty 2018-10-31 00:03:27 +00:00
  • e3e1c4e00b Initial commit of pyinstaller spec. Some changes to path handling to help. Mike Auty 2018-10-30 23:56:34 +00:00
  • 241b7475fb Add in an initial implementation of the metadata system (extremely liable to change). Mike Auty 2018-10-30 15:01:31 +00:00
  • f76aa66805 Reduce the risk of scanning the entire virtual address space, given we've already found potential kernels. Mike Auty 2018-10-26 22:39:36 +01:00
  • e9bad27793 Add in kdbg_offset method for pdbscan, and make the module_offset the third choice. Mike Auty 2018-10-26 22:28:09 +01:00
  • 68a4bbf26c Modularize pdb finding code. Mike Auty 2018-10-26 00:47:01 +01:00
  • 03023e45eb Add in schema version 6. Mike Auty 2018-10-24 22:45:16 +01:00
  • e6711f580d Add required poolheader types and change the PoolHeaderSymbolTable to match the inheritted constructor signature. Mike Auty 2018-10-24 19:31:22 +01:00
  • ff3bae0804 Fix up typing information. Mike Auty 2018-10-14 23:03:58 +01:00
  • d799d4edd8 Add additional typing information. Mike Auty 2018-10-11 16:40:59 +01:00
  • 2288f54a44 Raise exception instead of returning None. Mike Auty 2018-10-11 14:26:37 +01:00
  • f1c5b3ca29 Improve the typing in places. Mike Auty 2018-10-11 11:14:29 +01:00
  • 21384be035 Remove the confusing max/min address values in scan chunk (the iterator should only pass chunks that need scanning). Mike Auty 2018-10-11 11:14:07 +01:00
  • df57ee5045 Fix minor typo in poolscanner logic (thanks mypy!). Mike Auty 2018-10-10 15:32:28 +01:00
  • e500e87fc6 Add in type annotations for the poolscanner plugin. Mike Auty 2018-10-05 00:20:44 +01:00
  • d829028a36 Apply various type annotation/bug fixes. Mike Auty 2018-10-05 00:16:42 +01:00
  • 9c101aee91 Ensure pointers are masked based on their native_layer not their instantiated layer. Mike Auty 2018-10-04 02:44:26 +01:00
  • 2943ae1dc6 Fix up another exception gone rogue. Mike Auty 2018-10-04 02:13:40 +01:00
  • f044569613 Fix up catching the wrong exception type (and the lack of context). Mike Auty 2018-10-04 02:07:33 +01:00
  • d6b60149a1 Update poolscanner to use the new symbol_table_is_64bit function. Mike Auty 2018-10-03 23:36:54 +01:00
  • 77a894b224 Convert 64bit checks to a symbol utility function. Mike Auty 2018-10-03 23:34:12 +01:00
  • 97ae236fcc add the pool header json files to be used when kernels fail to define their own _POOL_HEADER Michael Ligh 2018-10-03 17:07:07 -05:00
  • 09f12a2126 Add in most of the code required for poolscanning goodness. @imhlv2 to fix the tests. Mike Auty 2018-10-03 22:03:29 +01:00
  • da6d211a40 The isf_url parameter is never populated, so this can go away. Mike Auty 2018-10-03 21:32:31 +01:00
  • c8dd50dacb Improve help message to list unloadable plugins. Mike Auty 2018-10-03 21:32:03 +01:00
  • 6a79d803dc Fix up timeliner to produce files rather than writing them directly. Mike Auty 2018-10-03 21:31:36 +01:00
  • c0b7376226 Ensure we don't break all plugins on versions where _POOL_HEADER doesn't exist. Mike Auty 2018-09-30 17:00:25 +01:00
  • 701c56558b Fix a typo from the big refactor in commit 190ffaf2. Mike Auty 2018-09-28 12:51:55 +01:00
  • de3bfad135 Replace 'raise StopIteration' with a blank 'return', since changes in python-3.7 change StopIeration to a RuntimeError. Mike Auty 2018-09-28 12:44:19 +01:00
  • 3e176c8a50 Use the prefered method of dynamic importing. Mike Auty 2018-09-28 12:05:57 +01:00
  • fc0d2bcf10 Support recording the configuration data for timeliner. Mike Auty 2018-09-24 01:06:28 +01:00
  • 059edd56c8 Convert timeliner to use the plugin runner. Mike Auty 2018-09-24 00:52:17 +01:00
  • 99ba8bfb3f Change plugin runner to use a base_config_path. Mike Auty 2018-09-24 00:45:36 +01:00
  • e5024420c8 Refactor plugin running to ensure automagics and reconstruction occur properly. Mike Auty 2018-09-24 00:36:40 +01:00
  • 821841e7ee Refactor wher ethe UnsatisfiedException lives. Mike Auty 2018-09-23 22:55:37 +01:00
  • 4eb30d5003 Rework the config_value method. Mike Auty 2018-09-23 22:55:10 +01:00
  • 00a118a06a Reduce return results from find_requirements. Mike Auty 2018-09-23 22:24:44 +01:00
  • 6c938869db Refactor timeliner to clarify when automagic happens. Mike Auty 2018-09-23 18:19:23 +01:00
  • 81bef5ace8 Minor fixes to the requirement framework. Mike Auty 2018-09-23 18:13:58 +01:00
  • 828652f9cb Convert LayerList into more generic ComplexType List. Mike Auty 2018-09-23 13:11:26 +01:00
  • e203d11e0b Ensure the swap list configuration gets set appropriately. Mike Auty 2018-09-23 13:06:48 +01:00
  • c9ecf5fa2a ConfigurableRequirements should be Requirements. Mike Auty 2018-09-21 11:43:33 +01:00
  • 190ffaf28b Refactor where certain types of requirement live (given they're more concrete than interface). Mike Auty 2018-09-20 16:14:57 +01:00
  • 8d5a6ffdd4 Refactor InstanceRequirement into SimpleTypeRequirement. Mike Auty 2018-09-20 14:56:16 +01:00
  • 222b5f14a7 There is no need to cast as ord. Mike Auty 2018-09-16 16:24:34 +01:00
  • 90d13be9a9 Ensure we pass the native_layer_name whenever constructing a subobject. Mike Auty 2018-09-16 15:59:30 +01:00
  • 569bc97bc2 Fix up the use of native_layer_name in the poolscanning code. Mike Auty 2018-09-16 15:31:50 +01:00
  • efd9dffdfe Fix up the passing of native_layer_name to object constructors. Mike Auty 2018-09-16 14:33:24 +01:00
  • 5add8ea078 Remove the obsolete FIXME. Mike Auty 2018-09-15 15:23:43 +01:00
  • fffdd253ae use renderers.NotApplicableValue() for the poolscanner plugin's name field Michael Lighandikelos 2018-09-15 09:18:32 -05:00
  • ac60d36e04 pass in native_layer_name to _POOL_HEADER.get_object() and remove FIXME Michael Lighandikelos 2018-09-15 09:10:03 -05:00
  • 88f73365ee remove vol magic comment Michael Lighandikelos 2018-09-15 09:06:44 -05:00
  • 668f8ad037 add pydocs to windows extension classes Michael Lighandikelos 2018-09-15 09:01:20 -05:00
  • 0baa0ecdf5 Update the poolscanner to take care of multiple constraints with the same tag. Mike Auty 2018-09-13 00:31:09 +01:00
  • 9d6055d2ba add a lambda placeholder for is_windows_10 - replace it once we have PE file version checks Michael Lighandikelos 2018-09-12 09:48:23 -05:00
  • f02df7a92e reduce the extra tag_type_map lookup by yielding the constraint from the pool scanner Michael Lighandikelos 2018-09-12 08:49:49 -05:00
  • 5d20faa0a7 work on _POOL_HEADER.get_object() Michael Lighandikelos 2018-09-11 09:18:31 -05:00
  • be6a351a11 start adding the _POOL_HEADER extension. expand the pool constraints to include processes Michael Lighandikelos 2018-09-10 23:31:42 -05:00
  • ce4ed9fea8 Add in the start of actual output from the poolscanner. Mike Auty 2018-08-30 11:14:48 +01:00
  • 56a5012a46 fix alignment, should offset be optional to context.module()? refactor pool type checks Michael Lighandikelos 2018-05-23 22:25:37 -05:00
  • 8a5d3b0c1e Initial poolscanning code. Mike Auty 2018-05-06 16:12:59 +01:00
  • 00a7f9ce2d Rework the way verinfo works. Mike Auty 2018-09-13 00:24:57 +01:00
  • 6dc8b4d517 Create a windows.registry category. Mike Auty 2018-09-12 22:55:32 +01:00
  • fa552aa3b0 Add in the native_layer_name concept to ObjectInformation. Mike Auty 2018-09-12 22:45:34 +01:00
  • dd5edc395a Add in commented code for keeping the zip file in sync if we decide it's needed. Mike Auty 2018-09-03 22:14:48 +01:00
  • abee0f8de7 Change the ASLR finding code to return no shift values (and log when it's found none). Mike Auty 2018-09-03 21:48:16 +01:00
  • f584be8d18 Fix up the linux symbol caching code. Mike Auty 2018-09-03 21:39:48 +01:00
  • 0c46da22c3 Readd the check to ensure we don't stack on top of an existing Intel layer. Mike Auty 2018-09-02 19:03:39 +01:00
  • 7f966901cf Ensure the dtb can't get specified from an earlier run around the loop. Mike Auty 2018-09-02 18:28:59 +01:00
  • c1dc36a327 Fix up the breakage from the preivous commit. Mike Auty 2018-09-02 18:27:28 +01:00
  • 29f1a0f216 Change the default state for stacking to ensure layer isn't set unless successful. Mike Auty 2018-09-02 17:42:55 +01:00
  • e665ec7505 Minor fix in Volshell. Mike Auty 2018-09-02 16:59:03 +01:00
  • 2d2b3c27dc Fix up the symbols import in volshell. Mike Auty 2018-09-02 00:58:27 +01:00
  • 1299fa4a36 Fix up volshell failing on missing modules (eg, yara) and tart up the setup file. Mike Auty 2018-09-02 00:52:17 +01:00
  • 5668f271df Fix issue when handling zip files on windows. Mike Auty 2018-09-02 00:13:33 +01:00
  • 3713e9484c Add in a setup.py and fix up the documentation so setuptools can build it. Mike Auty 2018-09-01 22:28:03 +01:00
  • 312e74cd08 Improve typing information for verinfo. Mike Auty 2018-09-01 22:14:34 +01:00
  • 0550186ed2 Fix a couple bugs in moddump. Mike Auty 2018-09-01 22:04:51 +01:00
  • dff7e6d6df Add in support for specific symbol directories. Mike Auty 2018-09-01 21:57:49 +01:00
  • 9d05482e50 Make sure we appropriately use classmethods now they're in place. Mike Auty 2018-08-30 16:40:39 +01:00
  • ce63ee2e83 Conver the verinfo plugin to using the classmethod moddump. Mike Auty 2018-08-30 12:02:04 +01:00
  • edac0bee6f Update moddump to use classmethods. Mike Auty 2018-06-16 17:28:18 +01:00
  • 5791cfaab7 Stop overriding the builtin filter method, and ensure suitable parameter names. Mike Auty 2018-08-30 11:41:19 +01:00
  • 26a4eb66d9 move import to the top superponibleandikelos 2018-08-29 21:12:05 -05:00
  • f5e075ab72 change comment to docstring superponibleandikelos 2018-08-29 21:10:20 -05:00
  • eb9a426760 switch enum.Enum to enum.IntEnum superponibleandikelos 2018-08-29 21:08:58 -05:00
  • c676f17fc8 refs #39 - update _CM_KEY_BODY.get_full_key_name() Dave Lassalleandikelos 2018-08-29 10:48:41 -05:00
  • f4dd40ba0b Ensure we're catching the appropriate expcetions rather than all of them. Mike Auty 2018-08-30 09:41:39 +01:00
  • 19dcb80de6 catch os detection exception, change loop break to continue superponible 2018-08-29 20:59:42 -05:00
  • cc99d08c88 Move userassist keys over to a JSON data file. Mike Auty 2018-08-30 00:52:02 +01:00
  • 93607b2586 Fix up exception catching with no exception specified. Mike Auty 2018-08-30 00:36:32 +01:00
  • fe9a1617c9 Include printkey in the hivelist conversion. Mike Auty 2018-08-29 23:31:39 +01:00
  • 0aa6ba0fe0 Convert hivelist to classmethod style. Mike Auty 2018-08-29 23:29:51 +01:00