Commit Graph

106 Commits

Author SHA1 Message Date
rakuyo 00ffd7e9c7 merge in master and fix some conflicts 2025-01-10 21:35:41 -05:00
atlas0fd00m 5531bdae6f Vstruct repr render improvement (#674)
* vstruct rendering improvements

* bugfix and unittests

* unittests

* Update vivisect/tests/testvstruct.py

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2025-01-07 17:31:53 -05:00
James Gross 6f729fab2e Fix an annoying off by one issue in the LNK parser (#655) 2024-07-23 11:35:34 -04:00
James Gross 0d883083c2 LNK parser (#649) 2024-07-15 14:57:31 -04:00
rnumsu b3846f3156 Missing IHEX_REC_STARTLINADDR check
- In vstruct/defs/ihex.py getMemoryMaps, there is not a check for
IHEX_REC_STARTLINADDR. The patch adds a check for this record type and
skips over the chunk, similarly to IHEX_REC_STARTSEG.
2024-01-29 17:07:45 -05:00
Erin dde8ac119b sped up vsEmit() of ihex and srec file formats (#627)
* sped up vsEmit() of ihex and srec file formats

* updated generator comprehension to be more efficient per suggestion

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2023-09-01 18:25:30 -04:00
Willi Ballenthin c0708f9498 minidump: parse Threads from MiniDumpThreadListStream (#625)
currently a single thread is parsed, independent of `NumberOfThreads`. this PR parses all the threads.

Co-authored-by: atlas0fd00m <atlas@r4780y.com>
2023-07-20 17:42:43 -04:00
Willi Ballenthin a270f3b967 minidump: fix name of MemoryDescriptor range start (#626)
following naming here: https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_descriptor
2023-07-19 16:29:11 -04:00
Matthias Görgens 7a883f4bbf Migrate away from some deprecated functions (#593)
* Migrate away from deprecated `assertRaisesRegexp`

In Python 3.12 `assertRaisesRegexp` will no longer work.  Replace it with
`assertRaisesRegex`.

* Migrate deprecated threading.currentThread

* Migrate from deprecated `threading.Thread.setDaemon`
2023-03-17 10:07:50 -04:00
atlas0fd00m c35b9e96b5 Arch Const Handling bugfix/refactor (#571)
* auto-build getArchModules() using getArchModule()

refactor getArchModule() to load from a set of dictionaries (instead of manually importing and loading each arch module based on manual matching of the arch string name)

clean up arch_by_name to only include a direct 1-to-1 mapping.  probably should autogenerate this from arch_names

creation of getArchNames() to return a dictionary with only the correctly loaded architectures (for use in things like the Viv Context Menu)

* fix older ELF parsing bug (robustness in the calculation of DYNAMICS DynSyms table)

* bugfix: strsz

* tweak

* clarification and tweak

* delete commented old code

* commentary

* integer division, please.

* removed comments which are half-truths

* architectures transformation to a dict of dicts

* implementing the module loader as a separate function.
storing full path to the envi module libraries, and the ArchitectureModule as a separate field in the dict.

* updates per @rakuy0

* updates per @rakuy0

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2023-02-16 17:03:19 -05:00
Michael Appel 5a3d41efec Don't log to root logger (#565) 2023-01-13 12:35:53 -05:00
atlas0fd00m 70269ab567 Update vstruct/defs/macho/__init__.py 2022-10-30 19:17:48 -04:00
atlas0fd00m 92b068703d Merge branch 'master' into viv_loader 2022-09-09 14:23:19 -04:00
James Gross f638118fbd QT Version Bumps (#541)
Bump qt versions to get things working and installing on windows and manjaro and fix a missing var issue
2022-08-31 21:55:14 -04:00
atlas 6b543f8238 Merge branch 'master' into viv_loader
# Conflicts:
#	vivisect/parsers/elf.py
2022-07-28 09:37:26 -04:00
James Gross 3f8c3141fb Relocatable ELF Support (#531)
* wip

* still some cleanup I wanna do but it's mostly there

* back out a few things and make dynamics win more

* fixup elf tests

* cleanup

* moar data

* test data
2022-07-22 00:30:12 -04:00
rakuyo 266720a0df merge in master 2022-05-30 18:38:58 -04:00
atlas 37b698f26c Merge branch 'master' into viv_loader
# Conflicts:
#	vivisect/analysis/elf/elfplt.py
2022-04-21 15:33:00 -04:00
James Gross a3333bd02e tweak how we handle section names (#514) 2022-03-30 15:05:47 -04:00
atlas 72a35383c1 fix size calculation 2022-01-19 08:19:57 -05:00
atlas bd0a1266fc improving the MemObjFile shim to make a memobj act like a file object. 2022-01-19 08:14:33 -05:00
atlas a7d00d2cd3 Merge branch 'master' into viv_loader
# Conflicts:
#	vivisect/parsers/macho.py
2022-01-18 13:33:28 -05:00
James Gross e4bc9b93cd more mach-o definitions and support (#495)
Add more definitions for FAT64 and CPU arch names/constants.
2022-01-12 14:49:10 -05:00
atlas 401bd5f3c5 bugfix 2021-12-28 10:23:49 -05:00
atlas c17e328a69 bugfix: vsParse doesn't have bigend defined 2021-12-28 09:05:50 -05:00
atlas a8a1332667 off by one 2021-12-27 20:04:37 -05:00
atlas e7f3df071a Merge branch 'master-upstream' into viv_loader
# Conflicts:
#	vivisect/parsers/macho.py
#	vstruct/defs/macho/__init__.py
#	vstruct/defs/macho/const.py
#	vstruct/defs/macho/loader.py
2021-12-27 17:41:56 -05:00
atlas 8f05afcd8c make LC_UNIXTHREAD/thread_command work with .flavor (and getEntryPoints())
updates to work with bigendian (and wonky git-shit)
2021-12-27 17:31:30 -05:00
atlas 83ccea77f3 touchup 2021-12-27 17:17:27 -05:00
atlas b28b46c8fb updates to support big-endian MachO 2021-12-27 17:15:37 -05:00
atlas 30a1f13de6 macho is loading an MACHO-64 binary into a workspace :) 2021-12-27 17:15:37 -05:00
atlas 1353cdce12 making macho progress. it's apparently been very limited if not broken for a while. bringing it into the 2020's 2021-12-27 17:13:50 -05:00
atlas a374161e27 Merge branch 'master' into viv_loader.
rehashing lots of Mach-O parsing stuff (especially around endianness)

# Conflicts:
#	vivisect/parsers/macho.py
#	vstruct/defs/macho/__init__.py
#	vstruct/defs/macho/const.py
#	vstruct/defs/macho/loader.py
2021-12-27 16:15:02 -05:00
James Gross 6405bc5519 update macho parsing to the modern age (#486)
Fix and extend Mach-O parsing, add tests, more structure definitions. Just a large round of needed updates.
2021-12-22 16:31:18 -05:00
James Gross f9505fb407 update macho parsing to the modern age (#486)
Fix and extend Mach-O parsing, add tests, more structure definitions. Just a large round of needed updates.
2021-12-21 01:42:24 -05:00
atlas d45de4d486 macho is loading an MACHO-64 binary into a workspace :) 2021-11-15 04:10:12 -05:00
atlas c88e3ce234 making macho progress. it's apparently been very limited if not broken for a while. bringing it into the 2020's 2021-11-15 03:20:51 -05:00
atlas e0c4f65ca4 lots of updates to support getBaseAddrAndSize() on each file format (except macho, which is a wip) 2021-11-15 02:51:23 -05:00
rakuyo 0f6d22de29 Merge branch 'master' into dotnet_basics 2021-09-26 22:00:13 -04:00
rakuyo 3222ce2484 merge and fix 2021-08-28 01:45:12 -04:00
atlas0fd00m e42e6de568 i386-more-emu-bugfixes (#405)
* initial emulation commit:
bugfix: BSF
bugfix: ROR (emu doesn't set OF when processor does, in the "undefined behavior" realm)
add: e_bits.msb_minus_one() and unittest

* a few bugs

* psize should be imem_psize

* PE use archcalls instead of defcalls...

* more updates - emu-bugfixes and lockstep updates

* amd64-emu-bugfixes and lockstep work.

* bugfix for call [esp + FOO]
bugfix for pushfd

* new memory allocator (been long in coming).  hey, it said "fixme!"

* more efficient findFreeMemoryBlock() algorithm

* lots of emulation and symbol bugfixes

* enhancement: REP i386reponce
enhancement: i386 LEA analyzed for accessing local vars

* tweak for Function Header
bugfix: VWGUI envi nav sendto (actually check and limit which funcgraphs are sent)

* bugfix: REP/REPZ/REPNZ handlers

* Safeguard codeblocks.py as it counts mnemonics (#408)

* Safeguard codeblocks.py as it counts mnemonics

* Add logging for error

* break instead of pass

Co-authored-by: todd-plantenga <todd.plantenga@mandiant.com>
Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>

* Yet Another Grabbag Bugfix PR (#404)

* Get vtrace and other unittests working on windows
* tests for vivisect.reports
* PE.carve bytes/string IO fix
* lots of fixes to the intel emulators per the lockstepper test which only runs on windows.
* utilitize some common hex functionality

* bugfix and implement BOUND emulation

* reponce bugfix
cleanup

* mods and bugfixes per @rakuy0

* updates from merge-fail

* bugfix: envitools->util

* more tweaks for unittests and @rakuy0

* replacing delMemoryMap() in envi.memory!

* fix unittest that doesn't want to work correctly.

* modified rep prefix handler to handle repz as well.
unittests

* updated BSR tests (and emu flags work)

* changes per @rakuy0

* bugfix: IMUL now does signed math

* fixed unittest

* mods per @rakuy0

* unduplicate the rep_handler list for Amd64Emulator (since it's defined in IntelEmulator's __init__)

* updated MM_* constants from envi.const

* more e_mem -> e_const for MM_READ/WRITE/etc..

* updates per @rakuy0

* touchups before the purge...  about to kill off the LockStep stuff from this branch (will continue in Vtrace conversions PR#406)

* RESET LockStepper code and tests.  look to Vtrace PR#406 for these changes

* test allocateMemory() "insufficient contiguous memory" exception case.

Co-authored-by: upside2 <todd.plantenga@fireeye.com>
Co-authored-by: todd-plantenga <todd.plantenga@mandiant.com>
Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2021-08-22 00:29:36 -04:00
James Gross 6de41d2f23 Fix vstruct number issue (#412)
Squash a few bugs in vstruct related to negative numbers and unformatted values.
2021-07-31 00:09:44 -04:00
James Gross 726afe014a Yet Another Grabbag Bugfix PR (#404)
* Get vtrace and other unittests working on windows
* tests for vivisect.reports
* PE.carve bytes/string IO fix
* lots of fixes to the intel emulators per the lockstepper test which only runs on windows.
* utilitize some common hex functionality
2021-07-06 10:54:26 -04:00
rakuyo 0c946f9e4e stash working 2021-06-12 23:46:52 -04:00
rakuyo 6054bbd43e Bug fix and updates 2021-02-15 02:58:22 -05:00
rakuyo 55740e7435 Merge branch 'master' into dotnet_basics 2021-02-13 19:13:20 -05:00
James Gross 888d683663 Py3 Cleanup (#353)
* clean up the emulators a bit. tried to use safemem to fix the bug, but that didn't work as intended.

* ton of cleanup and test cleanup. and also emulator fix

* found the edge case

* Make the dirs on a save just in case

* fix issue with v_zwstr in vstruct parsing and cleanup

* Bunch of little fixups from division fixes for py2/3 stuff, a set of new intel instructions (from decoding all the way up to symboliks), to PE loading

* Docstring updates, more unittests for vstruct, extension fix, memcanvas fix for certain edge cases. Overall: incorporating feedback from @willi and @atlas

* custom log level

* envi config encoding per @willi, getting memoryview hotkeys working again for the same reason mouse was broken
2021-02-12 22:55:03 -05:00
James Gross a7b5f8deef Py3 cutover (try number: who knows?) (#328)
Massive cutover to python3 (baseline is 3.9.1, but is also tested/working on 3.7.x). This merge is a breaking change for any downstream consumers, as the python 2->3 strings/bytes change is central. Most APIs should still work roughly as intended, as I didn't majorly re-organize the codebase, so most APIs live where they lived before. But a changelog/migration guide will be included in the next PR for this.

This PR will constitute most if not all of the v1.0.0 release that is forthcoming soon.
2021-02-03 14:37:09 -05:00
atlas0fd00m 955491fbfb srec parser support (#343)
* initial commit of SREC file parser

* vivbin really wants to read in more than one option at a time!

* minor SREC parser bugfixes

* cleanup and logging

* updates per @rakuy0

* bugfix

* cleanup and unittest per @rakuyo

* cleanup

* updates per @rakuy0

* bugfix: imported constants

* updates to SREC and IHEX for hashing and improved parsing.

* div comment per @rakuy0

* reduce log clutter on makePointers where pointers already exist (at the same location)
2021-01-30 01:35:46 -05:00
atlas0fd00m b46509bad0 streamlined testelf, loading one workspace at a time. (#340)
* streamlined testelf, loading one workspace at a time.

* merge fail

* updates

* bugfix

* your hex and blob unittests, and a bugfix for ihex parsing.

* bugfix per @rakuyo

* bugfix (newrel) and cleanup.

* fix wrong handling of IHEX_REC_STARTSEG
2021-01-18 09:40:41 -05:00