 Andrew Case
|
703b29be24
|
Linux - fix bug in file enumeration code
|
2020-08-16 15:04:55 -05:00 |
|
|
Andrew Case
|
794d25e1f7
|
Merge pull request #633 from iSmellPowder/patch-1
Update tty_check.py to support unified output
|
2020-05-13 18:06:30 -05:00 |
|
|
Andrew Case
|
fb0e09974a
|
Merge pull request #625 from pagabuc/kuid_t
Handling kuid_t/kgid_t types in struct inode
|
2020-05-13 18:04:22 -05:00 |
|
|
Andrew Case
|
809b5d7f69
|
Merge pull request #559 from demoray/master
prevent infinite looping handling fops
|
2020-05-13 17:59:51 -05:00 |
|
|
Andrew Case
|
861837051e
|
update mount for smear protection
|
2019-07-26 12:26:34 -05:00 |
|
|
iSmellPowder
|
370cb98342
|
Update tty_check.py to support unified output
Added in codes to support JSON/unified output
|
2019-07-23 10:55:57 +08:00 |
|
|
Andrew Case
|
8769579a83
|
Update check_afinfo for 4.18+
|
2019-07-10 11:22:51 -05:00 |
|
|
Andrew Case
|
d1e3c41ff0
|
Update pidhashtable for 4.18+
|
2019-07-10 11:22:39 -05:00 |
|
|
Fabio
|
d5b5ad8ed9
|
Handling kuid_t/kgid_t types in struct inode
|
2019-07-08 17:50:30 +02:00 |
|
|
Andrew Case
|
019b0f9fdc
|
Linux - add file extraction support for 4.18-4.20
|
2019-05-22 13:30:12 -05:00 |
|
|
Andrew Case
|
74f1134865
|
Linux - more smear protection
|
2019-05-21 14:33:24 -05:00 |
|
|
Andrew Case
|
b87c4648ed
|
Update mount enumeration v2
|
2019-04-22 14:07:38 -05:00 |
|
|
Andrew Case
|
1cd33e071c
|
Update mount enumeration v1
|
2019-04-22 14:01:20 -05:00 |
|
|
Andrew Case
|
753bfa87b6
|
Linux - fix smear issue in check_fop
|
2019-02-11 18:47:58 -06:00 |
|
|
Andrew Case
|
975b557847
|
Linux - update pidhashtable to fix bug
|
2019-02-11 17:37:34 -06:00 |
|
|
Andrew Case
|
ef758329d4
|
Linux - update check_idt for new data structure
|
2019-02-11 14:15:01 -06:00 |
|
|
Andrew Case
|
5c728c8d2b
|
Linux - fix the 1000th iteration mount list corruption
|
2019-02-11 13:31:30 -06:00 |
|
|
iMHLv2
|
f1ac0b1e90
|
Merge pull request #574 from ant1/fix-yarascan-R
Fix the offset printed when using yarascan -R
|
2019-01-30 09:19:36 -06:00 |
|
|
Andrew Case
|
569b7b971a
|
Linux - add further smear protection
|
2019-01-21 21:25:32 -06:00 |
|
|
Andrew Case
|
355773b9bb
|
Linux - update process hash table enumeration for 4.20
|
2019-01-15 09:56:04 -06:00 |
|
|
Andrew Case
|
79b61a9cea
|
Linux - update cached file extraction for 4.20
|
2019-01-15 09:55:40 -06:00 |
|
|
Andrew Case
|
8c05ce05a0
|
Linux - update check syscall
|
2019-01-15 09:54:57 -06:00 |
|
|
Andrew Case
|
99d1de83e4
|
Linux - Update check_fops for 4.20
|
2019-01-15 09:52:08 -06:00 |
|
|
Andrew Case
|
61a77adc33
|
Linux - update pidhashtable with more smear protection
|
2019-01-07 11:33:53 -06:00 |
|
|
Antoine
|
73077d6fe6
|
Fix the offset printed when using linux_yarascan -R
|
2018-12-24 07:40:16 +00:00 |
|
|
gleeda
|
9c1c613be2
|
Merge pull request #501 from mutedmouse/master
Added unified output to netstat (linux) and ppid to pslist (mac)
|
2018-12-06 10:22:54 -06:00 |
|
|
Brian Caswell
|
d2bdef1858
|
prevent infinite looping handling fops
|
2018-10-30 16:39:24 -04:00 |
|
|
atcuno
|
343753c64f
|
Linux - update operations member checking to avoid RedHat stupidity
|
2018-10-10 22:43:57 -05:00 |
|
|
atcuno
|
2ce4c7f039
|
Add support for the new process tracking radix tree in kernels 4.15+
|
2018-10-01 12:41:25 -05:00 |
|
|
atcuno
|
a48aa66856
|
Linux - sanity check height member
|
2018-06-12 13:38:15 -05:00 |
|
|
atcuno
|
62b516682d
|
Linux - add cache for per-process file path lookups
|
2018-06-11 13:08:47 -05:00 |
|
|
atcuno
|
e7eaee242a
|
Linux - make type check specific in check_syscall
|
2018-06-11 09:49:41 -05:00 |
|
|
atcuno
|
9ad2619a95
|
Linux - add pidhashtable sanity checks
|
2018-06-06 11:19:28 -05:00 |
|
|
Andrew Case
|
1b81b83a6a
|
Linux - fix height calculation
|
2018-04-24 00:12:26 -05:00 |
|
|
Andrew Case
|
f567ace9a3
|
Linux - check tree height in file cache
|
2018-04-17 08:35:06 -05:00 |
|
|
Muted Mouse
|
19e4c5f001
|
add unified output
|
2018-03-24 17:22:36 -04:00 |
|
|
atcuno
|
682b340ae3
|
Linux - update psscan to debug.warning instead of debug.error
|
2018-02-22 14:24:28 -06:00 |
|
|
Andrew Case
|
2da5aec5ce
|
Linux - update system call API
|
2017-08-17 22:57:27 -05:00 |
|
|
Andrew Case
|
4b680c86ec
|
Linux - add support for indexes for both system call tables on 64 bit systems
|
2017-08-17 19:18:06 -05:00 |
|
|
Andrew Case
|
f56382a389
|
Linux - remove prints and update api for linux_moddump
|
2017-08-17 04:01:55 -05:00 |
|
|
Andrew Case
|
5a64808793
|
Linux - update check_fop through 4.13 and with more checks
|
2017-08-14 19:01:48 -05:00 |
|
|
Andrew Case
|
7f9f7715db
|
Linux - add stricter checks in cached file enumeration
|
2017-08-14 18:59:40 -05:00 |
|
|
Andrew Case
|
68065613c3
|
Linux - remove dead code from keyboard_notifiers
|
2017-08-01 09:29:42 -05:00 |
|
|
Andrew Case
|
0d8eb81eab
|
Linux - add support for file extraction through 4.13
|
2017-07-31 23:12:03 -05:00 |
|
|
Andrew Case
|
9c9315ac3e
|
Linux - add support for module scanning, extraction, and enumeration through 4.13
|
2017-07-31 14:11:01 -05:00 |
|
|
Andrew Case
|
c84c491a11
|
Update kref reference counter handling for 4.12
|
2017-07-31 13:07:26 -05:00 |
|
|
atcuno
|
f93390e09c
|
Linux - fix module reference
|
2017-06-09 13:38:58 -05:00 |
|
|
Fabio
|
1bdb319ab4
|
ktime_t is not a union anymore
|
2017-05-13 15:08:43 +02:00 |
|
|
Andrew Case
|
f803a13bc3
|
Merge pull request #403 from bneuburg/issue-392-fixed
Use read_long_long_phys for LinuxAMD64PagedMemory address
|
2017-05-08 08:40:07 -05:00 |
|
|
atcuno
|
3619c8a32f
|
Linux - add support for kernel physical ASLR in 4.9+ kernels
|
2017-05-04 18:06:37 -05:00 |
|