 iMHLv2
|
26563fdccc
|
add sanity checks to the PoolScanTcpEndpoint results in netscan. these cannot be done with a ScannerCheck because they need to deref pointers in kernel space and we do scanning in physical space
|
2012-05-18 18:07:00 +00:00 |
|
|
iMHLv2
|
43a0229f51
|
now that r1716 fixed CheckPoolType, modify netscan to search only in free and non-paged pools. network objects will never be found in paged pools
|
2012-05-18 17:40:13 +00:00 |
|
|
mike.auty@gmail.com
|
996e18b412
|
Check in netscan valid profile override.
|
2012-05-18 10:25:07 +00:00 |
|
|
mike.auty@gmail.com
|
4f6681a14d
|
Apply basic windows restrictions to most windows plugins.
|
2012-05-18 09:53:27 +00:00 |
|
|
mike.auty@gmail.com
|
eb5a0c8278
|
Pull in the Command profile-decision support from linux-trunk.
|
2012-05-18 09:08:48 +00:00 |
|
|
iMHLv2
|
ffb98015fc
|
the paged vs non-paged logic is reversed in CheckPoolType for Vista/2008/7. fixes Issue #257.
|
2012-05-17 14:06:16 +00:00 |
|
|
iMHLv2
|
e4ec2aac49
|
apply the x64 win7 netscan vtypes to x64 vista and x64 2008. helps with issue #194.
|
2012-05-16 22:22:57 +00:00 |
|
|
iMHLv2
|
19dc3ae4f5
|
add standard license to tcpip_vtypes.py and some comments to help describe which vtypes apply to which profiles
|
2012-05-16 19:06:15 +00:00 |
|
|
iMHLv2
|
5393c37dde
|
add object classes for netscan's _TCP_LISTENER, _TCP_ENDPOINT, and _UDP_ENDPOINT. this cleanup is a pre-requisite for closing issue #194
|
2012-05-16 18:12:47 +00:00 |
|
|
iMHLv2
|
c4454fa2ca
|
remove some unnecessary variable re-assignments in netscan, now that we don't need socket.ntohs
|
2012-05-16 17:07:42 +00:00 |
|
|
iMHLv2
|
63ebf7f19c
|
netscan variable name change: s/vspace/kernel_space/ and s/pspace/flat_space/
|
2012-05-16 16:57:48 +00:00 |
|
|
iMHLv2
|
9d8837108a
|
make sure to dereference sock.Next and conn.Next, otherwise it will appear as if multiple socket and connection objects have different members but the same offset since sock.obj_offset == sock.Next.obj_offset. Fixes Issue #244. Fixes Issue #258.
|
2012-05-16 16:37:50 +00:00 |
|
|
iMHLv2
|
3a12f04c68
|
netscan vtypes should use unsigned be short for ports instead of unsigned short wrapped with socket.ntohs
|
2012-05-16 16:30:49 +00:00 |
|
|
iMHLv2
|
f547d24dd5
|
XP x86 sockets/sockscan port endianness is backwards
|
2012-05-16 14:33:33 +00:00 |
|
|
mike.auty@gmail.com
|
a51f61a44f
|
Fix a typo/bug in the recent malware threads plugin.
|
2012-05-14 23:07:20 +00:00 |
|
|
mike.auty@gmail.com
|
5cb4ab5dda
|
Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.
|
2012-05-14 23:06:56 +00:00 |
|
|
mike.auty@gmail.com
|
d04c721dd1
|
Remove width parameter from db in volshell because it's completely unused.
|
2012-05-14 23:06:47 +00:00 |
|
|
mike.auty@gmail.com
|
b904171df7
|
Move the plugin constraints to an is_valid_profile function, in preparation for the linux-trunk merge.
|
2012-05-14 23:06:39 +00:00 |
|
|
mike.auty@gmail.com
|
92ca6454f7
|
Set a sensible default for the new attribute to is_valid (since the overridden method doesn't expect that value).
|
2012-05-14 23:06:23 +00:00 |
|
|
mike.auty@gmail.com
|
7366f215ce
|
Change the moddump offset flag to a base flag to better fit the values. Fixes issue 254.
|
2012-05-14 20:43:09 +00:00 |
|
|
mike.auty@gmail.com
|
6520b19117
|
Fix up error reporting and file flushing in imagecopy.
|
2012-05-14 19:27:55 +00:00 |
|
|
iMHLv2
|
91685d3cf6
|
fix a rare though very major bug which treats x64 DTB as unsigned long instead of unsigned long long
|
2012-05-14 19:15:29 +00:00 |
|
|
iMHLv2
|
1b6f331bc9
|
integrate the generic IpAddress and Ipv6Address into netscan's vtypes
|
2012-05-09 23:39:26 +00:00 |
|
|
iMHLv2
|
a3fd95c210
|
delete netscan.tcp_states (should have happened in r1686)
|
2012-05-09 23:35:49 +00:00 |
|
|
iMHLv2
|
1c05b46602
|
move netscan.tcp_states to an enumeration inside the vtypes. note the values for the enum are different than what linux uses so we can't share them
|
2012-05-09 23:34:36 +00:00 |
|
|
iMHLv2
|
a08ae45ecc
|
remove unused PoolScanRawEndpoint from netscan.py. condense the pool scanners using inheritance
|
2012-05-09 23:30:47 +00:00 |
|
|
iMHLv2
|
fd0a33a085
|
add Ipv6Address to WindowsObjectClasses so its accessible from windows profiles just like IpAddress
|
2012-05-09 23:27:49 +00:00 |
|
|
iMHLv2
|
613778538b
|
move netscan.inet_ntop to utils.inet_ntop so its accessible from basic.IpAddress and plugins from other profiles like linux etc
|
2012-05-09 23:24:23 +00:00 |
|
|
iMHLv2
|
66d25549d7
|
add support for connections, connscan, sockets, and sockscan on xpsp1x64, xpsp2x64, win2003sp1x64, and win2003sp2x64. see Issue #194.
|
2012-05-09 18:07:48 +00:00 |
|
|
iMHLv2
|
ce2aab1f2d
|
mask upper 16 bits in Pointer.__eq__. patch kpcrscan for x64 profiles. fixes issue #184.
|
2012-05-08 23:13:38 +00:00 |
|
|
iMHLv2
|
eed7207f5a
|
clear the Balanced bits from the _MMADDRESS_NODE.u1 union (shared with Parent) so that vadtree and vadwalk use the right address for vad parent nodes. fixes issue #246
|
2012-05-08 22:09:34 +00:00 |
|
|
iMHLv2
|
fdb358b9d5
|
reduce the size of vtypes in svcscan.py by using base vtypes and overlays
|
2012-05-08 16:27:38 +00:00 |
|
|
iMHLv2
|
fc33d7dcce
|
add threads plugin. fixes issue #249
|
2012-05-08 15:53:02 +00:00 |
|
|
mike.auty@gmail.com
|
82ca06731a
|
Add in Gleeda's registryapi module and shimcache plugin.
|
2012-05-06 23:16:26 +00:00 |
|
|
mike.auty@gmail.com
|
8afb0e8ae8
|
Add in generic IPv6 Address.
|
2012-05-03 19:19:29 +00:00 |
|
|
mike.auty@gmail.com
|
b6028b4f43
|
Move IpAddress to basic since it's platform agnostic.
|
2012-05-03 18:14:56 +00:00 |
|
|
mike.auty@gmail.com
|
47f7c4302c
|
Rework LIST_ITEM iterator to avoid 'while 1' and make use of a header sentinel explicit.
|
2012-05-03 13:33:41 +00:00 |
|
|
mike.auty@gmail.com
|
6450d8f852
|
Fix up a typo in WindowsObjectClasses conditions.
|
2012-05-03 01:48:50 +00:00 |
|
|
mike.auty@gmail.com
|
f3c28c098a
|
Pylint some files.
|
2012-04-30 11:56:50 +00:00 |
|
|
iMHLv2
|
1dcad3d557
|
bring back the --dump-dir option to malfind
|
2012-04-23 02:45:51 +00:00 |
|
|
iMHLv2
|
00dd38e075
|
bug in svcscan (valid -> is_valid)
|
2012-04-19 15:15:03 +00:00 |
|
|
mike.auty@gmail.com
|
3ec9fbc7f7
|
Improve KDBG performance.
|
2012-04-14 13:47:11 +00:00 |
|
|
iMHLv2
|
8eea2347b6
|
ikelos's patch for adding a len() to unicode strings so mutantscan's silent option doesn't crash. fixes Issue #242
|
2012-04-11 23:44:29 +00:00 |
|
|
mike.auty@gmail.com
|
14d9953a42
|
Fix up header in the exceptions file.
|
2012-04-11 20:33:01 +00:00 |
|
|
mike.auty@gmail.com
|
864faf2de2
|
Take 2 at fixing issue 244.
|
2012-04-11 20:06:25 +00:00 |
|
|
mike.auty@gmail.com
|
53b6ea1ff4
|
Keep a list of seen sockets. Fixes issue 244.
|
2012-04-11 16:06:12 +00:00 |
|
|
iMHLv2
|
60404a00a2
|
some object classes in svcscan.py have both a valid() and is_valid() check (the second is inherited from obj.Object). this is unnecessary as the code currently in valid() can be moved to is_valid() and we don't have to define an extra method.
|
2012-04-11 13:49:36 +00:00 |
|
|
iMHLv2
|
a25aa7be57
|
change a few get_xxx() in svcscan to @property
|
2012-04-11 13:40:45 +00:00 |
|
|
iMHLv2
|
af5130e419
|
move svcscan's service record tag into a VolatilityMagic so its always available in the profile
|
2012-04-11 01:37:18 +00:00 |
|
|
iMHLv2
|
e5e8c4b899
|
fudge the build number for win2003sp2 to be 5.2.3791. currently it conflicts with win2003sp1 using 5.2.3790 and there's no way to differentiate other than using __class__.__name__ which we're trying to avoid. also fixup the hibernate profile mod so it still applies to all win2003.
|
2012-04-10 19:58:01 +00:00 |
|