2f7e6ed60d
malfind and yarascan should not bt if the specified output directory doesn't exist or if its a file - spotted by attrc
2012-07-28 15:35:18 +00:00
f16400dd78
until we can fix the Pointer.v() 48-bit truncation globally, fix the yarascan module resolution on x64 by supplying it with a private version of find_module that does the truncation
2012-07-25 18:09:16 +00:00
87dc0d7e06
add a comment to yarascan which explains why module lookups will fail when operating in kernelmode on x64. it'll be a known issue of the plugin for 2.1, after which time we'll update trunk's Pointer.v() and be able to test more thoroughly before a release
2012-07-24 19:47:05 +00:00
9db11a27e5
fix an off-by-one error in the impscan plugin. use the new vad.Length property added in r2076
2012-07-24 19:39:48 +00:00
dec52f7a43
bring back the ability for malfind to ignore VADs whose entire region is either unavailable due to paging or all 0's...this was lost in r2077 because we avoided reading the entire range into memory at once.
2012-07-24 19:37:11 +00:00
d5678fd981
apply a remedy for issue 306 - vaddump on wow64 processes with MM_MAX_COMMIT. we don't want to dump these multi terabyte ranges with no valid pages. see issue 306 for details and analysis...the issue will remain open while we consider other ways to address the problem, however this patch should resolve it well enough for the stability of the 2.1 release
2012-07-24 14:47:37 +00:00
9f79c3aca2
Make sure we don't use the same variable for different things in malfind BaseScanner.
2012-07-24 07:30:59 +00:00
5f7e3c1837
add scudette's BaseYaraScanner, VadYaraScanner, and DiscontigYaraScanner to malfind.py. this fixes yarascan on x64 kernelmode. the EPROCESS.get_vads() API changes a bit. it results in greater speed when using ldrmodules because only the first 2 bytes are needed instead of the whole vad region. also a new method VADDump.dump_vad is added which aims to write vads to a file in small chunks rather than building a large buffer in memory, which can exhaust/consume the analysis system's RAM.
2012-07-24 03:07:10 +00:00
84bc637f2f
add a Length property to MMVAD to reduce confusion over the purpose of vad.End and minimize the chance of off-by-one errors when calculating vad lengths. fixes Issue 308
2012-07-24 01:45:52 +00:00
712ac11fdf
prevent the 'NoneObject as string' warning when using regex with dlldump and moddump. we do plan on finding some other solution for all this after 2.1
2012-07-18 15:02:33 +00:00
7a27e3504b
Potential fix for issue 301, and minor pylint on volshell.
2012-07-17 16:09:55 +00:00
43ff231ada
Fix minor typo in impscan.
2012-07-17 16:09:48 +00:00
f7b46ccef5
Fix a minor error in netscan, and pylint the rest of the recently changed code.
2012-07-12 20:00:04 +00:00
65507320be
prevent impscan from raising an IndexError when no imports are found. Fixes issue #300
2012-07-12 16:28:21 +00:00
7a4021fea1
convert dlldump, procexedump, and moddump to table_header/row output. increases code sharing between the plugins. adds more descriptive error messages when pe files cannot be dumped. accomplishes goals 1, 2, and 3 from issue #291 . all parties agree commit is OK wrt 2.1 RC1
2012-07-10 18:27:08 +00:00
00d59759ad
convert connscan output to table_header/table_row. this should be done prior to 2.1 since table renders are a major new feature in 2.1
2012-07-10 14:20:40 +00:00
5479c2be1d
fix some typos in the connections.Connections class pydoc
2012-07-10 14:13:53 +00:00
a2d21d59ef
make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.
2012-07-10 14:11:47 +00:00
d6050871e9
apply (maybe temporary) fixes to two UnicodeEncodeError exceptions in vadinfo and hivelist. fixes issue #295 .
2012-07-10 03:20:43 +00:00
a019abed5d
Fix pyinstaller plugins support.
...
Includes plugins in both the internal pyz, and the unpacked data
directory, in order to have dynamic loading work properly.
Also ensure that existing __path__ directories don't throw the plugin
loader off by trying to import the same plugin twice under different
namespaces.
2012-07-08 21:19:08 +00:00
8bd862b2aa
fix a UnicodeEncodeError when dlldump prints module names
2012-07-07 23:24:27 +00:00
33cbf31032
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
2012-07-07 19:19:58 +00:00
f2b24da4d9
tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278
2012-06-28 19:09:18 +00:00
d6e2136a61
small tweak to what ldrmodules considers a mapped file, for better detection of stuxnet and other malware that could possibly overwrite the vad's FileName after loading
2012-06-28 15:25:45 +00:00
0c70e45b66
use the MaxAddress volatility magic in yarascan
2012-06-28 13:52:54 +00:00
a989a170ef
fix a bug in vaddump and introduce a VolMagic for getting the maximum address in an AS based on the size of a native addr
2012-06-28 13:36:48 +00:00
74c678989a
the Limit column of GDT plugin should be addrpad
2012-06-25 20:39:38 +00:00
6c91c521d1
apply Ikelos' patch for adding a format_value method to commands. use it in vaddump to properly format file names for x86 and x64 addresses
2012-06-25 19:54:44 +00:00
b0fc9fab2e
fix a bitmasking issue with GDT 32-bit callgate address calculation. also make the Limit field for callgates 0 instead of a dash or it'll encounter a formatting bug when trying to print as hex
2012-06-25 19:18:14 +00:00
d2b99f97a0
Move hivedump to the printkey module, since it prints registry data, rather than having anything to do with crypto. Fixes issue 276.
2012-06-25 18:59:25 +00:00
143e73a47d
the gdt selector column should be displayed as hex
2012-06-25 18:57:13 +00:00
5a719d134d
bring back two components of the idt plugin output which was present in 2.0: print the PE section name of the IDT function and allow disasm of code when --verbose is enabled
2012-06-25 18:43:02 +00:00
7572475254
add a column to memmap's output to help locate the pages in memdump's dump file. fixes Issue #271
2012-06-24 19:34:44 +00:00
2c52ee66f6
bring back the -v option to driverirp that prints a disasm of each function (was in 2.0 version of the plugin from malware.py)
2012-06-23 22:59:11 +00:00
9e0525da35
add a description to apihooks plugin
2012-06-23 05:44:45 +00:00
ddf9de9edc
add apihooks plugin (x86) for IAT, EAT, Inline hooks in user and kernel mode, plus winsock proc table hooks (new), calls to unknown code pages (kernel), and ntdll syscall hooks
2012-06-21 14:26:48 +00:00
3292d8e67b
add impscan plugin for x86 and x64
2012-06-18 16:06:11 +00:00
f46a772538
the task_info dictionary in pstree is unnecessary
2012-06-18 15:07:54 +00:00
cc2037ffe9
kpcrscan is more verbose now
2012-06-18 14:34:14 +00:00
9687a7484e
Fixes issue 273.
2012-06-15 22:36:07 +00:00
b092cee309
convert pstree to ikelos' new table format
2012-06-13 16:17:08 +00:00
696f9e1c59
fix the circular references bug in pstree. fixes Issue #239
2012-06-13 15:52:02 +00:00
37c0703cbe
use a ProfileModification to apply the _SE_AUDIT_PROCESS_CREATION_INFO and _OBJECT_NAME_INFORMATION vtypes in pstree, to avoid the Deprecation warning from using profile.add_types
2012-06-13 15:33:30 +00:00
801a51c745
fix the verbose > 1 check in pstree per issue #239
2012-06-13 15:22:10 +00:00
fd035d1677
fix a bug from r1866 when kdbgscan is used with no profile
2012-06-13 15:00:37 +00:00
b0bd25c6c2
kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268
2012-06-12 22:49:32 +00:00
65f15dd893
fix a mis-understanding of the cases in which kpcrscan can serve as a backup for finding KDBG. in short, we iterate through the volmagic suggestions instead of accepting the first/best suggestion. for more details, please see issue #269 . Fixes Issue #269 .
2012-06-12 15:47:15 +00:00
ed22db8c61
per request, avoid changing the number of variables yielded by IDT.calculate() and GDT.calculate() just to access the associated KPCRs. instead access the KPCR using the IDT or GDT entry's obj_parent
2012-06-12 14:07:40 +00:00
f23dfc8f5b
when calculating the IDT for each CPU, make sure we use the GDT entries from the same CPU
2012-06-12 13:52:18 +00:00
abf1668d84
per request, move the KPCR object classes from malware/idt.py to windows/overlays/kpcr_vtypes.py (since they aren't malware specific)
2012-06-12 13:45:01 +00:00
iMHLv2