 gleeda
|
9221956b2d
|
Changed input to search_process_memory to list format as required. fixes issue 371
|
2013-01-09 16:25:01 +00:00 |
|
|
iMHLv2
|
a66c3a6c14
|
apihooks should handle systems using kiintsystemcall in addition to kifastsystemcall. spotted by mathieu.geli. fixes issue #370
|
2013-01-03 23:01:12 +00:00 |
|
|
iMHLv2
|
c238f9272d
|
add the same check to _EPROCESS.search_process_memory() as VADDump uses for avoiding MM_MAX_COMMIT ranges on wow64 processes. spotted by Wyatt
|
2012-12-10 21:10:44 +00:00 |
|
|
iMHLv2
|
e4b8caf53e
|
the --pid parameter to impscan should be an integer (comma separated strings are not accepted)
|
2012-11-23 16:32:11 +00:00 |
|
|
iMHLv2
|
b23d6cf75a
|
bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images
|
2012-11-22 18:04:20 +00:00 |
|
|
iMHLv2
|
9d881ed2b0
|
a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set
|
2012-11-22 02:55:52 +00:00 |
|
|
iMHLv2
|
a9a6ff54a1
|
in --verbose mode, the svcscan plugin queries the registry for a service's ServiceDll path
|
2012-11-21 16:31:34 +00:00 |
|
|
iMHLv2
|
022972a33c
|
patch from gleeda to conform the search_process_memory API call in svcscan to the new format (which accepts a list of strings instead of a single string)
|
2012-11-01 23:06:13 +00:00 |
|
|
iMHLv2
|
33fccde81f
|
fix an issue in devicetree regarding display of attached device names
|
2012-10-30 20:28:25 +00:00 |
|
|
iMHLv2
|
48669536bf
|
fix a typo in psxview column headers s/pspcdid/pspcid/
|
2012-10-30 20:22:22 +00:00 |
|
|
mike.auty@gmail.com
|
518294754d
|
Merge 2.3-devel into trunk.
|
2012-10-13 21:31:29 +00:00 |
|
|
iMHLv2
|
15b089752c
|
fix a unicode decode error in ldrmodules reported by David Kovar
|
2012-10-04 22:09:53 +00:00 |
|
|
iMHLv2
|
f37e895f7c
|
make ImpScan.enum_apis() a @staticmethod so it can be called from volshell scripts etc without having to subclass ImpScan's plugin
|
2012-09-29 23:32:18 +00:00 |
|
|
iMHLv2
|
4b0de7aa9a
|
add proper spacing to registers in threads output. fixes issue #348
|
2012-09-17 16:51:25 +00:00 |
|
|
mike.auty@gmail.com
|
25f7095377
|
Ensure all classes are new style classes.
|
2012-09-02 19:29:09 +00:00 |
|
|
iMHLv2
|
a4be56b1c7
|
all windows-only plugins should inherit from common.AbstractWindowsCommand instead of commands.Command - so they don't show up in --help output for Linux profiles
|
2012-08-26 17:14:46 +00:00 |
|
|
iMHLv2
|
acc71d4a90
|
remove the temporary fix we put in place to allow yarascan's kernel module lookups to work in 2.1. now that we properly truncate 64-bit pointers, the temp fix is no longer needed
|
2012-08-10 16:40:21 +00:00 |
|
|
iMHLv2
|
ba42522f13
|
cmdscan and consoles plugins now work on win7 x64
|
2012-08-04 17:05:42 +00:00 |
|
|
iMHLv2
|
4dbb7bade5
|
dereference the _SCREEN_INFORMATION in cmdhistory.py before reporting its offset (because its a pointer). spotted by scudette
|
2012-07-28 15:41:31 +00:00 |
|
|
iMHLv2
|
2f7e6ed60d
|
malfind and yarascan should not bt if the specified output directory doesn't exist or if its a file - spotted by attrc
|
2012-07-28 15:35:18 +00:00 |
|
|
iMHLv2
|
f16400dd78
|
until we can fix the Pointer.v() 48-bit truncation globally, fix the yarascan module resolution on x64 by supplying it with a private version of find_module that does the truncation
|
2012-07-25 18:09:16 +00:00 |
|
|
iMHLv2
|
87dc0d7e06
|
add a comment to yarascan which explains why module lookups will fail when operating in kernelmode on x64. it'll be a known issue of the plugin for 2.1, after which time we'll update trunk's Pointer.v() and be able to test more thoroughly before a release
|
2012-07-24 19:47:05 +00:00 |
|
|
iMHLv2
|
9db11a27e5
|
fix an off-by-one error in the impscan plugin. use the new vad.Length property added in r2076
|
2012-07-24 19:39:48 +00:00 |
|
|
iMHLv2
|
dec52f7a43
|
bring back the ability for malfind to ignore VADs whose entire region is either unavailable due to paging or all 0's...this was lost in r2077 because we avoided reading the entire range into memory at once.
|
2012-07-24 19:37:11 +00:00 |
|
|
mike.auty@gmail.com
|
9f79c3aca2
|
Make sure we don't use the same variable for different things in malfind BaseScanner.
|
2012-07-24 07:30:59 +00:00 |
|
|
iMHLv2
|
5f7e3c1837
|
add scudette's BaseYaraScanner, VadYaraScanner, and DiscontigYaraScanner to malfind.py. this fixes yarascan on x64 kernelmode. the EPROCESS.get_vads() API changes a bit. it results in greater speed when using ldrmodules because only the first 2 bytes are needed instead of the whole vad region. also a new method VADDump.dump_vad is added which aims to write vads to a file in small chunks rather than building a large buffer in memory, which can exhaust/consume the analysis system's RAM.
|
2012-07-24 03:07:10 +00:00 |
|
|
mike.auty@gmail.com
|
43ff231ada
|
Fix minor typo in impscan.
|
2012-07-17 16:09:48 +00:00 |
|
|
mike.auty@gmail.com
|
f7b46ccef5
|
Fix a minor error in netscan, and pylint the rest of the recently changed code.
|
2012-07-12 20:00:04 +00:00 |
|
|
iMHLv2
|
65507320be
|
prevent impscan from raising an IndexError when no imports are found. Fixes issue #300
|
2012-07-12 16:28:21 +00:00 |
|
|
iMHLv2
|
a2d21d59ef
|
make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.
|
2012-07-10 14:11:47 +00:00 |
|
|
mike.auty@gmail.com
|
33cbf31032
|
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
|
2012-07-07 19:19:58 +00:00 |
|
|
iMHLv2
|
f2b24da4d9
|
tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278
|
2012-06-28 19:09:18 +00:00 |
|
|
iMHLv2
|
d6e2136a61
|
small tweak to what ldrmodules considers a mapped file, for better detection of stuxnet and other malware that could possibly overwrite the vad's FileName after loading
|
2012-06-28 15:25:45 +00:00 |
|
|
iMHLv2
|
0c70e45b66
|
use the MaxAddress volatility magic in yarascan
|
2012-06-28 13:52:54 +00:00 |
|
|
iMHLv2
|
a989a170ef
|
fix a bug in vaddump and introduce a VolMagic for getting the maximum address in an AS based on the size of a native addr
|
2012-06-28 13:36:48 +00:00 |
|
|
iMHLv2
|
74c678989a
|
the Limit column of GDT plugin should be addrpad
|
2012-06-25 20:39:38 +00:00 |
|
|
iMHLv2
|
b0fc9fab2e
|
fix a bitmasking issue with GDT 32-bit callgate address calculation. also make the Limit field for callgates 0 instead of a dash or it'll encounter a formatting bug when trying to print as hex
|
2012-06-25 19:18:14 +00:00 |
|
|
iMHLv2
|
143e73a47d
|
the gdt selector column should be displayed as hex
|
2012-06-25 18:57:13 +00:00 |
|
|
iMHLv2
|
5a719d134d
|
bring back two components of the idt plugin output which was present in 2.0: print the PE section name of the IDT function and allow disasm of code when --verbose is enabled
|
2012-06-25 18:43:02 +00:00 |
|
|
iMHLv2
|
2c52ee66f6
|
bring back the -v option to driverirp that prints a disasm of each function (was in 2.0 version of the plugin from malware.py)
|
2012-06-23 22:59:11 +00:00 |
|
|
iMHLv2
|
9e0525da35
|
add a description to apihooks plugin
|
2012-06-23 05:44:45 +00:00 |
|
|
iMHLv2
|
ddf9de9edc
|
add apihooks plugin (x86) for IAT, EAT, Inline hooks in user and kernel mode, plus winsock proc table hooks (new), calls to unknown code pages (kernel), and ntdll syscall hooks
|
2012-06-21 14:26:48 +00:00 |
|
|
iMHLv2
|
3292d8e67b
|
add impscan plugin for x86 and x64
|
2012-06-18 16:06:11 +00:00 |
|
|
iMHLv2
|
ed22db8c61
|
per request, avoid changing the number of variables yielded by IDT.calculate() and GDT.calculate() just to access the associated KPCRs. instead access the KPCR using the IDT or GDT entry's obj_parent
|
2012-06-12 14:07:40 +00:00 |
|
|
iMHLv2
|
f23dfc8f5b
|
when calculating the IDT for each CPU, make sure we use the GDT entries from the same CPU
|
2012-06-12 13:52:18 +00:00 |
|
|
iMHLv2
|
abf1668d84
|
per request, move the KPCR object classes from malware/idt.py to windows/overlays/kpcr_vtypes.py (since they aren't malware specific)
|
2012-06-12 13:45:01 +00:00 |
|
|
iMHLv2
|
e3b10c112c
|
per request, move envars plugin to a separate file in core
|
2012-06-12 13:26:55 +00:00 |
|
|
iMHLv2
|
05c3c015bb
|
leverage the new KDBG.kpcrs() to iterate quickly through all KPCRs in a memory dump. this allows us to display IDT, GDT, and Timers per-processor without relying on kpcrscan which is way too slow to actually be useful
|
2012-06-05 21:58:24 +00:00 |
|
|
iMHLv2
|
b754e88e4a
|
document our backup method of finding KDBG via KPCR. use object classes w/ inheritance to clearly indicate that finding KDBG via KPCR will not work on x64.
|
2012-06-05 21:21:51 +00:00 |
|
|
iMHLv2
|
081806196c
|
add a plugin to print environment variables for x86 and x64 windows processes
|
2012-06-05 19:34:47 +00:00 |
|