def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="vmlinux", description="Linux kernel symbols"), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(1, 0, 0)), requirements.ListRequirement( name='pid', element_type=int, description= "Process IDs to include (all other processes are excluded)", optional=True), requirements.ListRequirement( name='name', element_type=str, description= "Process name to include (all other processes are excluded)", optional=True), requirements.StringRequirement(name='out', description="JSON output file", optional=True) ]
def get_requirements(cls): return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), requirements.BooleanRequirement( name='physical', description='Display physical offsets instead of virtual', default=cls.PHYSICAL_DEFAULT, optional=True), requirements.ListRequirement( name='pid', element_type=int, description= "Process ID to include (all other processes are excluded)", optional=True), requirements.BooleanRequirement( name='dump', description="Extract listed processes", default=False, optional=True) ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.BooleanRequirement(name = 'dump', description = "Extract listed memory ranges", default = False, optional = True), requirements.IntRequirement(name = 'maxsize', description = "Maximum size for dumped VAD sections " \ "(all the bigger sections will be ignored)", default = cls.MAXSIZE_DEFAULT, optional = True), ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.StringRequirement( name='plugins', description="Comma separated list of plugins to run", optional=True, default=None), requirements.BooleanRequirement( name='record-config', description= "Whether to record the state of all the plugins once complete", optional=True, default=False), requirements.ListRequirement( name='plugin-filter', description="Only run plugins featuring this substring", element_type=str, optional=True, default=[]), requirements.BooleanRequirement( name='create-bodyfile', description= "Whether to create a body file whilst producing results", optional=True, default=False) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), requirements.ListRequirement( name='pid', description='Filter on specific process IDs', element_type=int, optional=True), requirements.BooleanRequirement( name='silent', description='Suppress common and non-persistent variables', optional=True), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(2, 0, 0)), requirements.PluginRequirement(name='hivelist', plugin=hivelist.HiveList, version=(1, 0, 0)) ]
def get_requirements(cls): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), requirements.ListRequirement( name='pid', element_type=int, description= "Process IDs to include (all other processes are excluded)", optional=True), requirements.BooleanRequirement( name='dump', description="Extract injected VADs", default=False, optional=True), requirements.VersionRequirement(name='pslist', component=pslist.PsList, version=(1, 1, 0)), requirements.VersionRequirement(name='vadinfo', component=vadinfo.VadInfo, version=(1, 1, 0)) ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name='primary', description="Memory layer for the kernel", architectures=['Intel32', 'Intel64']), requirements.SymbolTableRequirement(name='vmlinux', description="Linux kernel symbols"), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(1, 0, 0)), requirements.ListRequirement(name='pids', description="Filter on specific process IDs. Default is pid 1", element_type=int, default=DEFAULT_PIDS_VALUE, optional=True), requirements.BooleanRequirement(name='all', description="Shows information about mount points for each process mount " "namespace. It could take a while depending on the number of processes " "running. Note that if this argument is not specified it uses the root " "mount namespace based on pid 1.", optional=True, default=False), requirements.BooleanRequirement(name='mount-format', description="Shows a brief summary of a process mount points information " "with similar output format to the older /proc/[pid]/mounts or the " "user-land command 'mount -l'.", optional=True, default=False), ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = "Memory layer for the kernel", architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.BooleanRequirement(name = "wide", description = "Match wide (unicode) strings", default = False, optional = True), requirements.StringRequirement(name = "yara_rules", description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000, description = "Set the maximum size (default is 1GB)", optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.VersionRequirement(name = 'yarascanner', component = yarascan.YaraScanner, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True) ]
def get_requirements(cls): return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(2, 0, 0)), requirements.VersionRequirement(name='info', component=info.Info, version=(1, 0, 0)), requirements.ListRequirement( name='pid', element_type=int, description= "Process ID to include (all other processes are excluded)", optional=True), requirements.BooleanRequirement( name='dump', description="Extract listed processes", default=False, optional=True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ListRequirement(name='pages', element_type=int, min_elements=1), requirements.TranslationLayerRequirement(name='base_layer'), requirements.IntRequirement(name='maximum_size') ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "vmlinux", description = "Linux kernel symbols"), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ]
def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Linux kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: # This is not optional for the stacker to run, so optional must be marked as False return [ requirements.URIRequirement( name="single_location", description="Specifies a base location on which to stack", optional=True), requirements.ListRequirement(name="stackers", description="List of stackers", optional=True) ]
def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"), requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 0, 0)), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), requirements.ListRequirement(name = 'pid', element_type = int, description = "Process IDs to include (all other processes are excluded)", optional = True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: """Returns the requirements of this plugin.""" return [ requirements.ListRequirement( name="single_swap_locations", element_type=str, min_elements=0, max_elements=16, description= "Specifies a list of swap layer URIs for use with single-location", optional=True) ]
def get_requirements(cls): return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"), requirements.ChoiceRequirement(name = 'pslist_method', description = 'Method to determine for processes', choices = cls.pslist_methods, default = cls.pslist_methods[0], optional = True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"), # TODO: Convert this to a ListRequirement so that people can filter on sets of ranges requirements.IntRequirement(name = 'address', description = "Process virtual memory address to include " \ "(all other address ranges are excluded). This must be " \ "a base address, not an address within the desired range.", optional = True), requirements.ListRequirement(name = 'pid', description = 'Filter on specific process IDs', element_type = int, optional = True), requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)), ]
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement(name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]), requirements.IntRequirement(name = 'block_size', description = "Size of blocks to copy over", default = cls.default_block_size, optional = True), requirements.BooleanRequirement(name = 'list', description = 'List available layers', default = False, optional = True), requirements.ListRequirement(name = 'layers', element_type = str, description = 'Names of layer to write', default = None, optional = True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ListRequirement( name='filter', description= 'String that must be present in the file URI to display the ISF', optional=True, default=[]), requirements.URIRequirement( name='isf', description="Specific ISF file to process", default=None, optional=True), requirements.BooleanRequirement( name='validate', description='Validate against schema if possible', default=False, optional=True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), requirements.ListRequirement( name='pid', description='Filter on specific process IDs', element_type=int, optional=True), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(1, 0, 0)), requirements.PluginRequirement(name='hivelist', plugin=hivelist.HiveList, version=(1, 0, 0)) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="vmlinux", description="Linux kernel symbols"), requirements.PluginRequirement(name='pslist', plugin=pslist.PsList, version=(1, 0, 0)), requirements.VersionRequirement(name='linuxutils', component=linux.LinuxUtilities, version=(1, 0, 0)), requirements.ListRequirement( name='pid', description='Filter on specific process IDs', element_type=int, optional=True) ]
def get_requirements( cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.TranslationLayerRequirement( name='primary', description='Memory layer for the kernel', architectures=["Intel32", "Intel64"]), requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols"), #requirements.VersionRequirement(name = 'info', component = info.Info, version = (1, 0, 0)), requirements.ListRequirement( name='pid', element_type=str, description= "Process IDs to include (all other processes are excluded)", optional=True), requirements.BooleanRequirement( name='include-corrupt', description="Include non-valid records (substitutions)", default=False, optional=True), ]