mirror of
https://github.com/Velocidex/velociraptor.git
synced 2026-10-12 02:09:59 +00:00
Added an ARM64 Windows target (#5017)
This PR changes the build toolchains to use the hermetic mingw clang toolchains so we do not depend on the OS installed ones. The build will now automatically download and unpack the toolchain inside the build directory and use it for reproducible builds. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
Mike Cohen
co-authored by
dependabot[bot]
dependabot[bot]
parent
4022b686b6
commit
08acb33ade
@@ -12,9 +12,7 @@ jobs:
|
||||
build:
|
||||
if: github.event.pull_request.merged || github.event_name == 'workflow_dispatch'
|
||||
name: Build
|
||||
# We used to build on ubuntu-18.04 but that is now deprecated by
|
||||
# GitHub. Earlier distributions will have to use the musl build.
|
||||
runs-on: ubuntu-22.04
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
- name: Check out code into the Go module directory
|
||||
@@ -31,13 +29,6 @@ jobs:
|
||||
|
||||
- run: go version
|
||||
|
||||
- name: Get dependencies
|
||||
run: |
|
||||
go get -v -t -d ./...
|
||||
sudo apt-get update
|
||||
sudo apt-get upgrade
|
||||
sudo apt-get install mingw-w64-x86-64-dev gcc-mingw-w64-x86-64 gcc-mingw-w64
|
||||
|
||||
- name: Use Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
|
||||
|
||||
@@ -58,7 +49,7 @@ jobs:
|
||||
go run make.go -v DarwinBase
|
||||
go run make.go -v Windows
|
||||
go run make.go -v WindowsSumo
|
||||
go run make.go -v Windowsx86
|
||||
go run make.go -v WindowsArm
|
||||
|
||||
- name: StoreBinaries
|
||||
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
|
||||
|
||||
@@ -54,8 +54,6 @@ jobs:
|
||||
|
||||
- name: Build
|
||||
if: success()
|
||||
env:
|
||||
CC: x86_64-w64-mingw32-gcc
|
||||
shell: bash
|
||||
run: |
|
||||
go run make.go -v BasicAssets
|
||||
|
||||
@@ -29,3 +29,4 @@ __debug*
|
||||
debug.test*
|
||||
artifacts/testdata/server/hunts/H.*
|
||||
artifacts/testdata/server/users/
|
||||
build/packages/
|
||||
@@ -45,6 +45,10 @@ linux_sumo:
|
||||
windows_sumo:
|
||||
go run make.go -v WindowsSumo
|
||||
|
||||
# A build with the race detector enabled.
|
||||
windows_test:
|
||||
go run make.go -v WindowsTest
|
||||
|
||||
linux_arm64:
|
||||
go run make.go -v LinuxArm64
|
||||
|
||||
@@ -85,6 +89,9 @@ windowsarm:
|
||||
clean:
|
||||
go run make.go -v clean
|
||||
|
||||
clean_toolchain:
|
||||
go run make.go -v cleantoolchains
|
||||
|
||||
generate:
|
||||
go generate ./vql/windows/
|
||||
go generate ./api/mock/
|
||||
@@ -122,7 +129,7 @@ translations:
|
||||
python3 ./scripts/find_i8n_translations.py ./gui/velociraptor/src/components/i8n/
|
||||
|
||||
config_check:
|
||||
go run ./docs/references/sample_config/main.go ./docs/references/server.config.yaml
|
||||
go run -tags config_check ./docs/references/sample_config/main.go ./docs/references/server.config.yaml
|
||||
|
||||
deadcode:
|
||||
go run make.go -v deadcode
|
||||
|
||||
@@ -1,14 +1,13 @@
|
||||
package utils
|
||||
package assets
|
||||
|
||||
import (
|
||||
"github.com/Velocidex/yaml/v2"
|
||||
api_proto "www.velocidex.com/golang/velociraptor/api/proto"
|
||||
"www.velocidex.com/golang/velociraptor/artifacts/assets"
|
||||
)
|
||||
|
||||
// Loads the api description from the embedded asset
|
||||
func LoadApiDescription() ([]*api_proto.Completion, error) {
|
||||
data, err := assets.ReadFile("/docs/references/vql.yaml")
|
||||
data, err := ReadFile("/docs/references/vql.yaml")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -4,7 +4,7 @@ author: Matt Green - @mgreen27
|
||||
description: |
|
||||
Detects Kerberoasting attempts by extracting Kerberos TGS requests
|
||||
(EID 4769) with RC4 encryption from the Security log.
|
||||
|
||||
|
||||
This Artifact will return all successful Kerberos TGS Ticket events
|
||||
for Service Accounts (SPN attribute) implemented with weak
|
||||
encryption. These tickets are vulnerable to brute force attack and
|
||||
@@ -17,7 +17,7 @@ description: |
|
||||
often have elevated privileges. Kerberoasting can be used for
|
||||
privilege escalation or persistence by adding a SPN attribute to an
|
||||
unexpected account.
|
||||
|
||||
|
||||
Log Source: Windows Security Event Log (Domain Controllers).
|
||||
Event ID: 4769
|
||||
Status: 0x0 (Audit Success)
|
||||
@@ -67,10 +67,10 @@ sources:
|
||||
EventData.ServiceName as ServiceName,
|
||||
EventData.ServiceSid as ServiceSid,
|
||||
EventData.TargetUserName as TargetUserName,
|
||||
format(format="0x%x", args=EventData.Status) as Status,
|
||||
EventData.Status as Status,
|
||||
EventData.TargetDomainName as TargetDomainName,
|
||||
format(format="0x%x", args=EventData.TicketEncryptionType) as TicketEncryptionType,
|
||||
format(format="0x%x", args=EventData.TicketOptions) as TicketOptions,
|
||||
EventData.TicketEncryptionType as TicketEncryptionType,
|
||||
EventData.TicketOptions as TicketOptions,
|
||||
EventData.TransmittedServices as TransmittedServices,
|
||||
EventData.IpAddress as IpAddress,
|
||||
EventData.IpPort as IpPort,
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Windows.Events.Kerberoasting
|
||||
description: |
|
||||
Monitors Kerberos TGS ticket requests (EventID 4769) with RC4 (weak)
|
||||
encryption as indicators of Kerberoasting attacks.
|
||||
|
||||
|
||||
These tickets are vulnerable to brute force attack and this event is
|
||||
an indicator of a Kerberoasting attack.
|
||||
|
||||
@@ -48,10 +48,10 @@ sources:
|
||||
EventData.ServiceName as ServiceName,
|
||||
EventData.ServiceSid as ServiceSid,
|
||||
EventData.TargetUserName as TargetUserName,
|
||||
"0x" + format(format="%x", args=EventData.Status) as Status,
|
||||
EventData.Status as Status,
|
||||
EventData.TargetDomainName as TargetDomainName,
|
||||
"0x" + format(format="%x", args=EventData.TicketEncryptionType) as TicketEncryptionType,
|
||||
"0x" + format(format="%x", args=EventData.TicketOptions) as TicketOptions,
|
||||
EventData.TicketEncryptionType as TicketEncryptionType,
|
||||
EventData.TicketOptions as TicketOptions,
|
||||
EventData.TransmittedServices as TransmittedServices,
|
||||
EventData.IpAddress as IpAddress,
|
||||
EventData.IpPort as IpPort
|
||||
|
||||
+2
-2
@@ -13,7 +13,7 @@ Output: [
|
||||
"Level": 4,
|
||||
"Task": 1,
|
||||
"Opcode": 0,
|
||||
"Keywords": 9223372036854775808,
|
||||
"Keywords": "0x8000000000000000",
|
||||
"TimeCreated": {
|
||||
"SystemTime": 1590282834.1201713
|
||||
},
|
||||
@@ -44,7 +44,7 @@ Output: [
|
||||
"CurrentDirectory": "C:\\Windows\\system32\\",
|
||||
"User": "NT AUTHORITY\\SYSTEM",
|
||||
"LogonGuid": "747F3D96-BDD1-5EC9-0000-0020E7030000",
|
||||
"LogonId": 999,
|
||||
"LogonId": "0x3e7",
|
||||
"TerminalSessionId": 1,
|
||||
"IntegrityLevel": "System",
|
||||
"Hashes": "SHA1=47D7864D26FC67E0D60391CBF170D33DA518C322,MD5=43C2D3293AD939241DF61B3630A9D3B6,SHA256=1D5491E3C468EE4B4EF6EDFF4BBC7D06EE83180F6F0B1576763EA2EFE049493A,IMPHASH=7FF0758B766F747CE57DFAC70743FB88",
|
||||
|
||||
+6
-6
@@ -14,7 +14,7 @@ Output: [
|
||||
"Level": 4,
|
||||
"Task": 104,
|
||||
"Opcode": 0,
|
||||
"Keywords": 4620693217682128896,
|
||||
"Keywords": "0x4020000000000000",
|
||||
"TimeCreated": {
|
||||
"SystemTime": 1549731924.6727583
|
||||
},
|
||||
@@ -33,10 +33,10 @@ Output: [
|
||||
"SubjectUserSid": "S-1-5-21-546003962-2713609280-610790815-1001",
|
||||
"SubjectUserName": "test",
|
||||
"SubjectDomainName": "TESTCOMPUTER",
|
||||
"SubjectLogonId": 135562
|
||||
"SubjectLogonId": "0x2118a"
|
||||
}
|
||||
},
|
||||
"Message": "The audit log was cleared.\nSubject:\n\tSecurity ID:\tS-1-5-21-546003962-2713609280-610790815-1001\n\tAccount Name:\ttest\n\tDomain Name:\tTESTCOMPUTER\n\tLogon ID:\t135562\r\n"
|
||||
"Message": "The audit log was cleared.\nSubject:\n\tSecurity ID:\tS-1-5-21-546003962-2713609280-610790815-1001\n\tAccount Name:\ttest\n\tDomain Name:\tTESTCOMPUTER\n\tLogon ID:\t0x2118a\r\n"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -51,7 +51,7 @@ Output: [
|
||||
"SubjectUserSid": "S-1-5-21-546003962-2713609280-610790815-1001",
|
||||
"SubjectUserName": "test",
|
||||
"SubjectDomainName": "TESTCOMPUTER",
|
||||
"SubjectLogonId": 135562
|
||||
"SubjectLogonId": "0x2118a"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -164,7 +164,7 @@ Output: [
|
||||
"SubjectUserSid": "S-1-5-21-128822557-2730879828-3162054034-1000",
|
||||
"SubjectUserName": "yolo",
|
||||
"SubjectDomainName": "RE-DEV",
|
||||
"SubjectLogonId": 200302,
|
||||
"SubjectLogonId": "0x30e6e",
|
||||
"TaskName": "\\T1053_005_powershell",
|
||||
"TaskContent": {
|
||||
"Actions": {
|
||||
@@ -237,7 +237,7 @@ Output: [
|
||||
"SubjectUserSid": "S-1-5-21-128822557-2730879828-3162054034-1000",
|
||||
"SubjectUserName": "yolo",
|
||||
"SubjectDomainName": "RE-DEV",
|
||||
"SubjectLogonId": 200302,
|
||||
"SubjectLogonId": "0x30e6e",
|
||||
"TaskName": "\\T1053_005_powershell",
|
||||
"TaskContent": "",
|
||||
"ClientProcessStartKey": 5348024557502636,
|
||||
|
||||
+1
-1
@@ -26,8 +26,8 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/Velocidex/ordereddict"
|
||||
kingpin "github.com/alecthomas/kingpin/v2"
|
||||
errors "github.com/go-errors/errors"
|
||||
kingpin "gopkg.in/alecthomas/kingpin.v2"
|
||||
actions_proto "www.velocidex.com/golang/velociraptor/actions/proto"
|
||||
config_proto "www.velocidex.com/golang/velociraptor/config/proto"
|
||||
"www.velocidex.com/golang/velociraptor/constants"
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
toolchain
|
||||
@@ -0,0 +1,10 @@
|
||||
# Local cache for packages.
|
||||
|
||||
Place the packages here if you do not want the build to fetch them
|
||||
automatically:
|
||||
|
||||
When building on Ubuntu:
|
||||
https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64.tar.xz
|
||||
|
||||
When building on Windows:
|
||||
https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-i686.zip
|
||||
+316
@@ -0,0 +1,316 @@
|
||||
package build
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"archive/zip"
|
||||
"bufio"
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
|
||||
"github.com/ulikunitz/xz"
|
||||
"www.velocidex.com/golang/velociraptor/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
// When building on ubuntu
|
||||
package_url_ubuntu_amd64 = ToolchainDesc{
|
||||
Download: "https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64.tar.xz",
|
||||
_GCC: map[string]string{
|
||||
"windows/armv7": "llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/bin/armv7-w64-mingw32-clang",
|
||||
"windows/386": "llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/bin/i686-w64-mingw32-clang",
|
||||
"windows/amd64": "llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/bin/x86_64-w64-mingw32-clang",
|
||||
"windows/aarch64": "llvm-mingw-20260908-ucrt-ubuntu-22.04-x86_64/bin/aarch64-w64-mingw32-clang",
|
||||
},
|
||||
}
|
||||
|
||||
// When building on Windows
|
||||
package_url_windows_amd64 = ToolchainDesc{
|
||||
Download: "https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-ucrt-i686.zip",
|
||||
_GCC: map[string]string{
|
||||
"windows/armv7": "llvm-mingw-20260908-ucrt-i686/bin/armv7-w64-mingw32-clang",
|
||||
"windows/amd64": "llvm-mingw-20260908-ucrt-i686/bin/i686-w64-mingw32-clang",
|
||||
"windows/aarch64": "llvm-mingw-20260908-ucrt-i686/bin/aarch64-w64-mingw32-clang",
|
||||
},
|
||||
}
|
||||
)
|
||||
|
||||
type ToolChainOptions struct {
|
||||
BaseDir string
|
||||
PackageCacheDir string
|
||||
Verbose bool
|
||||
}
|
||||
|
||||
type ToolchainDesc struct {
|
||||
// Should be an absolute path for unpacking the toolchain
|
||||
basedir string
|
||||
|
||||
// Enable for extract messages.
|
||||
verbose bool
|
||||
|
||||
// The download URL for the package.
|
||||
Download string
|
||||
|
||||
// A map of compilers keyed by architectures
|
||||
_GCC map[string]string
|
||||
}
|
||||
|
||||
func NewToolchainDesc(basedir string, verbose bool) *ToolchainDesc {
|
||||
var res ToolchainDesc
|
||||
// When building on Windows use these tool chains.
|
||||
if runtime.GOOS == "windows" {
|
||||
res = package_url_windows_amd64
|
||||
} else {
|
||||
res = package_url_ubuntu_amd64
|
||||
}
|
||||
|
||||
res.basedir = basedir
|
||||
res.verbose = verbose
|
||||
return &res
|
||||
}
|
||||
|
||||
func (self *ToolchainDesc) extractZip(
|
||||
ctx context.Context, fd *os.File) error {
|
||||
|
||||
stat, err := os.Lstat(fd.Name())
|
||||
if err == nil && stat.Mode().IsDir() {
|
||||
return nil
|
||||
}
|
||||
|
||||
z, err := zip.NewReader(fd, stat.Size())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
buffer := make([]byte, 10*1024*1024)
|
||||
|
||||
for _, member := range z.File {
|
||||
if utils.IsCtxDone(ctx) {
|
||||
return utils.CancelledError
|
||||
}
|
||||
|
||||
if member.FileInfo().IsDir() {
|
||||
continue
|
||||
}
|
||||
|
||||
output_path := utils.Join(self.basedir, member.Name)
|
||||
if self.verbose {
|
||||
fmt.Printf("Creating %v (%v bytes)\n", output_path,
|
||||
member.FileInfo().Size())
|
||||
}
|
||||
err = os.MkdirAll(filepath.Dir(output_path), 0700)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
out_fd, err := os.OpenFile(output_path,
|
||||
os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0700)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
in_fd, err := member.Open()
|
||||
if err != nil {
|
||||
out_fd.Close()
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = utils.CopyWithBuffer(ctx, out_fd, in_fd, buffer)
|
||||
if err != nil {
|
||||
in_fd.Close()
|
||||
out_fd.Close()
|
||||
return err
|
||||
}
|
||||
in_fd.Close()
|
||||
out_fd.Close()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (self *ToolchainDesc) extractXZ(
|
||||
ctx context.Context, fd *os.File) error {
|
||||
gzr, err := xz.NewReader(bufio.NewReader(fd))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
buffer := make([]byte, 10*1024*1024)
|
||||
|
||||
tr := tar.NewReader(gzr)
|
||||
for {
|
||||
if utils.IsCtxDone(ctx) {
|
||||
return utils.CancelledError
|
||||
}
|
||||
|
||||
header, err := tr.Next()
|
||||
|
||||
switch {
|
||||
case err == io.EOF:
|
||||
return nil
|
||||
|
||||
case err != nil:
|
||||
return err
|
||||
|
||||
case header == nil:
|
||||
continue
|
||||
}
|
||||
|
||||
target := filepath.Join(self.basedir, header.Name)
|
||||
|
||||
// check the file type
|
||||
switch header.Typeflag {
|
||||
default:
|
||||
fmt.Printf("Do not know how to handle type %v: %#v\n",
|
||||
header.Typeflag, header)
|
||||
return utils.InvalidArgError
|
||||
|
||||
case tar.TypeSymlink:
|
||||
target_link := header.Linkname
|
||||
err := os.Symlink(target_link, target)
|
||||
if self.verbose {
|
||||
fmt.Printf("Linking %v to %v\n", target, target_link)
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// if its a dir and it doesn't exist create it
|
||||
case tar.TypeDir:
|
||||
err := os.MkdirAll(target, 0755)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
case tar.TypeReg:
|
||||
if self.verbose {
|
||||
fmt.Printf("Creating %v (%v bytes)\n", target, header.Size)
|
||||
}
|
||||
|
||||
f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = utils.CopyWithBuffer(ctx, f, tr, buffer)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
f.Close()
|
||||
|
||||
err = os.Chmod(target, os.FileMode(header.Mode))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (self *ToolchainDesc) GCC(target string) (string, error) {
|
||||
// Check if the compiler is there
|
||||
filename, pres := self._GCC[target]
|
||||
if !pres {
|
||||
return "", fmt.Errorf("Unsupported target %v", target)
|
||||
}
|
||||
|
||||
fullpath := filepath.Join(self.basedir, filename)
|
||||
|
||||
cmd := exec.Command(fullpath, "--version")
|
||||
_, err := cmd.CombinedOutput()
|
||||
return fullpath, err
|
||||
}
|
||||
|
||||
func fetchFile(
|
||||
ctx context.Context, url, output string) error {
|
||||
// Download the package locally
|
||||
out_fd, err := os.OpenFile(output,
|
||||
os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0700)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer out_fd.Close()
|
||||
|
||||
req, err := http.NewRequestWithContext(
|
||||
ctx, "GET", url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
_, err = utils.Copy(ctx, out_fd, resp.Body)
|
||||
return err
|
||||
}
|
||||
|
||||
func InstallToolChain(
|
||||
ctx context.Context,
|
||||
options ToolChainOptions) (*ToolchainDesc, error) {
|
||||
|
||||
if options.BaseDir == "" || options.PackageCacheDir == "" {
|
||||
return nil, fmt.Errorf(
|
||||
"Both BaseDir and PackageCacheDir must be provided")
|
||||
}
|
||||
|
||||
desc := NewToolchainDesc(
|
||||
options.BaseDir, options.Verbose)
|
||||
|
||||
stat, err := os.Lstat(options.BaseDir)
|
||||
// If the directory already exists, we assume the toolchain is
|
||||
// already downloaded.
|
||||
if err == nil && stat.Mode().IsDir() {
|
||||
return desc, nil
|
||||
}
|
||||
|
||||
package_filename := filepath.Join(
|
||||
options.PackageCacheDir, filepath.Base(desc.Download))
|
||||
|
||||
_, err = os.Lstat(package_filename)
|
||||
if err == nil {
|
||||
fmt.Printf("Reusing cached package %v\n", package_filename)
|
||||
|
||||
} else {
|
||||
if os.IsNotExist(err) {
|
||||
fmt.Printf("Downloading package %v into %v\n",
|
||||
desc.Download, package_filename)
|
||||
|
||||
err := fetchFile(ctx, desc.Download, package_filename)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
} else {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
fd, err := os.Open(package_filename)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer fd.Close()
|
||||
|
||||
if strings.HasSuffix(package_filename, ".xz") {
|
||||
fmt.Printf("Unpacking %v to %v\n", package_filename,
|
||||
options.BaseDir)
|
||||
defer fmt.Printf("Done!\n")
|
||||
return desc, desc.extractXZ(ctx, fd)
|
||||
}
|
||||
|
||||
if strings.HasSuffix(package_filename, ".zip") {
|
||||
fmt.Printf("Unpacking %v to %v\n", package_filename,
|
||||
options.BaseDir)
|
||||
defer fmt.Printf("Done!\n")
|
||||
return desc, desc.extractZip(ctx, fd)
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("Unknown compression for %v",
|
||||
package_filename)
|
||||
}
|
||||
@@ -1,2 +1,2 @@
|
||||
all:
|
||||
go run ./main.go ~/projects/velociraptor/docs/references/server.config.yaml
|
||||
go run -tags config_check ./main.go ~/projects/velociraptor/docs/references/server.config.yaml
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
//go:build config_check
|
||||
// +build config_check
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
@@ -9,8 +12,8 @@ import (
|
||||
"unicode"
|
||||
|
||||
"github.com/Velocidex/yaml/v2"
|
||||
kingpin "github.com/alecthomas/kingpin/v2"
|
||||
"github.com/davecgh/go-spew/spew"
|
||||
kingpin "gopkg.in/alecthomas/kingpin.v2"
|
||||
config_proto "www.velocidex.com/golang/velociraptor/config/proto"
|
||||
"www.velocidex.com/golang/velociraptor/constants"
|
||||
"www.velocidex.com/golang/velociraptor/utils"
|
||||
|
||||
@@ -7,9 +7,9 @@ require (
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Showmax/go-fqdn v1.0.0
|
||||
github.com/Velocidex/amsi v0.0.0-20250418124629-ea341d1aa3f2
|
||||
github.com/Velocidex/etw v0.0.0-20251027041548-6d97883fd588
|
||||
github.com/Velocidex/go-magic v0.0.0-20260623224109-5dd5a41c69ac
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260806050527-f3bfad52e4eb
|
||||
github.com/Velocidex/etw v0.0.0-20260915061434-e8c6e9f7b799
|
||||
github.com/Velocidex/go-magic v0.0.0-20260915105357-ee314c304181
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260915111603-5c94650bd2f5
|
||||
github.com/Velocidex/grpc-go-pool v1.2.2-0.20260526092838-b4e236b2105f
|
||||
github.com/Velocidex/json v0.0.0-20220224052537-92f3c0326e5a
|
||||
github.com/Velocidex/pkcs7 v0.0.0-20230220112103-d4ed02e1862a
|
||||
@@ -67,22 +67,21 @@ require (
|
||||
github.com/xor-gate/ar v0.0.0-20170530204233-5c72ae81e2b7
|
||||
github.com/xor-gate/debpkg v1.0.0
|
||||
go.starlark.net v0.0.0-20230925163745-10651d5192ab
|
||||
golang.org/x/crypto v0.54.0
|
||||
golang.org/x/mod v0.38.0
|
||||
golang.org/x/net v0.57.0
|
||||
golang.org/x/sys v0.47.0
|
||||
golang.org/x/text v0.41.0
|
||||
golang.org/x/crypto v0.55.0
|
||||
golang.org/x/mod v0.41.0
|
||||
golang.org/x/net v0.58.0
|
||||
golang.org/x/sys v0.48.0
|
||||
golang.org/x/text v0.42.0
|
||||
golang.org/x/time v0.14.0
|
||||
google.golang.org/api v0.264.0
|
||||
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
|
||||
google.golang.org/grpc v1.83.1
|
||||
google.golang.org/grpc v1.83.2
|
||||
google.golang.org/protobuf v1.36.11
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6
|
||||
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
|
||||
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
|
||||
gopkg.in/sourcemap.v1 v1.0.5 // indirect
|
||||
howett.net/plist v1.0.0
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260612024815-7947209eb310
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260916104054-0ef2ce4e83a8
|
||||
www.velocidex.com/golang/go-ese v0.2.1-0.20260812030448-458e8abf4a57
|
||||
www.velocidex.com/golang/go-ntfs v0.2.1-0.20260722055306-c81244c6bcd5
|
||||
www.velocidex.com/golang/go-pe v0.1.1-0.20251107001057-f93001158cd9
|
||||
@@ -156,6 +155,7 @@ require (
|
||||
github.com/rogpeppe/go-internal v1.14.1
|
||||
github.com/shirou/gopsutil/v4 v4.25.1
|
||||
github.com/syndtr/goleveldb v1.0.0
|
||||
github.com/ulikunitz/xz v0.5.15
|
||||
github.com/valyala/fastjson v1.6.4
|
||||
github.com/vincent-petithory/dataurl v1.0.0
|
||||
github.com/virtuald/go-paniclog v0.0.0-20190812204905-43a7fa316459
|
||||
@@ -194,7 +194,6 @@ require (
|
||||
github.com/RoaringBitmap/roaring/v2 v2.14.5 // indirect
|
||||
github.com/alecthomas/colour v0.1.0 // indirect
|
||||
github.com/alecthomas/participle v0.7.1 // indirect
|
||||
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
|
||||
github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
|
||||
github.com/andybalholm/cascadia v1.3.2 // indirect
|
||||
github.com/atotto/clipboard v0.1.4 // indirect
|
||||
@@ -245,7 +244,7 @@ require (
|
||||
github.com/charmbracelet/x/ansi v0.11.7 // indirect
|
||||
github.com/charmbracelet/x/exp/strings v0.0.0-20241209212528-0eec74ecaa6f // indirect
|
||||
github.com/charmbracelet/x/term v0.2.2 // indirect
|
||||
github.com/cilium/ebpf v0.20.1-0.20251215101449-df5c3096bd8c // indirect
|
||||
github.com/cilium/ebpf v0.22.0 // indirect
|
||||
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
||||
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
||||
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
|
||||
@@ -339,7 +338,6 @@ require (
|
||||
github.com/tinylib/msgp v1.6.3 // indirect
|
||||
github.com/tklauser/go-sysconf v0.3.12 // indirect
|
||||
github.com/tklauser/numcpus v0.6.1 // indirect
|
||||
github.com/ulikunitz/xz v0.5.15 // indirect
|
||||
github.com/valyala/fasttemplate v1.2.2 // indirect
|
||||
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
|
||||
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
||||
@@ -361,7 +359,7 @@ require (
|
||||
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
||||
golang.org/x/arch v0.23.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
|
||||
golang.org/x/sync v0.22.0 // indirect
|
||||
golang.org/x/sync v0.23.0 // indirect
|
||||
golang.org/x/term v0.45.0 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df // indirect
|
||||
kernel.org/pub/linux/libs/security/libcap/cap v1.2.71 // indirect
|
||||
@@ -383,7 +381,7 @@ require (
|
||||
// replace github.com/Velocidex/yaml/v2 => ../yaml
|
||||
// replace www.velocidex.com/golang/go-prefetch => ../go-prefetch
|
||||
// replace github.com/Velocidex/go-magic => ../go-magic
|
||||
// replace github.com/Velocidex/go-yara => ../go-yara-velocidex
|
||||
// replace github.com/Velocidex/go-yara => ../go-yara
|
||||
// replace github.com/Velocidex/json => ../json
|
||||
// replace github.com/russross/blackfriday/v2 => ../blackfriday
|
||||
// replace www.velocidex.com/golang/vtypes => ../vtypes
|
||||
|
||||
@@ -99,8 +99,8 @@ github.com/Velocidex/disklru v0.0.0-20260320011440-3c115228b6d7 h1:0e+y6o+6b+aPv
|
||||
github.com/Velocidex/disklru v0.0.0-20260320011440-3c115228b6d7/go.mod h1:rnpfGZsQI3I0PZVhZyZMiXaGoRZ/D6zXH9Tl6Sn3c3o=
|
||||
github.com/Velocidex/errors v0.0.0-20221019164655-9ace6bf61e26 h1:VwbeNpMRuS3bRieg7WLaSYIMaI8RjH/wGxd37oj6H1g=
|
||||
github.com/Velocidex/errors v0.0.0-20221019164655-9ace6bf61e26/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
|
||||
github.com/Velocidex/etw v0.0.0-20251027041548-6d97883fd588 h1:cP4Tk/yo4bqcTm3QC5CGc92WJvh/tS+sWGI681WBUZM=
|
||||
github.com/Velocidex/etw v0.0.0-20251027041548-6d97883fd588/go.mod h1:VIXXclFpWN0pisSoz1obVWQvQCwqr60HmNWuYMB95Cs=
|
||||
github.com/Velocidex/etw v0.0.0-20260915061434-e8c6e9f7b799 h1:5g30krg7L88BNfqOrOfSJNXRJfRdJjrLWMxhEAv0k40=
|
||||
github.com/Velocidex/etw v0.0.0-20260915061434-e8c6e9f7b799/go.mod h1:VIXXclFpWN0pisSoz1obVWQvQCwqr60HmNWuYMB95Cs=
|
||||
github.com/Velocidex/file-rotatelogs v0.0.0-20211221020724-d12e4dae4e11 h1:pQY9p6hvmbFKXJg8suzGSG9/t8Ij9ece32GUFIdHgqg=
|
||||
github.com/Velocidex/file-rotatelogs v0.0.0-20211221020724-d12e4dae4e11/go.mod h1:Ya1f4Kowt2GC7gbnu1MbNncvI1Lp3i1plN2xLiETJfg=
|
||||
github.com/Velocidex/fileb0x v1.1.2-0.20251122021447-f71ad8da5502 h1:psJvxav9vuMgmJzPZAOIDerWc+PqwHl54SZi4HZ7dx0=
|
||||
@@ -115,16 +115,16 @@ github.com/Velocidex/go-fat v0.0.0-20260301005230-08fb790838a9 h1:Lc/fU68mtM09XP
|
||||
github.com/Velocidex/go-fat v0.0.0-20260301005230-08fb790838a9/go.mod h1:eIgJ3KnRtnoO6lXOfZBina/KGAoyUBFUYjy+iZGVvkc=
|
||||
github.com/Velocidex/go-journalctl v0.0.0-20260608120136-20835635c054 h1:hc8UFd8TVa9tJi+zEUVrJ3JYTCI9G/a4GfBpkUA2UtI=
|
||||
github.com/Velocidex/go-journalctl v0.0.0-20260608120136-20835635c054/go.mod h1:rlnsxeW5SJE/T9/6+TgxH5xFADkqizR02QIGFVJQsT4=
|
||||
github.com/Velocidex/go-magic v0.0.0-20260623224109-5dd5a41c69ac h1:754ZJyGX9gvOBNpYuG77okuoy6REJqc6d3gWFMQosz0=
|
||||
github.com/Velocidex/go-magic v0.0.0-20260623224109-5dd5a41c69ac/go.mod h1:2oVfOYRdtA0yuSZiN9ai8PRgxvkw6SLUlUXy1Sm76qk=
|
||||
github.com/Velocidex/go-magic v0.0.0-20260915105357-ee314c304181 h1:qwzdWT3jrG19NFsrOJprcwHeZ030PkRGVx5RznzuWog=
|
||||
github.com/Velocidex/go-magic v0.0.0-20260915105357-ee314c304181/go.mod h1:2oVfOYRdtA0yuSZiN9ai8PRgxvkw6SLUlUXy1Sm76qk=
|
||||
github.com/Velocidex/go-mscfb v0.0.0-20240618091452-31f4ccc54002 h1:FWeeVb/x+XvaIKZyMdxwB+JYmj4dSATSuu+DBfCXFVU=
|
||||
github.com/Velocidex/go-mscfb v0.0.0-20240618091452-31f4ccc54002/go.mod h1:YvYAfyK6Jg2WIaqvK42KPmVDfU8FSVxoSiZSVJfihDo=
|
||||
github.com/Velocidex/go-vhdx v0.0.0-20250511013458-5cba970cdeda h1:Q0pdD/aAUCmTv3ndK+m0yxQU1WdBLKEGPHEs68+w+8I=
|
||||
github.com/Velocidex/go-vhdx v0.0.0-20250511013458-5cba970cdeda/go.mod h1:lBB+XfppHmYxIfnWDszC78x1iMq8088nMnMYQFQovM4=
|
||||
github.com/Velocidex/go-vmdk v0.0.0-20250505140221-bd4633ce2fbf h1:nncITcAsfVBs01yg2Z0RJ05Phr6qM+UToxDEzqJ+1yk=
|
||||
github.com/Velocidex/go-vmdk v0.0.0-20250505140221-bd4633ce2fbf/go.mod h1:AlPOz69A80YxtZuayEM+w9PYbGhaOOHgm1l92egHlzg=
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260806050527-f3bfad52e4eb h1:pIsxnhAtmWH/Va7Z4yw9uZkXpR82uZbV7A5DCY/be+Q=
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260806050527-f3bfad52e4eb/go.mod h1:5KKwF74avzF4GPZg37NoWfJiDgrBF5ASHH27g1p83zk=
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260915111603-5c94650bd2f5 h1:27r8y5q7uV1pMrLqIgTrRk1MdtSnDD6zOeCdWclWq44=
|
||||
github.com/Velocidex/go-yara v1.1.10-0.20260915111603-5c94650bd2f5/go.mod h1:5KKwF74avzF4GPZg37NoWfJiDgrBF5ASHH27g1p83zk=
|
||||
github.com/Velocidex/grok v0.0.1 h1:bOaqowsW9ecfJISQOM9K47Jk/ID9V945BLfKngUZEjo=
|
||||
github.com/Velocidex/grok v0.0.1/go.mod h1:tO25ta1WAuru0QA9ajcK0bAsk0gpWiT8so+fR4u3GZE=
|
||||
github.com/Velocidex/grpc-go-pool v1.2.2-0.20260526092838-b4e236b2105f h1:nVc9Y69VrGkBVCDKYbrbf4gQYykRzArO6JUD3MOqKcE=
|
||||
@@ -176,8 +176,6 @@ github.com/alecthomas/repr v0.0.0-20201120212035-bb82daffcca2/go.mod h1:2kn6fqh/
|
||||
github.com/alecthomas/repr v0.1.1/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
|
||||
github.com/alecthomas/repr v0.5.4 h1:OVP7JEcuzU9CCDsT6STCr3rg17oQfWILtPWd2EG0uN4=
|
||||
github.com/alecthomas/repr v0.5.4/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
|
||||
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
|
||||
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
|
||||
github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
|
||||
github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
|
||||
github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
|
||||
@@ -313,8 +311,8 @@ github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5
|
||||
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
|
||||
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
|
||||
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
|
||||
github.com/cilium/ebpf v0.20.1-0.20251215101449-df5c3096bd8c h1:oC8e6Vac5mOCKfGtbozmBY7wUvKV0aekCUYeFJ9ffCM=
|
||||
github.com/cilium/ebpf v0.20.1-0.20251215101449-df5c3096bd8c/go.mod h1:dM+AMI6FkW5LOkzikdefUmzK0z81o7GqiKXon7D1F58=
|
||||
github.com/cilium/ebpf v0.22.0 h1:v2ktp0roffpMOj2MMf3idtCQZOsAoC4BJbAJN+ke2bY=
|
||||
github.com/cilium/ebpf v0.22.0/go.mod h1:CDzZbe2hC5JjlDC+CY3KFCzlYwN4gbxppYM+Z10bQt4=
|
||||
github.com/clayscode/Go-Splunk-HTTP/splunk/v2 v2.0.1-0.20221027171526-76a36be4fa02 h1:GpaHYwMLoDarNxagi3vGGzPsIMhO7LHGlMn9eHVXWK4=
|
||||
github.com/clayscode/Go-Splunk-HTTP/splunk/v2 v2.0.1-0.20221027171526-76a36be4fa02/go.mod h1:HxsMAwjIrYG2Afz/JB+a4HcALVNM0zTLTO5RZnf+OS8=
|
||||
github.com/clbanning/mxj v1.8.4 h1:HuhwZtbyvyOw+3Z1AowPkU87JkJUSv751ELWaiTpj8I=
|
||||
@@ -651,8 +649,8 @@ github.com/mccutchen/go-httpbin/v2 v2.18.3 h1:DyckIScjHLJtmlSju+rgjqqI1nL8AdMZHs
|
||||
github.com/mccutchen/go-httpbin/v2 v2.18.3/go.mod h1:GBy5I7XwZ4ZLhT3hcq39I4ikwN9x4QUt6EAxNiR8Jus=
|
||||
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
|
||||
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
|
||||
github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
|
||||
github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
|
||||
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
|
||||
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
|
||||
github.com/microcosm-cc/bluemonday v1.0.23 h1:SMZe2IGa0NuHvnVNAZ+6B38gsTbi5e4sViiWJyDDqFY=
|
||||
github.com/microcosm-cc/bluemonday v1.0.23/go.mod h1:mN70sk7UkkF8TUr2IGBpNN0jAgStuPzlK76QuruE/z4=
|
||||
github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
|
||||
@@ -921,8 +919,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
|
||||
golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
|
||||
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
|
||||
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
|
||||
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
|
||||
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
|
||||
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
|
||||
@@ -940,8 +938,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
|
||||
golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
|
||||
golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
|
||||
golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
|
||||
golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@@ -967,8 +965,8 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
|
||||
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
|
||||
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
|
||||
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
|
||||
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
|
||||
golang.org/x/oauth2 v0.0.0-20170912212905-13449ad91cb2/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
|
||||
@@ -983,8 +981,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
|
||||
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
|
||||
golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -1015,8 +1013,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
|
||||
golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
@@ -1033,8 +1031,8 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
|
||||
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
|
||||
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
|
||||
golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
|
||||
golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
|
||||
golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
|
||||
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
|
||||
@@ -1083,8 +1081,8 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac
|
||||
google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
|
||||
google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
|
||||
google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
|
||||
google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
|
||||
google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
|
||||
google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
|
||||
google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 h1:TLkBREm4nIsEcexnCjgQd5GQWaHcqMzwQV0TX9pq8S0=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
@@ -1100,8 +1098,6 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
|
||||
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
|
||||
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
|
||||
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
|
||||
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
@@ -1145,8 +1141,8 @@ software.sslmate.com/src/go-pkcs12 v0.2.0 h1:nlFkj7bTysH6VkC4fGphtjXRbezREPgrHuJ
|
||||
software.sslmate.com/src/go-pkcs12 v0.2.0/go.mod h1:23rNcYsMabIc1otwLpTkCCPwUq6kQsTyowttG/as0kQ=
|
||||
www.velocidex.com/golang/binparsergen v0.1.1-0.20240404114946-8f66c7cf586e h1:uf1AsYiIzUMJMIdFsVdrIw/BjrGzZbrsnz9xmeZmlYU=
|
||||
www.velocidex.com/golang/binparsergen v0.1.1-0.20240404114946-8f66c7cf586e/go.mod h1:jk+uZGukrJZWgnNH6q9tJLUnbugHEDPCQdIOmBBMXY4=
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260612024815-7947209eb310 h1:ZCFeIyZoe7bKeZjG7brciQZzqRY7PdscLOYuEbWpNHM=
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260612024815-7947209eb310/go.mod h1:AEH50xeMcAUGiCXLAueUOq800jFgFyqngyPt88fDzow=
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260916104054-0ef2ce4e83a8 h1:Me1/9DB8ZMH6+ZNFWPlfn3JEFgZNH59Cfk83wcQ2PEk=
|
||||
www.velocidex.com/golang/evtx v0.2.1-0.20260916104054-0ef2ce4e83a8/go.mod h1:AEH50xeMcAUGiCXLAueUOq800jFgFyqngyPt88fDzow=
|
||||
www.velocidex.com/golang/go-ese v0.2.1-0.20260812030448-458e8abf4a57 h1:CRdOpwPmVFzjfSrJXLj+xHOMyKfK4+WlJTf9IDMdXtk=
|
||||
www.velocidex.com/golang/go-ese v0.2.1-0.20260812030448-458e8abf4a57/go.mod h1:H1Gw62XkspXEtZPT2ep+L57GgdKIDHwueazxKnn5EXc=
|
||||
www.velocidex.com/golang/go-ntfs v0.2.1-0.20260722055306-c81244c6bcd5 h1:GDqKvZ2fdZVHQRSMczl41u2DPJEgbYdK6aaVkCBB8Jc=
|
||||
|
||||
Generated
+8
-89
@@ -20,7 +20,7 @@
|
||||
"axios-retry": "3.9.1",
|
||||
"bootstrap": "5.3.8",
|
||||
"classnames": "^2.5.1",
|
||||
"csv-parse": "4.16.3",
|
||||
"csv-parse": "7.0.2",
|
||||
"csv-stringify": "5.6.5",
|
||||
"dompurify": "3.4.13",
|
||||
"env-cmd": "^10.1.0",
|
||||
@@ -5976,9 +5976,10 @@
|
||||
"integrity": "sha512-DJR/VvkAvSZW9bTouZue2sSxDwdTN92uHjqeKVm+0dAqdfNykRzQ95tay8aXMBAAPpUiq4Qcug2L7neoRh2Egw=="
|
||||
},
|
||||
"node_modules/csv-parse": {
|
||||
"version": "4.16.3",
|
||||
"resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-4.16.3.tgz",
|
||||
"integrity": "sha512-cO1I/zmz4w2dcKHVvpCr7JVRu8/FymG5OEpmvsZYlccYolPBLoVGKUHgNoc4ZGkFeFlWGEDmMyBM+TTqRdW/wg=="
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-7.0.2.tgz",
|
||||
"integrity": "sha512-uKZghv9UmPkMVLYy//KZ9HFAIJsl7wkhoEdIL0+rhuSY9pZQlhaeGEDPIe+/w7eh81MOql8Q/9+inAGWG6ZHYA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/csv-stringify": {
|
||||
"version": "5.6.5",
|
||||
@@ -8938,41 +8939,6 @@
|
||||
"url": "https://github.com/chalk/ansi-styles?sponsor=1"
|
||||
}
|
||||
},
|
||||
"node_modules/jest-circus/node_modules/babel-plugin-macros": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/babel-plugin-macros/-/babel-plugin-macros-3.1.0.tgz",
|
||||
"integrity": "sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@babel/runtime": "^7.12.5",
|
||||
"cosmiconfig": "^7.0.0",
|
||||
"resolve": "^1.19.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10",
|
||||
"npm": ">=6"
|
||||
}
|
||||
},
|
||||
"node_modules/jest-circus/node_modules/cosmiconfig": {
|
||||
"version": "7.1.0",
|
||||
"resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
|
||||
"integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@types/parse-json": "^4.0.0",
|
||||
"import-fresh": "^3.2.1",
|
||||
"parse-json": "^5.0.0",
|
||||
"path-type": "^4.0.0",
|
||||
"yaml": "^1.10.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10"
|
||||
}
|
||||
},
|
||||
"node_modules/jest-circus/node_modules/dedent": {
|
||||
"version": "1.7.2",
|
||||
"resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
|
||||
@@ -9001,17 +8967,6 @@
|
||||
"node": "^14.15.0 || ^16.10.0 || >=18.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/jest-circus/node_modules/yaml": {
|
||||
"version": "1.10.3",
|
||||
"resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
|
||||
"integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">= 6"
|
||||
}
|
||||
},
|
||||
"node_modules/jest-cli": {
|
||||
"version": "29.7.0",
|
||||
"resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-29.7.0.tgz",
|
||||
@@ -18469,9 +18424,9 @@
|
||||
"integrity": "sha512-DJR/VvkAvSZW9bTouZue2sSxDwdTN92uHjqeKVm+0dAqdfNykRzQ95tay8aXMBAAPpUiq4Qcug2L7neoRh2Egw=="
|
||||
},
|
||||
"csv-parse": {
|
||||
"version": "4.16.3",
|
||||
"resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-4.16.3.tgz",
|
||||
"integrity": "sha512-cO1I/zmz4w2dcKHVvpCr7JVRu8/FymG5OEpmvsZYlccYolPBLoVGKUHgNoc4ZGkFeFlWGEDmMyBM+TTqRdW/wg=="
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-7.0.2.tgz",
|
||||
"integrity": "sha512-uKZghv9UmPkMVLYy//KZ9HFAIJsl7wkhoEdIL0+rhuSY9pZQlhaeGEDPIe+/w7eh81MOql8Q/9+inAGWG6ZHYA=="
|
||||
},
|
||||
"csv-stringify": {
|
||||
"version": "5.6.5",
|
||||
@@ -20611,34 +20566,6 @@
|
||||
"integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
|
||||
"dev": true
|
||||
},
|
||||
"babel-plugin-macros": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/babel-plugin-macros/-/babel-plugin-macros-3.1.0.tgz",
|
||||
"integrity": "sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"requires": {
|
||||
"@babel/runtime": "^7.12.5",
|
||||
"cosmiconfig": "^7.0.0",
|
||||
"resolve": "^1.19.0"
|
||||
}
|
||||
},
|
||||
"cosmiconfig": {
|
||||
"version": "7.1.0",
|
||||
"resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
|
||||
"integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"requires": {
|
||||
"@types/parse-json": "^4.0.0",
|
||||
"import-fresh": "^3.2.1",
|
||||
"parse-json": "^5.0.0",
|
||||
"path-type": "^4.0.0",
|
||||
"yaml": "^1.10.0"
|
||||
}
|
||||
},
|
||||
"dedent": {
|
||||
"version": "1.7.2",
|
||||
"resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
|
||||
@@ -20656,14 +20583,6 @@
|
||||
"ansi-styles": "^5.0.0",
|
||||
"react-is": "^18.0.0"
|
||||
}
|
||||
},
|
||||
"yaml": {
|
||||
"version": "1.10.3",
|
||||
"resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
|
||||
"integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
|
||||
"dev": true,
|
||||
"optional": true,
|
||||
"peer": true
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
"axios-retry": "3.9.1",
|
||||
"bootstrap": "5.3.8",
|
||||
"classnames": "^2.5.1",
|
||||
"csv-parse": "4.16.3",
|
||||
"csv-parse": "7.0.2",
|
||||
"csv-stringify": "5.6.5",
|
||||
"dompurify": "3.4.13",
|
||||
"env-cmd": "^10.1.0",
|
||||
|
||||
+170
-80
@@ -23,6 +23,7 @@ package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
@@ -38,13 +39,17 @@ import (
|
||||
|
||||
"github.com/Masterminds/semver/v3"
|
||||
"github.com/Velocidex/fileb0x/runner"
|
||||
"github.com/Velocidex/ordereddict"
|
||||
"github.com/magefile/mage/mg"
|
||||
"github.com/magefile/mage/sh"
|
||||
"gopkg.in/yaml.v2"
|
||||
"www.velocidex.com/golang/velociraptor/build"
|
||||
"www.velocidex.com/golang/velociraptor/constants"
|
||||
"www.velocidex.com/golang/velociraptor/json"
|
||||
)
|
||||
|
||||
// Run with DEBUG=1 environment variable to see more debug messages.
|
||||
|
||||
var (
|
||||
assets = []string{
|
||||
"artifacts/b0x.yaml",
|
||||
@@ -55,20 +60,19 @@ var (
|
||||
|
||||
index_template = "gui/velociraptor/build/index.html"
|
||||
|
||||
// apt-get install gcc-mingw-w64-x86-64
|
||||
mingw_xcompiler = "x86_64-w64-mingw32-gcc"
|
||||
|
||||
// apt-get install gcc-mingw-w64
|
||||
mingw_xcompiler_32 = "i686-w64-mingw32-gcc"
|
||||
musl_xcompiler = "musl-gcc"
|
||||
name = "velociraptor"
|
||||
version = "v" + constants.VERSION
|
||||
musl_xcompiler = "musl-gcc"
|
||||
name = "velociraptor"
|
||||
version = "v" + constants.VERSION
|
||||
|
||||
// https://github.com/googleapis/google-cloud-go/issues/11448
|
||||
// google cloud suddenly increased its dependency size by about
|
||||
// 20mb without warning. This little documented tag is used to
|
||||
// remove useless bloat.
|
||||
base_tags = " server_vql extras disable_grpc_modules "
|
||||
|
||||
// Where we store the toolchains and package caches
|
||||
toolchain_dir = "./build/toolchain"
|
||||
package_cache_dir = "./build/packages"
|
||||
)
|
||||
|
||||
func ReadAllWithLimit(
|
||||
@@ -126,37 +130,47 @@ func (self Builder) Name() string {
|
||||
}
|
||||
|
||||
func (self *Builder) Env() map[string]string {
|
||||
env := make(map[string]string)
|
||||
env := ordereddict.NewDict()
|
||||
|
||||
env["GOOS"] = self.goos
|
||||
env["GOARCH"] = self.arch
|
||||
env.Set("GOOS", self.goos)
|
||||
env.Set("GOARCH", self.arch)
|
||||
|
||||
if self.disable_cgo {
|
||||
env["CGO_ENABLED"] = "0"
|
||||
env.Set("CGO_ENABLED", "0")
|
||||
} else {
|
||||
env["CGO_ENABLED"] = "1"
|
||||
}
|
||||
|
||||
// If we are cross compiling, set the right compiler.
|
||||
if (runtime.GOOS == "linux" || runtime.GOOS == "darwin") &&
|
||||
self.goos == "windows" {
|
||||
|
||||
if self.arch == "amd64" {
|
||||
if mingwxcompiler_exists() {
|
||||
env["CC"] = mingw_xcompiler
|
||||
}
|
||||
} else {
|
||||
if mingwxcompiler32_exists() {
|
||||
env["CC"] = mingw_xcompiler_32
|
||||
}
|
||||
}
|
||||
env.Set("CGO_ENABLED", "1")
|
||||
}
|
||||
|
||||
// This is a cross compiled target
|
||||
if self.cc != "" {
|
||||
env["CC"] = self.cc
|
||||
env.Set("CC", self.cc)
|
||||
}
|
||||
fmt.Printf("Build Environment: %v\n", json.MustMarshalString(env))
|
||||
return env
|
||||
fmt.Printf("Build Environment: %v\n",
|
||||
json.MustMarshalString(env))
|
||||
|
||||
res := make(map[string]string)
|
||||
for _, item := range env.Items() {
|
||||
res[item.Key] = item.Value.(string)
|
||||
}
|
||||
|
||||
return res
|
||||
}
|
||||
|
||||
func (self *Builder) tags() string {
|
||||
tags := base_tags + self.extra_tags
|
||||
if self.sumo {
|
||||
tags += " sumo "
|
||||
}
|
||||
return tags
|
||||
}
|
||||
|
||||
func (self Builder) ldflags() string {
|
||||
basic_flags := "-w -s "
|
||||
if self.debug_build {
|
||||
basic_flags = ""
|
||||
}
|
||||
|
||||
return basic_flags + self.extra_ldflags + flags()
|
||||
}
|
||||
|
||||
func (self Builder) Run() error {
|
||||
@@ -169,22 +183,13 @@ func (self Builder) Run() error {
|
||||
return err
|
||||
}
|
||||
|
||||
basic_flags := "-w -s "
|
||||
if self.debug_build {
|
||||
basic_flags = ""
|
||||
}
|
||||
|
||||
tags := base_tags + self.extra_tags
|
||||
if self.sumo {
|
||||
tags += " sumo "
|
||||
}
|
||||
|
||||
args := []string{
|
||||
"build",
|
||||
// Uncomment this to force a rebuild.
|
||||
// "-a",
|
||||
"-o", filepath.Join("output", self.Name()),
|
||||
"-tags", tags,
|
||||
"-ldflags= " + basic_flags +
|
||||
self.extra_ldflags + flags(),
|
||||
"-tags", self.tags(),
|
||||
"-ldflags= " + self.ldflags(),
|
||||
}
|
||||
args = append(args, self.extra_flags...)
|
||||
args = append(args, "./bin/")
|
||||
@@ -209,7 +214,7 @@ func AutoDev() error {
|
||||
|
||||
// Build all the release versions. Darwin we build separately on a
|
||||
// Mac.
|
||||
func Release() error {
|
||||
func Release(ctx context.Context) error {
|
||||
err := Clean()
|
||||
if err != nil {
|
||||
return err
|
||||
@@ -231,25 +236,27 @@ func Release() error {
|
||||
}
|
||||
|
||||
if runtime.GOOS == "linux" {
|
||||
// Build all these targets in the Linux release.
|
||||
err := Linux()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if mingwxcompiler_exists() {
|
||||
err := Windows()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return Windowsx86()
|
||||
err = Windows(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Windowsx86(ctx)
|
||||
|
||||
}
|
||||
|
||||
// On MacOS we only build the macos release
|
||||
if runtime.GOOS == "darwin" {
|
||||
return Darwin()
|
||||
}
|
||||
|
||||
return Windows()
|
||||
return Windows(ctx)
|
||||
}
|
||||
|
||||
func Linux() error {
|
||||
@@ -394,75 +401,123 @@ func LinuxMips() error {
|
||||
|
||||
// Builds a Development binary. This does not embed things like GUI
|
||||
// resources to allow them to be loaded from the local directory.
|
||||
func Dev() error {
|
||||
return Builder{goos: "linux", arch: "amd64",
|
||||
func Dev(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
goos: "linux",
|
||||
arch: "amd64",
|
||||
cc: cc,
|
||||
extra_flags: []string{"-race"}}.Run()
|
||||
}
|
||||
|
||||
// Cross compile the windows binary using mingw. Note that this does
|
||||
// not run the race detector because the ubuntu distribution of mingw
|
||||
// does not include tsan.
|
||||
func Windows() error {
|
||||
func Windows(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
extra_tags: " release yara ",
|
||||
goos: "windows",
|
||||
cc: cc,
|
||||
arch: "amd64"}.Run()
|
||||
}
|
||||
|
||||
func WindowsSumo() error {
|
||||
func WindowsSumo(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
extra_tags: " release yara ",
|
||||
goos: "windows",
|
||||
sumo: true,
|
||||
cc: cc,
|
||||
arch: "amd64"}.Run()
|
||||
}
|
||||
|
||||
// Windows client without a gui.
|
||||
func WindowsBare() error {
|
||||
func WindowsBare(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
extra_tags: " release yara disable_gui ",
|
||||
goos: "windows",
|
||||
disable_cgo: true,
|
||||
cc: cc,
|
||||
arch: "amd64"}.Run()
|
||||
}
|
||||
|
||||
func WindowsDev() error {
|
||||
func WindowsDev(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
goos: "windows",
|
||||
extra_tags: " release yara ",
|
||||
cc: cc,
|
||||
filename: "velociraptor",
|
||||
arch: "amd64"}.Run()
|
||||
}
|
||||
|
||||
// Windows binary with race detection. This requires building on
|
||||
// windows (ie not cross compiling). You will need to install gcc
|
||||
// first using https://jmeubank.github.io/tdm-gcc/ as well as the Go
|
||||
// windows distribution and optionally the windows node distribution
|
||||
// (for the GUI).
|
||||
func WindowsTest() error {
|
||||
// Special target to the CI pipeline which uses the locally installed
|
||||
// c compiler to build - this does not need to download the toolchain
|
||||
// because it is already present on the CI Windows machines.
|
||||
func WindowsTest(ctx context.Context) (err error) {
|
||||
cc, err := getToolchainCC(ctx, "windows/amd64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
goos: "windows",
|
||||
extra_tags: " release yara ",
|
||||
filename: "velociraptor",
|
||||
cc: cc,
|
||||
arch: "amd64",
|
||||
extra_flags: []string{"-race"}}.Run()
|
||||
}
|
||||
|
||||
func Windowsx86() error {
|
||||
func Windowsx86(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/386")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
extra_tags: " release yara ",
|
||||
cc: cc,
|
||||
goos: "windows",
|
||||
arch: "386"}.Run()
|
||||
}
|
||||
|
||||
func WindowsArm() error {
|
||||
func WindowsArm(ctx context.Context) error {
|
||||
cc, err := getToolchainCC(ctx, "windows/aarch64")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return Builder{
|
||||
extra_tags: " release yara ",
|
||||
goos: "windows",
|
||||
disable_cgo: true,
|
||||
arch: "arm64"}.Run()
|
||||
extra_tags: " release yara ",
|
||||
cc: cc,
|
||||
goos: "windows",
|
||||
arch: "arm64"}.Run()
|
||||
}
|
||||
|
||||
// Must be built on MacOS - no cross compiles
|
||||
func Darwin() error {
|
||||
return Builder{goos: "darwin",
|
||||
extra_tags: " release yara ",
|
||||
@@ -509,6 +564,16 @@ func Clean() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func CleanToolchains() error {
|
||||
toolchain_dir_abs, err := filepath.Abs(toolchain_dir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Printf("Removing toolchain directory %v\n",
|
||||
toolchain_dir_abs)
|
||||
return sh.Rm(toolchain_dir_abs)
|
||||
}
|
||||
|
||||
// Only build the assets without building the actual code.
|
||||
func Assets() error {
|
||||
err := build_gui_files()
|
||||
@@ -619,21 +684,11 @@ func ensure_assets() error {
|
||||
return UpdateDependentTools()
|
||||
}
|
||||
|
||||
func mingwxcompiler_exists() bool {
|
||||
err := sh.Run(mingw_xcompiler, "--version")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func musl_exists() bool {
|
||||
err := sh.Run(musl_xcompiler, "--version")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func mingwxcompiler32_exists() bool {
|
||||
err := sh.Run(mingw_xcompiler_32, "--version")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// Temporarily manipulate the generated file until
|
||||
// https://github.com/UnnoTed/fileb0x/pull/46 goes in.
|
||||
func replace_string_in_file(filename string, old string, new string) error {
|
||||
@@ -943,3 +998,38 @@ func Container() error {
|
||||
// Upload the image to the repository
|
||||
return sh.Run("docker", "push", image)
|
||||
}
|
||||
|
||||
func getToolchainCC(
|
||||
ctx context.Context, target string) (string, error) {
|
||||
toolchain_dir_abs, err := filepath.Abs(toolchain_dir)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
package_cache_dir_abs, err := filepath.Abs(package_cache_dir)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
debug := false
|
||||
|
||||
debug_str, pres := os.LookupEnv("DEBUG")
|
||||
if pres {
|
||||
debug_int, err := strconv.Atoi(debug_str)
|
||||
if err == nil && debug_int > 0 {
|
||||
debug = true
|
||||
}
|
||||
}
|
||||
|
||||
desc, err := build.InstallToolChain(ctx,
|
||||
build.ToolChainOptions{
|
||||
BaseDir: toolchain_dir_abs,
|
||||
PackageCacheDir: package_cache_dir_abs,
|
||||
Verbose: debug,
|
||||
})
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return desc.GCC(target)
|
||||
}
|
||||
|
||||
@@ -132,6 +132,11 @@ func (self *ClientInfoManager) UpdateStats(
|
||||
func(record *services.ClientInfo) (*services.ClientInfo, error) {
|
||||
var changed bool
|
||||
|
||||
// If there is no record, then create one.
|
||||
if record == nil {
|
||||
return nil, fmt.Errorf("Client %v: %w", client_id, utils.NotFoundError)
|
||||
}
|
||||
|
||||
if stats.Ping > 0 && stats.Ping > record.Ping {
|
||||
self.mutation_manager.AddPing(client_id, stats.Ping)
|
||||
record.Ping = stats.Ping
|
||||
@@ -474,6 +479,9 @@ func (self *ClientInfoManager) ProcessPing(
|
||||
}
|
||||
err := self.storage.Modify(ctx, self.config_obj, client_id,
|
||||
func(client_info *services.ClientInfo) (*services.ClientInfo, error) {
|
||||
if client_info == nil {
|
||||
return nil, fmt.Errorf("Client %v: %w", client_id, utils.NotFoundError)
|
||||
}
|
||||
client_info.Ping = uint64(value)
|
||||
return client_info, nil
|
||||
})
|
||||
@@ -492,6 +500,9 @@ func (self *ClientInfoManager) ProcessPing(
|
||||
}
|
||||
err := self.storage.Modify(ctx, self.config_obj, client_id,
|
||||
func(client_info *services.ClientInfo) (*services.ClientInfo, error) {
|
||||
if client_info == nil {
|
||||
return nil, utils.NotFoundError
|
||||
}
|
||||
client_info.IpAddress = value
|
||||
return client_info, nil
|
||||
})
|
||||
@@ -511,6 +522,10 @@ func (self *ClientInfoManager) ProcessPing(
|
||||
|
||||
err := self.storage.Modify(ctx, self.config_obj, client_id,
|
||||
func(client_info *services.ClientInfo) (*services.ClientInfo, error) {
|
||||
if client_info == nil {
|
||||
return nil, utils.NotFoundError
|
||||
}
|
||||
|
||||
client_info.LastHuntTimestamp = uint64(value)
|
||||
return client_info, nil
|
||||
})
|
||||
@@ -530,6 +545,10 @@ func (self *ClientInfoManager) ProcessPing(
|
||||
|
||||
err := self.storage.Modify(ctx, self.config_obj, client_id,
|
||||
func(client_info *services.ClientInfo) (*services.ClientInfo, error) {
|
||||
if client_info == nil {
|
||||
return nil, utils.NotFoundError
|
||||
}
|
||||
|
||||
client_info.LastEventTableVersion = uint64(value)
|
||||
return client_info, nil
|
||||
})
|
||||
|
||||
@@ -7,6 +7,7 @@ import (
|
||||
"strings"
|
||||
|
||||
api_proto "www.velocidex.com/golang/velociraptor/api/proto"
|
||||
"www.velocidex.com/golang/velociraptor/artifacts/assets"
|
||||
artifacts_proto "www.velocidex.com/golang/velociraptor/artifacts/proto"
|
||||
config_proto "www.velocidex.com/golang/velociraptor/config/proto"
|
||||
"www.velocidex.com/golang/velociraptor/paths/artifact_modes"
|
||||
@@ -195,7 +196,7 @@ func (self *ApiDescription) init() error {
|
||||
self.functions = make(map[string]CallDescriptor)
|
||||
self.plugins = make(map[string]CallDescriptor)
|
||||
|
||||
apis, err := utils.LoadApiDescription()
|
||||
apis, err := assets.LoadApiDescription()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+2
-1
@@ -8,6 +8,7 @@ import (
|
||||
"sync"
|
||||
|
||||
api_proto "www.velocidex.com/golang/velociraptor/api/proto"
|
||||
"www.velocidex.com/golang/velociraptor/artifacts/assets"
|
||||
artifacts_proto "www.velocidex.com/golang/velociraptor/artifacts/proto"
|
||||
config_proto "www.velocidex.com/golang/velociraptor/config/proto"
|
||||
"www.velocidex.com/golang/velociraptor/services"
|
||||
@@ -56,7 +57,7 @@ func loadApiDescriptions() []*api_proto.Completion {
|
||||
}
|
||||
|
||||
func_lookup = make(map[string]*api_proto.Completion)
|
||||
descriptions, err := utils.LoadApiDescription()
|
||||
descriptions, err := assets.LoadApiDescription()
|
||||
if err != nil || len(descriptions) == 0 {
|
||||
// The embedded reference document is compiled into every
|
||||
// build so this should never happen - but if it does we
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
package event_logs
|
||||
|
||||
import (
|
||||
"www.velocidex.com/golang/evtx"
|
||||
vql_subsystem "www.velocidex.com/golang/velociraptor/vql"
|
||||
"www.velocidex.com/golang/vfilter/types"
|
||||
"www.velocidex.com/golang/vfilter/utils"
|
||||
)
|
||||
|
||||
// The EVTX parser emits a HexInt type for integers to allow them to
|
||||
// be encoded as hex strings. But they may still need to be
|
||||
// comparable with an integer.
|
||||
type _HexIntEq struct{}
|
||||
|
||||
func (self _HexIntEq) Eq(scope types.Scope, a types.Any, b types.Any) bool {
|
||||
a_value, a_ok := a.(evtx.HexInt)
|
||||
if !a_ok {
|
||||
return false
|
||||
}
|
||||
|
||||
b_value, ok := utils.ToInt64(b)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
return b_value == int64(a_value)
|
||||
}
|
||||
|
||||
func (self _HexIntEq) Applicable(a types.Any, b types.Any) bool {
|
||||
_, a_ok := a.(evtx.HexInt)
|
||||
if !a_ok {
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
func init() {
|
||||
vql_subsystem.RegisterProtocol(&_HexIntEq{})
|
||||
}
|
||||
+3
-1
@@ -175,19 +175,21 @@ func (self *UnzipPlugin) unpackZip(
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer out_fd.Close()
|
||||
|
||||
in_fd, err := member.Open()
|
||||
if err != nil {
|
||||
out_fd.Close()
|
||||
return err
|
||||
}
|
||||
|
||||
n, err := utils.Copy(ctx, out_fd, in_fd)
|
||||
if err != nil {
|
||||
in_fd.Close()
|
||||
out_fd.Close()
|
||||
return err
|
||||
}
|
||||
in_fd.Close()
|
||||
out_fd.Close()
|
||||
|
||||
output := &UnzipResponse{
|
||||
OriginalPath: member.Name,
|
||||
|
||||
@@ -33,7 +33,7 @@ BOOL WINAPI certEnumSystemStoreCallback(const void* systemStore,
|
||||
LPCWSTR store_name = (LPCWSTR)systemStore;
|
||||
HCERTSTORE hCertStore = CertOpenSystemStoreW(0, store_name);
|
||||
if (hCertStore == NULL) {
|
||||
printf("Failed to open cert store %S with %ld\n",
|
||||
printf("Failed to open cert store %S with %d\n",
|
||||
(wchar_t *)systemStore, (uint32_t)GetLastError());
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
// +build windows
|
||||
// +build cgo
|
||||
// +build amd64 arm64
|
||||
|
||||
// References:
|
||||
// https://www.codeproject.com/Articles/10539/Making-WMI-Queries-In-C
|
||||
@@ -323,6 +325,6 @@ void Error(void *go_ctx, char *function, HRESULT hres) {
|
||||
// store the HRESULT - users can lookup the MSDN to figure out
|
||||
// what it means.
|
||||
char buf[512];
|
||||
snprintf(buf, 512, "%s: Error code %#lx", function, (uint32_t)hres);
|
||||
snprintf(buf, 512, "%s: Error code %#x", function, (uint32_t)hres);
|
||||
log_error(go_ctx, buf);
|
||||
}
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
//go:build windows && cgo
|
||||
// +build windows,cgo
|
||||
//go:build windows && cgo && (amd64 || arm64)
|
||||
// +build windows
|
||||
// +build cgo
|
||||
// +build amd64 arm64
|
||||
|
||||
/*
|
||||
Velociraptor - Dig Deeper
|
||||
|
||||
Reference in New Issue
Block a user