Mathieu Tarral

Results 166 issues of Mathieu Tarral

After #95 I was looking if it was possible to replace `checksec.sh`, considering that we are integrating `lief` as a dependency anyway. Also with #94, the output is not reliable....

Checksec's JSON should contain a key which is the filepath: `~/Projets/oswatcher/tools/checksec/checksec --output=json --file=/usr/bin/xz | jq .` ~~~JSON { "/usr/bin/xz": { "relro": "full", "canary": "yes", "nx": "yes", "pie": "yes", "rpath": "no",...

Upstream
checksec

When commiting a file with an apostrophe `’` as part of the filename, `git ls-files` will return it as an escaped character: ![Capture d’écran de 2020-02-06 00-19-58](https://user-images.githubusercontent.com/964610/73892169-72590980-4876-11ea-9bca-64c56a835a4f.png) This breaks our...

bug

Recently a dependency problem made the GitFilesystemHook to fail in Github Actions: https://github.com/Wenzel/oswatcher/pull/67/checks?check_run_id=493909976#step:18:6 This wasn't catched because oswatcher doesn't see the hooks failing and returns 0.

bug

At the moment, we use Volatility3 in the forensic hooks, but there is not package available on PIP yet. When it will be available, add it to the requirements.

enhancement
Upstream
Volatility

While listing the entries on a directory on a Windows XP image, libguestfs mysteriously failed: We need to report this bug upstream. Workaround: https://github.com/Wenzel/oswatcher/blob/f95e14aa20f1e3bdb4301a1e929c9554f2faf2b3/hooks/filesystem.py#L141

After setting up the CI in Github Actions, I managed to install libguestfs via PIP, using tarballs available from libguestfs website: http://download.libguestfs.org/python/ We should document this method also

I started the integration of `kconfig-hardened-check`. Unfortunately, the JSON output produced is not valid... https://github.com/a13xp0p0v/kconfig-hardened-check/issues/20#issuecomment-508997348 So we will have to wait for an update. cc @nettrino

This PR Dockerize the kAFL fuzzer. It's based on https://github.com/Wenzel/kAFL/tree/docker_workspace, updated with the new Ansible deployment.