From 12e470ab55aa7cc76bfaa709810a9538e9fdcf90 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 18 Dec 2018 10:16:13 -0600 Subject: [PATCH] add malfind plugin part 2 (extension update) --- .../framework/symbols/mac/extensions/__init__.py | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index d8c8107b2..f0dca9417 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -114,7 +114,6 @@ class vnode(generic.GenericIntelProcess): return if vname: - print("adding: {}".format(utility.array_to_string(vname, 255))) ret.append(utility.pointer_to_string(vname)) if int(vnodeobj.v_flag) & 0x000001 != 0 and int(vnodeobj.v_mount) != 0: @@ -144,6 +143,18 @@ class vnode(generic.GenericIntelProcess): class vm_map_entry(generic.GenericIntelProcess): + def is_suspicious(self, context, config_prefix): + ret = False + + perms = self.get_perms() + + if perms == "rwx": + ret = True + + elif perms == "r-x" and self.get_path(context, config_prefix) == "": + ret = True + + return ret def get_perms(self): permask = "rwx" @@ -215,7 +226,6 @@ class vm_map_entry(generic.GenericIntelProcess): if self.is_sub_map == 1: return "sub_map" - print("Getting vnode object") # based on find_vnode_object vnode_object = self.get_object().get_map_object()