More minor cleanup.

This commit is contained in:
Mike Auty
2018-12-19 00:54:51 +00:00
committed by ikelos
parent 3a2d3c604f
commit 1322ebd44f
4 changed files with 21 additions and 18 deletions
+1 -1
View File
@@ -2,7 +2,7 @@
typically found in Mac's lsmod command.
"""
from volatility.framework import renderers, constants, interfaces
from volatility.framework import renderers, interfaces
from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
+3 -3
View File
@@ -25,7 +25,7 @@ class Malfind(interfaces_plugins.PluginInterface):
"""
proc_layer_name = task.add_process_layer()
if proc_layer_name == None:
if proc_layer_name is None:
return
proc_layer = self.context.memory[proc_layer_name]
@@ -57,11 +57,11 @@ class Malfind(interfaces_plugins.PluginInterface):
vma.get_perms(), format_hints.HexBytes(data), disasm))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex),
("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces_renderers.Disassembly)],
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
+5 -10
View File
@@ -2,14 +2,9 @@
typically found in Linux's /proc file system.
"""
import datetime
import struct
from operator import attrgetter
from volatility.framework import exceptions, constants, renderers, symbols
from volatility.framework import exceptions, renderers
from volatility.framework.interfaces import plugins
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import pslist
@@ -26,7 +21,7 @@ class Psaux(plugins.PluginInterface):
task_name = utility.array_to_string(task.p_comm)
proc_layer_name = task.add_process_layer()
if proc_layer_name == None:
if proc_layer_name is None:
print("no proc layer")
continue
@@ -34,7 +29,7 @@ class Psaux(plugins.PluginInterface):
argsstart = task.user_stack - task.p_argslen
if (not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0):
if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0:
print("bad check")
continue
@@ -85,10 +80,10 @@ class Psaux(plugins.PluginInterface):
yield (0, (task.p_pid, task_name, task.p_argc, args_str))
def run(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))
+12 -4
View File
@@ -23,13 +23,21 @@ class PsList(interfaces_plugins.PluginInterface):
@classmethod
def create_filter(cls, pid_list: typing.List[int] = None) -> typing.Callable[[int], bool]:
filter = lambda _: False
def nullfilter():
return False
filt = nullfilter
# FIXME: mypy #4973 or #2608
pid_list = pid_list or []
filter_list = [x for x in pid_list if x is not None]
if filter_list:
filter = lambda x: x not in filter_list
return filter
def list_filter(x):
return x not in filter_list
filt = list_filter
return filt
def _generator(self):
for task in self.list_tasks(
@@ -56,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface):
proc = darwin.object(symbol_name = "allproc").lh_first
seen = {}
while proc != None and proc.vol.offset != 0:
while proc is not None and proc.vol.offset != 0:
if proc.vol.offset in seen:
vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).")
break