From 19d39e53ff19eb7617cd626810c9876b3697e926 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 18 Dec 2018 13:00:24 -0600 Subject: [PATCH] add docstrings for malfind --- volatility/framework/symbols/mac/extensions/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index acf1ae357..adb5b5257 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -137,6 +137,7 @@ class vnode(generic.GenericIntelProcess): class vm_map_entry(generic.GenericIntelProcess): def is_suspicious(self, context, config_prefix): + """Flags memory regions that are mapped rwx or that map an executable not back from a file on disk""" ret = False perms = self.get_perms()