WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-20 16:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Initial attempts at cloning a symbol table

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 19:39:20 +01:00
committed by ikelos
parent fabb4f4924
commit 2748ce32d8
18 changed files with 69 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_sysctl.py
+7 -6
View File
@@ -2,16 +2,16 @@
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#
import logging
from typing import List, Iterator, Any
from typing import List
import volatility
from volatility.framework import exceptions, interfaces
from volatility.framework import renderers, constants, contexts
from volatility.framework import renderers, contexts
from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.framework.renderers import format_hints
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.mac import lsmod
vollog = logging.getLogger(__name__)
@@ -112,11 +112,12 @@ class Check_sysctl(plugins.PluginInterface):
break
def _generator(self):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
masked_darwin_symbols = mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'],
self.config['primary'])
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
kernel = contexts.Module(self._context, masked_darwin_symbols, self.config['primary'], 0)
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin'])
mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], masked_darwin_symbols)
handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods)