From 29cc435b5e8eeed6181269cb52b07cc662e8e933 Mon Sep 17 00:00:00 2001
From: Andrew Case <acase@volexity.com>
Date: Fri, 3 Jan 2020 16:21:45 -0600
Subject: [PATCH] update sysctl v2

---
 .../framework/plugins/mac/check_sysctl.py     |  2 +-
 volatility/framework/symbols/mac/__init__.py  |  1 +
 .../symbols/mac/extensions/__init__.py        | 63 +++++++++++++++----
 3 files changed, 53 insertions(+), 13 deletions(-)

diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py
index 768e33b85..f678d2029 100644
--- a/volatility/framework/plugins/mac/check_sysctl.py
+++ b/volatility/framework/plugins/mac/check_sysctl.py
@@ -40,7 +40,7 @@ class Check_sysctl(plugins.PluginInterface):
             var_name = known_sysctls[name]
 
             try:
-                var_array = kernel.object(object_type = var_name)
+                var_array = kernel.object_from_symbol(symbol_name = var_name)
             except exceptions.SymbolError:
                 var_array = None
 
diff --git a/volatility/framework/symbols/mac/__init__.py b/volatility/framework/symbols/mac/__init__.py
index 570a131b4..1842d7251 100644
--- a/volatility/framework/symbols/mac/__init__.py
+++ b/volatility/framework/symbols/mac/__init__.py
@@ -24,3 +24,4 @@ class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class('ifnet', extensions.ifnet)
         self.set_type_class('sockaddr_dl', extensions.sockaddr_dl)
         self.set_type_class('sockaddr', extensions.sockaddr)
+        self.set_type_class('sysctl_oid', extensions.sysctl_oid)
diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py
index cd266848f..a82e0756c 100644
--- a/volatility/framework/symbols/mac/extensions/__init__.py
+++ b/volatility/framework/symbols/mac/extensions/__init__.py
@@ -4,7 +4,7 @@
 
 from typing import Generator, Iterable, Optional, Set, Tuple
 
-from volatility.framework import constants, objects
+from volatility.framework import constants, objects, renderers
 from volatility.framework import exceptions, interfaces
 from volatility.framework.objects import utility
 from volatility.framework.renderers import conversion
@@ -390,17 +390,27 @@ class queue_entry(objects.StructType):
                   max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
         yielded = 0
 
-        for attr in ['next', 'prev']:
-            try:
-                n = getattr(self, attr).dereference().cast(type_name)
-                while n is not None and n.vol.offset != list_head:
-                    yield n
-                    yielded = yielded + 1
-                    if yielded == max_size:
-                        return
-                    n = getattr(n.member(attr = member_name), attr).dereference().cast(type_name)
-            except exceptions.InvalidAddressException:
-                pass
+        try:
+            n = self.next.dereference().cast(type_name)
+        except exceptions.PagedInvalidAddressException:
+            return
+        while n is not None and n.vol.offset != list_head:
+            yield n
+            yielded = yielded + 1
+            if yielded == max_size:
+                return
+            n = n.member(attr = member_name).next.dereference().cast(type_name)
+
+        try:
+            p = self.prev.dereference().cast(type_name)
+        except exceptions.PagedInvalidAddressException:
+            return
+        while p is not None and p.vol.offset != list_head:
+            yield p
+            yielded = yielded + 1
+            if yielded == max_size:
+                return
+            p = p.member(attr = member_name).prev.dereference().cast(type_name)
 
 
 class ifnet(objects.StructType):
@@ -464,3 +474,32 @@ class sockaddr(objects.StructType):
             ip = str(addr_dl)
 
         return ip
+
+
+class sysctl_oid(objects.StructType):
+
+    def get_perms(self):
+        ret = ""
+
+        checks = [0x80000000, 0x40000000, 0x00800000]
+        perms = ["R", "W", "L"]
+
+        for (i, c) in enumerate(checks):
+            if c & self.oid_kind:
+                ret = ret + perms[i]
+            else:
+                ret = ret + "-"
+
+        return ret
+
+    def get_ctltype(self):
+        types = {1: 'CTLTYPE_NODE', 2: 'CTLTYPE_INT', 3: 'CTLTYPE_STRING', 4: 'CTLTYPE_QUAD', 5: 'CTLTYPE_OPAQUE'}
+
+        ctltype = self.oid_kind & 0xf
+
+        if 0 < ctltype < 6:
+            ret = types[ctltype]
+        else:
+            ret = ""
+
+        return ret