Add in minor changes and remove the duplicate plugins for mac.

volatility/framework/plugins/mac/psaux.py

@@ -29,10 +29,10 @@ class Psaux(plugins.PluginInterface):
 
             argsstart = task.user_stack - task.p_argslen
 
-            if (not proc_layer.is_valid(argsstart) or not task.p_argslen or not task.p_argc):
+            if not proc_layer.is_valid(argsstart) or task.p_argslen == 0 or task.p_argc == 0:
                 continue
 
-                # Add one because the first two are usually duplicates
+            # Add one because the first two are usually duplicates
             argc = task.p_argc + 1
 
             # smear protection
@@ -50,13 +50,13 @@ class Psaux(plugins.PluginInterface):
                     break
 
                 idx = arg.find(b'\x00')
-                if idx > -1:
+                if idx != -1:
                     arg = arg[:idx]
 
                 argsstart += len(str(arg)) + 1
 
                 # deal with the stupid alignment (leading nulls) and arg duplication
-                if not args:
+                if len(args) == 0:
                     while argsstart < task.user_stack:
                         try:
                             check = proc_layer.read(argsstart, 1)
@@ -74,17 +74,17 @@ class Psaux(plugins.PluginInterface):
                 elif arg != args[0]:
                     args.append(arg)
 
-                argc -= 1
+                argc = argc - 1
 
             args_str = " ".join([s.decode("utf-8") for s in args])
 
             yield (0, (task.p_pid, task_name, task.p_argc, args_str))
 
     def run(self) -> renderers.TreeGrid:
-        filter = pslist.PsList.create_filter([self.config.get('pid', None)])
+        filt = pslist.PsList.create_filter([self.config.get('pid', None)])
 
         plugin = pslist.PsList.list_tasks
 
         return renderers.TreeGrid(
             [("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
-            self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
+            self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)))

volatility/framework/plugins/mac/pslist.py

@@ -1,5 +1,5 @@
 import logging
-from typing import Callable, Generator, List
+from typing import Callable, Iterable, List
 
 import volatility.framework.interfaces.plugins as interfaces_plugins
 from volatility.framework import renderers, interfaces
@@ -23,13 +23,21 @@ class PsList(interfaces_plugins.PluginInterface):
 
     @classmethod
     def create_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]:
-        filter = lambda _: False
+
+        def nullfilter():
+            return False
+
+        filt = nullfilter
         # FIXME: mypy #4973 or #2608
         pid_list = pid_list or []
         filter_list = [x for x in pid_list if x is not None]
         if filter_list:
-            filter = lambda x: x not in filter_list
-        return filter
+
+            def list_filter(x):
+                return x not in filter_list
+
+            filt = list_filter
+        return filt
 
     def _generator(self):
         for task in self.list_tasks(
@@ -47,8 +55,8 @@ class PsList(interfaces_plugins.PluginInterface):
                    context: interfaces.context.ContextInterface,
                    layer_name: str,
                    mac_symbols: str,
-                   filter: Callable[[int], bool] = lambda _: False) \
-            -> Generator[interfaces.objects.ObjectInterface, None, None]:
+                   filter: Callable[[int], bool] = lambda _: False) -> \
+            Iterable[interfaces.objects.ObjectInterface]:
         """Lists all the tasks in the primary layer"""
 
         aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name)
@@ -56,7 +64,7 @@ class PsList(interfaces_plugins.PluginInterface):
         proc = darwin.object(symbol_name = "allproc").lh_first
 
         seen = {}
-        while proc != None and proc.vol.offset != 0:
+        while proc is not None and proc.vol.offset != 0:
             if proc.vol.offset in seen:
                 vollog.log(logging.INFO, "Recursive process list detected (a result of non-atomic acquisition).")
                 break