From 2fa4bf245d8bb58db24511c08f7233d177fc99be Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 23 Oct 2020 12:45:54 -0500 Subject: [PATCH] implement a smear proof mac lsmod --- volatility/framework/plugins/mac/lsmod.py | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 27439efdc..66dc82e5a 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -38,12 +38,29 @@ class Lsmod(plugins.PluginInterface): """ kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel_layer = context.layers[layer_name] + kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod") - # TODO - use smear-proof list walking API after dev release kmod = kmod_ptr.dereference().cast("kmod_info") - while kmod != 0: + + yield kmod + + kmod = kmod.next + + seen = set() + + while kmod != 0 and \ + kmod not in seen and \ + len(seen) < 1024: + + if not kernel_layer.is_valid(kmod.dereference().vol.offset, kmod.dereference().vol.size): + break + + seen.add(kmod) + yield kmod + kmod = kmod.next def _generator(self):