diff --git a/volatility/framework/plugins/mac/bash.py b/volatility/framework/plugins/mac/bash.py index 83d8280ab..1979db141 100644 --- a/volatility/framework/plugins/mac/bash.py +++ b/volatility/framework/plugins/mac/bash.py @@ -21,11 +21,11 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def get_requirements(cls): - return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', - architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "darwin", - description = "mac Kernel")] + return [ + requirements.TranslationLayerRequirement( + name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), + requirements.SymbolRequirement(name = "darwin", description = "mac Kernel") + ] def _generator(self, tasks): is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"]) @@ -36,13 +36,10 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): pack_format = "Q" bash_json_file = "bash64" - bash_table_name = BashIntermedSymbols.create(self.context, - self.config_path, - "linux", - bash_json_file) + bash_table_name = BashIntermedSymbols.create(self.context, self.config_path, "linux", bash_json_file) - ts_offset = self.context.symbol_space.get_type( - bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp") + ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG + + "hist_entry").relative_child_offset("timestamp") for task in tasks: task_name = utility.array_to_string(task.p_comm) @@ -58,19 +55,24 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): bang_addrs = [] # find '#' values on the heap - for address in proc_layer.scan(self.context, - scanners.BytesScanner(b"#"), - sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)): + for address in proc_layer.scan( + self.context, + scanners.BytesScanner(b"#"), + sections = task.get_process_memory_sections(self.context, self.config['darwin'], + rw_no_file = True)): bang_addrs.append(struct.pack(pack_format, address)) history_entries = [] - for address, _ in proc_layer.scan(self.context, - scanners.MultiStringScanner(bang_addrs), - sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)): - hist = self.context.object(bash_table_name + constants.BANG + "hist_entry", - offset = address - ts_offset, - layer_name = proc_layer_name) + for address, _ in proc_layer.scan( + self.context, + scanners.MultiStringScanner(bang_addrs), + sections = task.get_process_memory_sections(self.context, self.config['darwin'], + rw_no_file = True)): + hist = self.context.object( + bash_table_name + constants.BANG + "hist_entry", + offset = address - ts_offset, + layer_name = proc_layer_name) if hist.is_valid(): history_entries.append(hist) @@ -84,24 +86,15 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): plugin = pslist.PsList.list_tasks return renderers.TreeGrid( - [("PID", int), - ("Process", str), - ("CommandTime", datetime.datetime), - ("Command", str)], - self._generator(plugin(self.context, - self.config['primary'], - self.config['darwin'], - filter = filter))) + [("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)], + self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter))) def generate_timeline(self): - filter = pslist.PsList.create_filter([self.config.get('pid', None)]) + filt = pslist.PsList.create_filter([self.config.get('pid', None)]) plugin = pslist.PsList.list_tasks - for row in self._generator(plugin(self.context, - self.config['primary'], - self.config['darwin'], - filter = filter)): + for row in self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)): _depth, row_data = row description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3]) yield (description, timeliner.TimeLinerType.CREATED, row_data[2]) diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 428dd0902..738591203 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -12,6 +12,7 @@ from volatility.plugins.mac import lsmod vollog = logging.getLogger(__name__) + class Check_syscall(plugins.PluginInterface): """Check system call table for hooks""" @@ -22,19 +23,18 @@ class Check_syscall(plugins.PluginInterface): name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]), requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel") ] - + def _generator(self, mods: Iterator[Any]): aslr_shift = mac.MacUtilities.find_aslr(self.context, self.config['darwin'], self.config['primary']) darwin = self.context.module(self.config['darwin'], self.config['primary'], aslr_shift) - mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'], - aslr_shift) + mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'], aslr_shift) policy_list = darwin.object(symbol_name = "_mac_policy_list").cast("mac_policy_list") - + entries = darwin.object( type_name = "array", - offset = policy_list.entries.dereference().vol.offset, + offset = policy_list.entries.dereference().vol.offset, subtype = darwin.get_type('mac_policy_list_element'), count = policy_list.staticmax + 1) @@ -51,7 +51,7 @@ class Check_syscall(plugins.PluginInterface): continue try: - ent_name = utility.pointer_to_string(mpc.mpc_name, 255) + ent_name = utility.pointer_to_string(mpc.mpc_name, 255) except exceptions.PagedInvalidAddressException: ent_name = "N/A" @@ -72,12 +72,12 @@ class Check_syscall(plugins.PluginInterface): symbol_module = utility.array_to_string(found_module) else: symbol_module = "UNKNOWN" - + yield (0, (check, ent_name, symbol_module, format_hints.Hex(call_addr))) def run(self): return renderers.TreeGrid([("Member", str), ("Policy Name", str), ("Handler Module", str), - ("Handler Address", format_hints.Hex)], - self._generator( - lsmod.Lsmod.list_modules(self.context, self.config['primary'], - self.config['darwin']))) + ("Handler Address", format_hints.Hex)], + self._generator( + lsmod.Lsmod.list_modules(self.context, self.config['primary'], + self.config['darwin'])))