WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-23 01:54:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reformat with yapf and change filter to filt.

Browse Source
This commit is contained in:
Mike Auty
2018-12-19 19:43:56 +00:00
committed by ikelos
parent 989e8643e9
commit 39634893d6
2 changed files with 37 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/bash.py
+26 -33
View File
@@ -21,11 +21,11 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
@classmethod
def get_requirements(cls):
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin",
description = "mac Kernel")]
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "mac Kernel")
]
def _generator(self, tasks):
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"])
@@ -36,13 +36,10 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
pack_format = "Q"
bash_json_file = "bash64"
bash_table_name = BashIntermedSymbols.create(self.context,
self.config_path,
"linux",
bash_json_file)
bash_table_name = BashIntermedSymbols.create(self.context, self.config_path, "linux", bash_json_file)
ts_offset = self.context.symbol_space.get_type(
bash_table_name + constants.BANG + "hist_entry").relative_child_offset("timestamp")
ts_offset = self.context.symbol_space.get_type(bash_table_name + constants.BANG +
"hist_entry").relative_child_offset("timestamp")
for task in tasks:
task_name = utility.array_to_string(task.p_comm)
@@ -58,19 +55,24 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
bang_addrs = []
# find '#' values on the heap
for address in proc_layer.scan(self.context,
scanners.BytesScanner(b"#"),
sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)):
for address in proc_layer.scan(
self.context,
scanners.BytesScanner(b"#"),
sections = task.get_process_memory_sections(self.context, self.config['darwin'],
rw_no_file = True)):
bang_addrs.append(struct.pack(pack_format, address))
history_entries = []
for address, _ in proc_layer.scan(self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(self.context, self.config['darwin'], rw_no_file = True)):
hist = self.context.object(bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
for address, _ in proc_layer.scan(
self.context,
scanners.MultiStringScanner(bang_addrs),
sections = task.get_process_memory_sections(self.context, self.config['darwin'],
rw_no_file = True)):
hist = self.context.object(
bash_table_name + constants.BANG + "hist_entry",
offset = address - ts_offset,
layer_name = proc_layer_name)
if hist.is_valid():
history_entries.append(hist)
@@ -84,24 +86,15 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
plugin = pslist.PsList.list_tasks
return renderers.TreeGrid(
[("PID", int),
("Process", str),
("CommandTime", datetime.datetime),
("Command", str)],
self._generator(plugin(self.context,
self.config['primary'],
self.config['darwin'],
filter = filter)))
[("PID", int), ("Process", str), ("CommandTime", datetime.datetime), ("Command", str)],
self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filter)))
def generate_timeline(self):
filter = pslist.PsList.create_filter([self.config.get('pid', None)])
filt = pslist.PsList.create_filter([self.config.get('pid', None)])
plugin = pslist.PsList.list_tasks
for row in self._generator(plugin(self.context,
self.config['primary'],
self.config['darwin'],
filter = filter)):
for row in self._generator(plugin(self.context, self.config['primary'], self.config['darwin'], filter = filt)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])