WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Add back in the checks because the filter might trip them

Browse Source
This commit is contained in:
Mike Auty
2020-07-18 16:38:49 +01:00
committed by ikelos
parent 73ad2bcd4e
commit 43ae291815
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/pslist.py
+6 -2
View File
@@ -109,6 +109,8 @@ class PsList(interfaces.plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel_layer = context.layers[layer_name]
proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first
seen = {} # type: Dict[int, int]
@@ -119,7 +121,7 @@ class PsList(interfaces.plugins.PluginInterface):
else:
seen[proc.vol.offset] = 1
if not filter_func(proc):
if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc):
yield proc
try:
@@ -148,6 +150,8 @@ class PsList(interfaces.plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kernel_layer = context.layers[layer_name]
queue_entry = kernel.object_from_symbol(symbol_name = "tasks")
seen = {} # type: Dict[int, int]
@@ -163,7 +167,7 @@ class PsList(interfaces.plugins.PluginInterface):
except exceptions.PagedInvalidAddressException:
continue
if not filter_func(proc):
if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc):
yield proc
@classmethod