From 43ae29181579c0854eb6c1efe9c7497e4275dbe2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 18 Jul 2020 16:12:25 +0100 Subject: [PATCH] Plugins: Add back in the checks because the filter might trip them --- volatility/framework/plugins/mac/pslist.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 1865529af..14f768c9e 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -109,6 +109,8 @@ class PsList(interfaces.plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel_layer = context.layers[layer_name] + proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first seen = {} # type: Dict[int, int] @@ -119,7 +121,7 @@ class PsList(interfaces.plugins.PluginInterface): else: seen[proc.vol.offset] = 1 - if not filter_func(proc): + if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc): yield proc try: @@ -148,6 +150,8 @@ class PsList(interfaces.plugins.PluginInterface): kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + kernel_layer = context.layers[layer_name] + queue_entry = kernel.object_from_symbol(symbol_name = "tasks") seen = {} # type: Dict[int, int] @@ -163,7 +167,7 @@ class PsList(interfaces.plugins.PluginInterface): except exceptions.PagedInvalidAddressException: continue - if not filter_func(proc): + if kernel_layer.is_valid(proc.vol.offset, proc.vol.size) and not filter_func(proc): yield proc @classmethod