From 545376d725958fbf34b9b2a051e61e4d5558d8dc Mon Sep 17 00:00:00 2001 From: atcuno Date: Thu, 17 Oct 2019 15:30:13 -0400 Subject: [PATCH] Mac - update trustedbsd --- volatility/framework/plugins/mac/trustedbsd.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility/framework/plugins/mac/trustedbsd.py b/volatility/framework/plugins/mac/trustedbsd.py index 2c51cce82..75672cfdd 100644 --- a/volatility/framework/plugins/mac/trustedbsd.py +++ b/volatility/framework/plugins/mac/trustedbsd.py @@ -17,8 +17,8 @@ from volatility.plugins.mac import lsmod vollog = logging.getLogger(__name__) -class Check_syscall(plugins.PluginInterface): - """Check system call table for hooks.""" +class trustedbsd(plugins.PluginInterface): + """Checks for malicious trustedbsd modules""" @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,7 +35,7 @@ class Check_syscall(plugins.PluginInterface): kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) - policy_list = kernel.object_from_symbol(symbol_name = "_mac_policy_list").cast("mac_policy_list") + policy_list = kernel.object_from_symbol(symbol_name = "mac_policy_list").cast("mac_policy_list") entries = kernel.object(object_type = "array", offset = policy_list.entries.dereference().vol.offset,