diff --git a/volatility3/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py index b0d75b93b..1a955a379 100644 --- a/volatility3/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -4,12 +4,15 @@ from typing import Generator, Iterable, Optional, Set, Tuple +import logging + from volatility3.framework import constants, objects, renderers from volatility3.framework import exceptions, interfaces from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion from volatility3.framework.symbols import generic +vollog = logging.getLogger(__name__) class proc(generic.GenericIntelProcess): @@ -51,7 +54,15 @@ class proc(generic.GenericIntelProcess): seen: Set[int] = set() for i in range(task.map.hdr.nentries): - if not current_map or current_map.vol.offset in seen: + if (not current_map or + current_map.vol.offset in seen or + not self._context.layers[task.vol.native_layer_name].is_valid(current_map.dereference().vol.offset, current_map.dereference().vol.size)): + + vollog.log(constants.LOGLEVEL_VVV, "Breaking process maps iteration due to invalid state.") + break + + # ZP_POISON value used to catch programming errors + if current_map.links.start == 0xdeadbeefdeadbeef or current_map.links.end == 0xdeadbeefdeadbeef: break yield current_map @@ -210,10 +221,21 @@ class vm_map_entry(objects.StructType): ret = node elif node: path = [] - while node: - v_name = utility.pointer_to_string(node.v_name, 255) + seen: Set[int] = set() + while node and node.vol.offset not in seen: + try: + v_name = utility.pointer_to_string(node.v_name, 255) + except exceptions.InvalidAddressException: + break + path.append(v_name) + if len(path) > 1024: + break + + seen.add(node.vol.offset) + node = node.v_parent + path.reverse() ret = "/" + "/".join(path) else: @@ -243,9 +265,10 @@ class vm_map_entry(objects.StructType): # based on find_vnode_object vnode_object = self.get_object().get_map_object() + if vnode_object == 0: + return None found_end = False - while not found_end: try: tmp_vnode_object = vnode_object.shadow.dereference() @@ -257,8 +280,15 @@ class vm_map_entry(objects.StructType): else: vnode_object = tmp_vnode_object + if vnode_object.vol.offset == 0: + return None + try: - ops = vnode_object.pager.mo_pager_ops.dereference() + pager = vnode_object.pager + if pager == 0: + return None + + ops = pager.mo_pager_ops.dereference() except exceptions.InvalidAddressException: return None