Merge pull request #1015 from Abyss-W4tcher/fix_mac_pslist

Fix mac pslist

volatility3/framework/symbols/mac/__init__.py

@@ -21,12 +21,14 @@ class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class("vm_map_object", extensions.vm_map_object)
         self.set_type_class("socket", extensions.socket)
         self.set_type_class("inpcb", extensions.inpcb)
-        self.set_type_class("queue_entry", extensions.queue_entry)
         self.set_type_class("ifnet", extensions.ifnet)
         self.set_type_class("sockaddr_dl", extensions.sockaddr_dl)
         self.set_type_class("sockaddr", extensions.sockaddr)
         self.set_type_class("sysctl_oid", extensions.sysctl_oid)
         self.set_type_class("kauth_scope", extensions.kauth_scope)
+        # https://developer.apple.com/documentation/kernel/queue_head_t
+        self.set_type_class("queue_entry", extensions.queue_entry)
+        self.optional_set_type_class("queue_head_t", extensions.queue_entry)
 
 
 class MacUtilities(interfaces.configuration.VersionableInterface):

volatility3/framework/symbols/mac/extensions/__init__.py

@@ -490,22 +490,24 @@ class queue_entry(objects.StructType):
 
         for attr in ["next", "prev"]:
             with contextlib.suppress(exceptions.InvalidAddressException):
-                n = getattr(self, attr).dereference().cast(type_name)
-
-                while n is not None and n.vol.offset != list_head:
-                    if n.vol.offset in seen:
+                queue_element = getattr(self, attr).dereference().cast(type_name)
+                while (
+                    queue_element is not None
+                    and queue_element.vol.offset != list_head.vol.offset
+                ):
+                    if queue_element.vol.offset in seen:
                         break
 
-                    yield n
+                    yield queue_element
 
-                    seen.add(n.vol.offset)
+                    seen.add(queue_element.vol.offset)
 
                     yielded = yielded + 1
                     if yielded == max_size:
                         return None
 
-                    n = (
-                        getattr(n.member(attr=member_name), attr)
+                    queue_element = (
+                        getattr(queue_element.member(attr=member_name), attr)
                         .dereference()
                         .cast(type_name)
                     )