diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 2883ee2a9..f51f3d956 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -28,11 +28,13 @@ class Check_syscall(plugins.PluginInterface): requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] - def _generator(self, mods: Iterator[Any]): + def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) nsysent = kernel.object_from_symbol(symbol_name = "nsysent") @@ -59,8 +61,4 @@ class Check_syscall(plugins.PluginInterface): def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], - self._generator( - lsmod.Lsmod.list_modules(self.context, self.config['primary'], - self.config['darwin']))) - - + self._generator()) diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index d6fd52cdf..00df15a07 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -111,11 +111,13 @@ class Check_sysctl(plugins.PluginInterface): except exceptions.InvalidAddressException: break - def _generator(self, mods: Iterator[Any]): + def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) sysctl_list = kernel.object_from_symbol(symbol_name = "sysctl__children") @@ -133,6 +135,4 @@ class Check_sysctl(plugins.PluginInterface): def run(self): return renderers.TreeGrid([("Name", str), ("Number", int), ("Perms", str), ("Handler Address", format_hints.Hex), ("Value", str), ("Handler Module", str), ("Handler Symbol", str)], - self._generator( - lsmod.Lsmod.list_modules(self.context, self.config['primary'], - self.config['darwin']))) + self._generator()) diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index d9cb7868c..f6d2528f8 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -29,11 +29,13 @@ class Check_trap_table(plugins.PluginInterface): requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] - def _generator(self, mods: Iterator[Any]): + def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) table = kernel.object_from_symbol(symbol_name = "mach_trap_table") @@ -54,11 +56,7 @@ class Check_trap_table(plugins.PluginInterface): def run(self): return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int), ("Handler Address", format_hints.Hex), ("Handler Module", str), ("Handler Symbol", str)], - self._generator( - lsmod.Lsmod.list_modules(self.context, self.config['primary'], - self.config['darwin']))) - - + self._generator()) diff --git a/volatility/framework/plugins/mac/timers.py b/volatility/framework/plugins/mac/timers.py index 8ad2c04c0..8982ebef4 100644 --- a/volatility/framework/plugins/mac/timers.py +++ b/volatility/framework/plugins/mac/timers.py @@ -30,11 +30,13 @@ class Timers(plugins.PluginInterface): requirements.PluginRequirement(name = 'lsmod', plugin = lsmod.Lsmod, version = (1, 0, 0)) ] - def _generator(self, mods: Iterator[Any]): + def _generator(self): mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary']) kernel = contexts.Module(self.context, self.config['darwin'], self.config['primary'], 0) + mods = lsmod.Lsmod.list_modules(self.context, self.config['primary'], self.config['darwin']) + handlers = mac.MacUtilities.generate_kernel_handler_info(self.context, self.config['primary'], kernel, mods) real_ncpus = kernel.object_from_symbol(symbol_name = "real_ncpus") @@ -75,7 +77,4 @@ class Timers(plugins.PluginInterface): def run(self): return renderers.TreeGrid([("Function", format_hints.Hex), ("Param 0", format_hints.Hex), ("Param 1", format_hints.Hex), ("Deadline", int), ("Entry Time", int), ("Module", str), ("Symbol", str)], - self._generator( - lsmod.Lsmod.list_modules(self.context, self.config['primary'], - self.config['darwin']))) - + self._generator())