diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 0f17df864..43e77b62a 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -219,6 +219,21 @@ class MacUtilities(object): context: interfaces.context.ContextInterface, task: interfaces.objects.ObjectInterface): + """Creates a generator for the file descriptors of a process + + Args: + symbol_table_name: The name of the symbol table associated with the process + context: + task: The process structure to enumerate file descriptors from + + Return: + A 3 element tuple is yielded for each file descriptor: + 1) The file's object + 2) The path referenced by the descriptor. + The path is either empty, the full path of the file in the file system, or the formatted name for sockets, pipes, etc. + 3) The file descriptor number + """ + try: num_fds = task.p_fd.fd_lastfile except exceptions.InvalidAddressException: diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index ae2cee69a..a31dafc74 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -36,6 +36,15 @@ class Netstat(plugins.PluginInterface): filter_func: Callable[[int], bool] = lambda _: False) -> \ Iterable[interfaces.objects.ObjectInterface]: + """ + Returns the open socket descriptors of a process + + Return values: + A tuple of 3 elements: + 1) The name of the process that opened the socket + 2) The process ID of the processed that opened the socket + 3) The address of the associated socket structure + """ for task in tasks.Tasks.list_tasks(context, layer_name, darwin_symbols,