WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mac: Consolidate methods of listing processes

Browse Source 
This also updates all other plugins that rely on process listing
and theoretically allows them to choose their preferred method of
process listing.  At the moment, the default (first in the method list)
is chosen.  An optional pslist_method StringRequirement can be added to
each plugin, but using the list in the requirements could break if the
pslist plugin is too old (ie, using the list would happen before the
PluginRequirement gets checked).

If this is a feature we want, it should be easy to add to all but
netstat, which does not parameterize the list of processes.
This commit is contained in:
Mike Auty
2020-07-18 16:38:49 +01:00
committed by ikelos
parent 0ccb1f82e6
commit 7673dd8d2d
10 changed files with 214 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/lsof.py
+8 -7
View File
@@ -8,7 +8,7 @@ from volatility.framework import renderers
from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.interfaces import plugins
from volatility.plugins.mac import tasks
from volatility.plugins.mac import pslist
vollog = logging.getLogger(__name__)
@@ -23,7 +23,7 @@ class Lsof(plugins.PluginInterface):
description = 'Kernel Address Space',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac Kernel"),
requirements.PluginRequirement(name = 'tasks', plugin = tasks.Tasks, version = (1, 0, 0))
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0))
]
def _generator(self, tasks):
@@ -36,11 +36,12 @@ class Lsof(plugins.PluginInterface):
yield (0, (pid, fd, filepath))
def run(self):
filter_func = tasks.Tasks.create_pid_filter([self.config.get('pid', None)])
filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)])
list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
return renderers.TreeGrid([("PID", int), ("File Descriptor", int), ("File Path", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))