diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 68a5fe594..8a0edb7b8 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -79,6 +79,7 @@ class proc(generic.GenericIntelProcess): yield (start, end - start) + class fileglob(objects.StructType): def get_fg_type(self): @@ -360,3 +361,16 @@ class inpcb(objects.StructType): rport = self.inp_fport return [lip, lport, rip, rport] + + +class queue_entry(objects.StructType): + + def walk_list(self, list_head, member_name, type_name): + n = self.next.dereference().cast(type_name) + while n is not None and n.vol.offset != list_head: + yield n + n = n.member(attr = member_name).next.dereference().cast(type_name) + p = self.prev.dereference().cast(type_name) + while p is not None and p.vol.offset != list_head: + yield p + p = p.member(attr = member_name).prev.dereference().cast(type_name)