From 76a1bb972c8ea87f322149e25b89c5d161e7166a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 16 Sep 2019 12:04:50 +0100 Subject: [PATCH] Restore the mac queue_event class override. For some reason, this went missing in commit a3caf39097984a8180c08d5dd50d49208e2ec917, which looks to have been an error. --- .../framework/symbols/mac/extensions/__init__.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 68a5fe594..8a0edb7b8 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -79,6 +79,7 @@ class proc(generic.GenericIntelProcess): yield (start, end - start) + class fileglob(objects.StructType): def get_fg_type(self): @@ -360,3 +361,16 @@ class inpcb(objects.StructType): rport = self.inp_fport return [lip, lport, rip, rport] + + +class queue_entry(objects.StructType): + + def walk_list(self, list_head, member_name, type_name): + n = self.next.dereference().cast(type_name) + while n is not None and n.vol.offset != list_head: + yield n + n = n.member(attr = member_name).next.dereference().cast(type_name) + p = self.prev.dereference().cast(type_name) + while p is not None and p.vol.offset != list_head: + yield p + p = p.member(attr = member_name).prev.dereference().cast(type_name)