diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index b48349bed..0f17df864 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -214,7 +214,8 @@ class MacUtilities(object): return addr - 0xffffff8000000000 @classmethod - def files_descriptors_for_process(cls, config: interfaces.configuration.HierarchicalDict, + def files_descriptors_for_process(cls, + symbol_table_name : str, context: interfaces.context.ContextInterface, task: interfaces.objects.ObjectInterface): @@ -234,7 +235,7 @@ class MacUtilities(object): if num_fds > 4096: num_fds = 1024 - file_type = config["darwin"] + constants.BANG + 'fileproc' + file_type = symbol_table_name + constants.BANG + 'fileproc' try: table_addr = task.p_fd.fd_ofiles.dereference() @@ -250,11 +251,11 @@ class MacUtilities(object): except exceptions.InvalidAddressException: continue - if ftype == 'DTYPE_VNODE': + if ftype == 'VNODE': vnode = f.f_fglob.fg_data.dereference().cast("vnode") path = vnode.full_path() - else: - path = "<{}>".format(ftype.replace("DTYPE_", "").lower()) + elif ftype: + path = "<{}>".format(ftype.lower()) yield f, path, fd_num diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 5b980566d..565773de7 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -30,7 +30,7 @@ class lsof(plugins.PluginInterface): for task in tasks: pid = task.p_pid - for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.config, self.context, task): + for _, filepath, fd in mac.MacUtilities.files_descriptors_for_process(self.config['darwin'], self.context, task): if filepath and len(filepath) > 0: yield (0, (pid, fd, filepath)) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 63bc41796..ae2cee69a 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -28,18 +28,29 @@ class Netstat(plugins.PluginInterface): requirements.PluginRequirement(name = 'tasks', plugin = tasks.Tasks, version = (1, 0, 0)) ] - def _generator(self, tasks): - for task in tasks: + @classmethod + def list_sockets(cls, + context: interfaces.context.ContextInterface, + layer_name: str, + darwin_symbols: str, + filter_func: Callable[[int], bool] = lambda _: False) -> \ + Iterable[interfaces.objects.ObjectInterface]: + + for task in tasks.Tasks.list_tasks(context, + layer_name, + darwin_symbols, + filter_func): + task_name = utility.array_to_string(task.p_comm) pid = task.p_pid - for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(self.config, self.context, task): + for filp, _, _ in mac.MacUtilities.files_descriptors_for_process(darwin_symbols, context, task): try: ftype = filp.f_fglob.get_fg_type() except exceptions.InvalidAddressException: continue - if ftype != 'DTYPE_SOCKET': + if ftype != 'SOCKET': continue try: @@ -47,39 +58,44 @@ class Netstat(plugins.PluginInterface): except exceptions.InvalidAddressException: continue - family = socket.get_family() + yield task_name, pid, socket - if family == 1: - try: - upcb = socket.so_pcb.dereference().cast("unpcb") - path = utility.array_to_string(upcb.unp_addr.sun_path) - except exceptions.InvalidAddressException: - continue + def _generator(self): + filter_func = tasks.Tasks.create_pid_filter([self.config.get('pid', None)]) + + for task_name, pid, socket in self.list_sockets(self.context, + self.config['primary'], + self.config['darwin'], + filter_func = filter_func): - yield (0, (format_hints.Hex(socket.vol.offset), "UNIX", path, 0, "", 0, "", + family = socket.get_family() + + if family == 1: + try: + upcb = socket.so_pcb.dereference().cast("unpcb") + path = utility.array_to_string(upcb.unp_addr.sun_path) + except exceptions.InvalidAddressException: + continue + + yield (0, (format_hints.Hex(socket.vol.offset), "UNIX", path, 0, "", 0, "", + "{}/{:d}".format(task_name, pid))) + + elif family in [2, 30]: + state = socket.get_state() + proto = socket.get_protocol_as_string() + + vals = socket.get_converted_connection_info() + + if vals: + (lip, lport, rip, rport) = vals + + yield (0, (format_hints.Hex(socket.vol.offset), proto, lip, lport, rip, rport, state, "{}/{:d}".format(task_name, pid))) - elif family in [2, 30]: - state = socket.get_state() - proto = socket.get_protocol_as_string() - - vals = socket.get_converted_connection_info() - - if vals: - (lip, lport, rip, rport) = vals - - yield (0, (format_hints.Hex(socket.vol.offset), proto, lip, lport, rip, rport, state, - "{}/{:d}".format(task_name, pid))) - def run(self): # mac.MacUtilities.aslr_mask_symbol_table(self.config, self.context) - filter_func = tasks.Tasks.create_pid_filter([self.config.get('pid', None)]) - return renderers.TreeGrid([("Offset", format_hints.Hex), ("Proto", str), ("Local IP", str), ("Local Port", int), ("Remote IP", str), ("Remote Port", int), ("State", str), ("Process", str)], - self._generator( - tasks.Tasks.list_tasks(self.context, - self.config['primary'], - self.config['darwin'], - filter_func = filter_func))) + self._generator()) + diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 9f115fc65..a4ee78f62 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -86,7 +86,8 @@ class proc(generic.GenericIntelProcess): class fileglob(objects.StructType): def get_fg_type(self): - ret = "INVALID" + ret = None + if self.has_member("fg_type"): ret = self.fg_type elif self.fg_ops != 0: @@ -95,8 +96,10 @@ class fileglob(objects.StructType): except exceptions.InvalidAddressException: pass - return ret.description + if ret: + ret = str(ret.description).replace("DTYPE_", "") + return ret class vm_map_object(objects.StructType):