switch mac_pslist to absolute_symbol_addresses interface

This commit is contained in:
Andrew Case
2018-12-27 22:43:19 +00:00
committed by ikelos
parent b77d638ead
commit 92adf4ffd0
+11 -5
View File
@@ -22,7 +22,7 @@ import logging
from typing import Callable, Iterable, List
import volatility.framework.interfaces.plugins as interfaces_plugins
from volatility.framework import renderers, interfaces
from volatility.framework import renderers, interfaces, contexts
from volatility.framework.automagic import mac
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
@@ -74,14 +74,20 @@ class PsList(interfaces_plugins.PluginInterface):
def list_tasks(cls,
context: interfaces.context.ContextInterface,
layer_name: str,
mac_symbols: str,
darwin_symbols: str,
filter: Callable[[int], bool] = lambda _: False) -> \
Iterable[interfaces.objects.ObjectInterface]:
"""Lists all the tasks in the primary layer"""
aslr_shift = mac.MacUtilities.find_aslr(context, mac_symbols, layer_name)
darwin = context.module(mac_symbols, layer_name, aslr_shift)
proc = darwin.object(symbol_name = "allproc").lh_first
mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name)
kernel = contexts.Module(context,
darwin_symbols,
layer_name,
0,
absolute_symbol_addresses = True)
proc = kernel.object(symbol_name = "allproc").lh_first
seen = {}
while proc is not None and proc.vol.offset != 0: