From 9eeac53d8d1c41a7c31b33e28f2bf2e5534586be Mon Sep 17 00:00:00 2001
From: Andrew Case <acase@volexity.com>
Date: Thu, 27 Dec 2018 13:15:21 -0600
Subject: [PATCH] add mac_check_syscall

---
 .../framework/plugins/mac/check_syscall.py    | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 volatility/framework/plugins/mac/check_syscall.py

diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py
new file mode 100644
index 000000000..5c0df7c42
--- /dev/null
+++ b/volatility/framework/plugins/mac/check_syscall.py
@@ -0,0 +1,62 @@
+import logging
+from typing import List
+
+from volatility.framework import exceptions, interfaces
+from volatility.framework import renderers, constants, contexts
+from volatility.framework.automagic import mac
+from volatility.framework.configuration import requirements
+from volatility.framework.interfaces import plugins
+from volatility.framework.renderers import format_hints
+
+vollog = logging.getLogger(__name__)
+
+class Check_syscall(plugins.PluginInterface):
+    """Check system call table for hooks"""
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.TranslationLayerRequirement(
+                name = 'primary', description = 'Kernel Address Space', architectures = ["Intel32", "Intel64"]),
+            requirements.SymbolRequirement(name = "darwin", description = "OSX Kernel")]
+
+    def _generator(self):
+        mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
+
+        kernel = contexts.Module(self._context, 
+                                 "kernel", 
+                                 self.config['primary'], 
+                                 0, 
+                                 self.config['darwin'], 
+                                 absolute_symbol_addresses = True)                
+
+        nsysent = kernel.object(symbol_name = "nsysent")
+        table = kernel.object(symbol_name = "sysent")
+
+        # smear help
+        num_ents = min(nsysent, table.count)
+        if num_ents > 1024:
+            num_ents = 1024
+
+        for (i, ent) in enumerate(table):
+            try:
+                call_addr = ent.sy_call.dereference().vol.offset
+            except exceptions.InvalidPagedAddressException:
+                continue
+
+            if not call_addr or call_addr == 0:
+                continue
+
+            symbols = list(self.context.symbol_space.get_symbols_by_location(call_addr))
+
+            if len(symbols) > 0:
+                sym_name = str(symbols[0].split(constants.BANG)[1]) if constants.BANG in symbols[0] else \
+                    str(symbols[0])
+            else:
+                sym_name = "UNKNOWN"
+
+            yield (0, (format_hints.Hex(table.vol.offset), "SysCall", i, format_hints.Hex(call_addr), sym_name))
+
+    def run(self):
+        return renderers.TreeGrid([("Table Address", format_hints.Hex), ("Table Name", str), ("Index", int),
+                                   ("Handler Address", format_hints.Hex), ("Handler Symbol", str)], self._generator())