Suggested changes from ikelos

volatility/framework/automagic/mac.py

@@ -4,7 +4,7 @@
 
 import logging
 import struct
-from typing import Optional
+from typing import Optional, Iterable
 
 from volatility.framework import interfaces, constants, layers, exceptions, objects
 from volatility.framework import symbols
@@ -257,3 +257,30 @@ class MacUtilities(object):
                     path = "<{}>".format(ftype.replace("DTYPE_", "").lower())
 
                 yield f, path, fd_num
+
+    def walk_tailq(queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
+        seen = set()
+
+        try:
+            current = queue.tqh_first
+        except exceptions.InvalidAddressException:
+            return
+
+        while current:
+            if current.vol.offset in seen:
+                break
+
+            seen.add(current.vol.offset)
+            
+            if len(seen) == max_elements:
+                break
+
+            yield current
+
+            try:
+                current = current.member(attr = next_member).tqe_next
+            except exceptions.InvalidAddressException:
+                break
+
+
+    

volatility/framework/plugins/mac/common.py

@@ -1,32 +0,0 @@
-# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
-# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0
-#
-
-from volatility.framework import interfaces
-from volatility.framework import exceptions
-
-def walk_tailq(queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096):
-    seen = set()
-
-    try:
-        current = queue.tqh_first
-    except exceptions.PagedInvalidAddressException:
-        return
-
-    while current:
-        if current.vol.offset in seen:
-            break
-
-        seen.add(current.vol.offset)
-        
-        if len(seen) == max_elements:
-            break
-
-        yield current
-
-        try:
-            current = current.member(attr = next_member).tqe_next
-        except exceptions.PagedInvalidAddressException:
-            return
-
-

volatility/framework/plugins/mac/ifconfig.py

@@ -1,5 +1,5 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
-# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
 from volatility.framework import exceptions, renderers, interfaces, contexts
@@ -9,13 +9,9 @@ from volatility.framework.interfaces import plugins
 from volatility.framework.objects import utility
 from volatility.framework.renderers import format_hints
 
-import volatility.plugins.mac.common as mac_common
-
 class Ifconfig(plugins.PluginInterface):
     """Lists loaded kernel modules"""
 
-    _version = (1, 0, 0)
-
     @classmethod
     def get_requirements(cls):
         return [
@@ -34,13 +30,10 @@ class Ifconfig(plugins.PluginInterface):
         except exceptions.SymbolError:
             list_head = kernel.object_from_symbol(symbol_name = "dlil_ifnet_head")
 
-        for ifnet in mac_common.walk_tailq(list_head, "if_link"):
+        for ifnet in mac.MacUtilities.walk_tailq(list_head, "if_link"):
             name = utility.pointer_to_string(ifnet.if_name, 32)
             unit = ifnet.if_unit
-            if ifnet.if_flags & 0x100 == 0x100: # IFF_PROMISC
-                prom = "True"
-            else:
-                prom = "False"
+            prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC
 
             sock_addr_dl = ifnet.sockaddr_dl()
             if sock_addr_dl is None:
@@ -48,13 +41,13 @@ class Ifconfig(plugins.PluginInterface):
             else:
                 mac_addr = str(sock_addr_dl)
 
-            for ifaddr in mac_common.walk_tailq(ifnet.if_addrhead, "ifa_link"):
+            for ifaddr in mac.MacUtilities.walk_tailq(ifnet.if_addrhead, "ifa_link"):
                 ip = ifaddr.ifa_addr.get_address()
 
                 yield (0, ("{0}{1}".format(name, unit), ip, mac_addr, prom))
 
     def run(self):
-        return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", str)], self._generator())
+        return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", bool)], self._generator())
 
 
 

volatility/framework/symbols/mac/extensions/__init__.py

@@ -88,7 +88,7 @@ class fileglob(objects.StructType):
     def get_fg_type(self):
         ret = "INVALID"
         if self.has_member("fg_type"):
-            ret = self.member(attr = 'fg_type')
+            ret = self.fg_type
         elif self.fg_ops != 0:
             try:
                 ret = self.fg_ops.fo_type
@@ -383,7 +383,7 @@ class inpcb(objects.StructType):
 
 class queue_entry(objects.StructType):
 
-    def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> interfaces.objects.ObjectInterface:
+    def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]:
         yielded = 0
 
         try:
@@ -412,7 +412,7 @@ class ifnet(objects.StructType):
     def sockaddr_dl(self):
         if self.has_member("if_lladdr"):
             try:
-                val = self.member(attr = "if_lladdr").ifa_addr.dereference().cast("sockaddr_dl")
+                val = self.if_lladdr.ifa_addr.dereference().cast("sockaddr_dl")
             except exceptions.PagedInvalidAddressException:
                 val = None
         else: