diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index ea1bf29d5..c698a189d 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -4,7 +4,7 @@ import logging import struct -from typing import Optional +from typing import Optional, Iterable from volatility.framework import interfaces, constants, layers, exceptions, objects from volatility.framework import symbols @@ -257,3 +257,30 @@ class MacUtilities(object): path = "<{}>".format(ftype.replace("DTYPE_", "").lower()) yield f, path, fd_num + + def walk_tailq(queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: + seen = set() + + try: + current = queue.tqh_first + except exceptions.InvalidAddressException: + return + + while current: + if current.vol.offset in seen: + break + + seen.add(current.vol.offset) + + if len(seen) == max_elements: + break + + yield current + + try: + current = current.member(attr = next_member).tqe_next + except exceptions.InvalidAddressException: + break + + + diff --git a/volatility/framework/plugins/mac/common.py b/volatility/framework/plugins/mac/common.py deleted file mode 100644 index 0481bc47a..000000000 --- a/volatility/framework/plugins/mac/common.py +++ /dev/null @@ -1,32 +0,0 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 -# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 -# - -from volatility.framework import interfaces -from volatility.framework import exceptions - -def walk_tailq(queue: interfaces.objects.ObjectInterface, next_member: str, max_elements: int = 4096): - seen = set() - - try: - current = queue.tqh_first - except exceptions.PagedInvalidAddressException: - return - - while current: - if current.vol.offset in seen: - break - - seen.add(current.vol.offset) - - if len(seen) == max_elements: - break - - yield current - - try: - current = current.member(attr = next_member).tqe_next - except exceptions.PagedInvalidAddressException: - return - - diff --git a/volatility/framework/plugins/mac/ifconfig.py b/volatility/framework/plugins/mac/ifconfig.py index 2a541a146..6447adaf6 100644 --- a/volatility/framework/plugins/mac/ifconfig.py +++ b/volatility/framework/plugins/mac/ifconfig.py @@ -1,5 +1,5 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 -# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # from volatility.framework import exceptions, renderers, interfaces, contexts @@ -9,13 +9,9 @@ from volatility.framework.interfaces import plugins from volatility.framework.objects import utility from volatility.framework.renderers import format_hints -import volatility.plugins.mac.common as mac_common - class Ifconfig(plugins.PluginInterface): """Lists loaded kernel modules""" - _version = (1, 0, 0) - @classmethod def get_requirements(cls): return [ @@ -34,13 +30,10 @@ class Ifconfig(plugins.PluginInterface): except exceptions.SymbolError: list_head = kernel.object_from_symbol(symbol_name = "dlil_ifnet_head") - for ifnet in mac_common.walk_tailq(list_head, "if_link"): + for ifnet in mac.MacUtilities.walk_tailq(list_head, "if_link"): name = utility.pointer_to_string(ifnet.if_name, 32) unit = ifnet.if_unit - if ifnet.if_flags & 0x100 == 0x100: # IFF_PROMISC - prom = "True" - else: - prom = "False" + prom = ifnet.if_flags & 0x100 == 0x100 # IFF_PROMISC sock_addr_dl = ifnet.sockaddr_dl() if sock_addr_dl is None: @@ -48,13 +41,13 @@ class Ifconfig(plugins.PluginInterface): else: mac_addr = str(sock_addr_dl) - for ifaddr in mac_common.walk_tailq(ifnet.if_addrhead, "ifa_link"): + for ifaddr in mac.MacUtilities.walk_tailq(ifnet.if_addrhead, "ifa_link"): ip = ifaddr.ifa_addr.get_address() yield (0, ("{0}{1}".format(name, unit), ip, mac_addr, prom)) def run(self): - return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", str)], self._generator()) + return renderers.TreeGrid([("Interface", str), ("IP Address", str), ("Mac Address", str), ("Promiscuous", bool)], self._generator()) diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index fe40fa7ba..a71f4f0ba 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -88,7 +88,7 @@ class fileglob(objects.StructType): def get_fg_type(self): ret = "INVALID" if self.has_member("fg_type"): - ret = self.member(attr = 'fg_type') + ret = self.fg_type elif self.fg_ops != 0: try: ret = self.fg_ops.fo_type @@ -383,7 +383,7 @@ class inpcb(objects.StructType): class queue_entry(objects.StructType): - def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> interfaces.objects.ObjectInterface: + def walk_list(self, list_head: interfaces.objects.ObjectInterface, member_name: str, type_name: str, max_size: int = 4096) -> Iterable[interfaces.objects.ObjectInterface]: yielded = 0 try: @@ -412,7 +412,7 @@ class ifnet(objects.StructType): def sockaddr_dl(self): if self.has_member("if_lladdr"): try: - val = self.member(attr = "if_lladdr").ifa_addr.dereference().cast("sockaddr_dl") + val = self.if_lladdr.ifa_addr.dereference().cast("sockaddr_dl") except exceptions.PagedInvalidAddressException: val = None else: