diff --git a/volatility/framework/plugins/mac/check_syscall.py b/volatility/framework/plugins/mac/check_syscall.py index 3a6077b8f..03085ead6 100644 --- a/volatility/framework/plugins/mac/check_syscall.py +++ b/volatility/framework/plugins/mac/check_syscall.py @@ -1,3 +1,6 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# import logging from typing import List diff --git a/volatility/framework/plugins/mac/check_sysctl.py b/volatility/framework/plugins/mac/check_sysctl.py index 396466525..6e1dcb80c 100644 --- a/volatility/framework/plugins/mac/check_sysctl.py +++ b/volatility/framework/plugins/mac/check_sysctl.py @@ -1,3 +1,6 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# import logging from typing import List diff --git a/volatility/framework/plugins/mac/check_trap_table.py b/volatility/framework/plugins/mac/check_trap_table.py index 99114de48..e8ab1fcf8 100644 --- a/volatility/framework/plugins/mac/check_trap_table.py +++ b/volatility/framework/plugins/mac/check_trap_table.py @@ -1,3 +1,7 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# + import logging from typing import List diff --git a/volatility/framework/plugins/mac/lsof.py b/volatility/framework/plugins/mac/lsof.py index 289a901d9..1973851c0 100644 --- a/volatility/framework/plugins/mac/lsof.py +++ b/volatility/framework/plugins/mac/lsof.py @@ -1,11 +1,13 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# + import logging -from volatility.framework import exceptions, renderers +from volatility.framework import renderers from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins -from volatility.framework.objects import utility -from volatility.framework.renderers import format_hints from volatility.plugins.mac import pslist vollog = logging.getLogger(__name__) diff --git a/volatility/framework/plugins/mac/netstat.py b/volatility/framework/plugins/mac/netstat.py index 8d5eab438..d01aaa9fa 100644 --- a/volatility/framework/plugins/mac/netstat.py +++ b/volatility/framework/plugins/mac/netstat.py @@ -1,3 +1,7 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 +# + import logging from volatility.framework import exceptions, renderers diff --git a/volatility/framework/plugins/mac/proc_maps.py b/volatility/framework/plugins/mac/proc_maps.py index 25f88c0b7..11e0ab2f0 100644 --- a/volatility/framework/plugins/mac/proc_maps.py +++ b/volatility/framework/plugins/mac/proc_maps.py @@ -1,32 +1,16 @@ -# This file was contributed to the Volatility Framework Version 3. -# Copyright (C) 2018 Volatility Foundation. -# -# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors -# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation, -# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION -# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED -# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS -# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED -# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE -# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE -# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A -# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE: -# https://www.volatilityfoundation.org/license/vcpl_v1.0 -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the -# specific language governing rights and limitations under the License. +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 # -import volatility.framework.interfaces.plugins as interfaces_plugins -import volatility.framework.interfaces.renderers as interfaces_renderers import volatility.plugins.mac.pslist as pslist -from volatility.framework import constants + +import volatility.framework.interfaces.plugins as interfaces_plugins from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.objects import utility from volatility.framework.renderers import format_hints + class Maps(interfaces_plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code""" @@ -48,8 +32,8 @@ class Maps(interfaces_plugins.PluginInterface): if path == "": path = vma.get_special_path() - yield (0, (process_pid, process_name, format_hints.Hex(vma.links.start), format_hints.Hex(vma.links.end), - vma.get_perms(), path)) + yield (0, (process_pid, process_name, format_hints.Hex(vma.links.start), + format_hints.Hex(vma.links.end), vma.get_perms(), path)) def run(self): filter_func = pslist.PsList.create_pid_filter([self.config.get('pid', None)]) diff --git a/volatility/framework/plugins/mac/tasks.py b/volatility/framework/plugins/mac/tasks.py index cf5c3aeb3..4620ce125 100644 --- a/volatility/framework/plugins/mac/tasks.py +++ b/volatility/framework/plugins/mac/tasks.py @@ -1,36 +1,17 @@ -# This file was contributed to the Volatility Framework Version 3. -# Copyright (C) 2018 Volatility Foundation. -# -# THE LICENSED WORK IS PROVIDED UNDER THE TERMS OF THE Volatility Contributors -# Public License V1.0("LICENSE") AS FIRST COMPLETED BY: Volatility Foundation, -# Inc. ANY USE, PUBLIC DISPLAY, PUBLIC PERFORMANCE, REPRODUCTION OR DISTRIBUTION -# OF, OR PREPARATION OF SUBSEQUENT WORKS, DERIVATIVE WORKS OR DERIVED WORKS BASED -# ON, THE LICENSED WORK CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS LICENSE AND ITS -# TERMS, WHETHER OR NOT SUCH RECIPIENT READS THE TERMS OF THE LICENSE. "LICENSED -# WORK,” “RECIPIENT" AND “DISTRIBUTOR" ARE DEFINED IN THE LICENSE. A COPY OF THE -# LICENSE IS LOCATED IN THE TEXT FILE ENTITLED "LICENSE.txt" ACCOMPANYING THE -# CONTENTS OF THIS FILE. IF A COPY OF THE LICENSE DOES NOT ACCOMPANY THIS FILE, A -# COPY OF THE LICENSE MAY ALSO BE OBTAINED AT THE FOLLOWING WEB SITE: -# https://www.volatilityfoundation.org/license/vcpl_v1.0 -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the -# specific language governing rights and limitations under the License. +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl_v1.0 # import logging -from typing import Callable, Iterable, List +from typing import Callable, Iterable -import volatility.framework.interfaces.plugins as interfaces_plugins -from volatility.framework import renderers, interfaces, contexts, constants +from volatility.framework import interfaces, contexts from volatility.framework.automagic import mac -from volatility.framework.configuration import requirements -from volatility.framework.objects import utility - from volatility.plugins.mac import pslist vollog = logging.getLogger(__name__) + class Tasks(pslist.PsList): """Lists the processes present in a particular mac memory image""" @@ -58,11 +39,9 @@ class Tasks(pslist.PsList): seen[task.vol.offset] = 1 proc = task.bsd_info.dereference().cast("proc") - + if not context.layers[layer_name].is_valid(proc.vol.offset): break if not filter_func(proc): yield proc - -