diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 9c60a73ea..dde35b314 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -21,7 +21,7 @@ typically found in Mac's lsmod command. """ -from volatility.framework import renderers, interfaces +from volatility.framework import renderers, interfaces, contexts from volatility.framework.automagic import mac from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins @@ -43,12 +43,15 @@ class Lsmod(plugins.PluginInterface): @classmethod def list_modules(cls, context: interfaces.context.ContextInterface, layer_name: str, darwin_symbols: str): """Lists all the modules in the primary layer""" + mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) - aslr_shift = mac.MacUtilities.find_aslr(context, darwin_symbols, layer_name) + kernel = contexts.Module(context, + darwin_symbols, + layer_name, + 0, + absolute_symbol_addresses = True) - darwin = context.module(darwin_symbols, layer_name, aslr_shift) - - kmod_ptr = darwin.object(symbol_name = "kmod") + kmod_ptr = kernel.object(symbol_name = "kmod") # TODO - use smear-proof list walking API after dev release kmod = kmod_ptr.dereference().cast("kmod_info")