From bc6e63cb1962cef19049ffc02cfbfd3fc44ff2d8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 28 May 2019 19:59:14 -0500 Subject: [PATCH] Mac - skip invaid kaslr shift results --- volatility/framework/automagic/mac.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index debbdfae6..3eb7ba439 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -95,6 +95,10 @@ class MacintelStacker(interfaces.automagic.StackerLayerInterface): compare_banner_offset = banner_offset, progress_callback = progress_callback) + if kaslr_shift == 0: + vollog.debug("Invalid kalsr_shift found at offset: {}".format(banner_offset)) + continue + bootpml4_addr = MacUtilities.virtual_to_physical_address( table.get_symbol("BootPML4").address + kaslr_shift)