WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-28 20:44:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor symbol to object_type (so it doesn't shadow builtin type).

Browse Source
This commit is contained in:
Mike Auty
2019-08-14 20:50:42 +01:00
committed by ikelos
parent 18283ab410
commit be27aab8ae
27 changed files with 89 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_syscall.py
+2 -2
View File
@@ -27,8 +27,8 @@ class Check_syscall(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
nsysent = kernel.object_from_symbol(symbol = "nsysent")
table = kernel.object_from_symbol(symbol = "sysent")
nsysent = kernel.object_from_symbol(object_type = "nsysent")
table = kernel.object_from_symbol(object_type = "sysent")
# smear help
num_ents = min(nsysent, table.count)
volatility/framework/plugins/mac/check_sysctl.py
+2 -2
View File
@@ -36,7 +36,7 @@ class Check_sysctl(plugins.PluginInterface):
var_name = known_sysctls[name]
try:
var_array = kernel.object(symbol = var_name)
var_array = kernel.object(object_type = var_name)
except exceptions.SymbolError:
var_array = None
@@ -110,7 +110,7 @@ class Check_sysctl(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
sysctl_list = kernel.object_from_symbol(symbol = "sysctl__children")
sysctl_list = kernel.object_from_symbol(object_type = "sysctl__children")
for sysctl, name, val in self._process_sysctl_list(kernel, sysctl_list):
check_addr = sysctl.oid_handler
volatility/framework/plugins/mac/check_trap_table.py
+1 -1
View File
@@ -27,7 +27,7 @@ class Check_trap_table(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
table = kernel.object_from_symbol(symbol = "mach_trap_table")
table = kernel.object_from_symbol(object_type = "mach_trap_table")
for i, ent in enumerate(table):
try:
volatility/framework/plugins/mac/lsmod.py
+1 -1
View File
@@ -47,7 +47,7 @@ class Lsmod(plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
kmod_ptr = kernel.object_from_symbol(symbol = "kmod")
kmod_ptr = kernel.object_from_symbol(object_type = "kmod")
# TODO - use smear-proof list walking API after dev release
kmod = kmod_ptr.dereference().cast("kmod_info")
volatility/framework/plugins/mac/pslist.py
+1 -1
View File
@@ -80,7 +80,7 @@ class PsList(interfaces_plugins.PluginInterface):
kernel = contexts.Module(context, darwin_symbols, layer_name, 0)
proc = kernel.object_from_symbol(symbol = "allproc").lh_first
proc = kernel.object_from_symbol(object_type = "allproc").lh_first
seen = {}
while proc is not None and proc.vol.offset != 0:
volatility/framework/plugins/mac/trustedbsd.py
+2 -2
View File
@@ -49,10 +49,10 @@ class Check_syscall(plugins.PluginInterface):
kernel = contexts.Module(self._context, self.config['darwin'], self.config['primary'], 0)
policy_list = kernel.object_from_symbol(symbol = "_mac_policy_list").cast("mac_policy_list")
policy_list = kernel.object_from_symbol(object_type = "_mac_policy_list").cast("mac_policy_list")
entries = kernel.object(
symbol = "array",
object_type = "array",
offset = policy_list.entries.dereference().vol.offset,
subtype = kernel.get_type('mac_policy_list_element'),
count = policy_list.staticmax + 1)