From c00b820f7480657a8d15602bd870846cf6a19ecf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 27 Sep 2019 11:21:49 +0100 Subject: [PATCH] Fix up recent Mac PagedInvalidAddress additions. --- volatility/framework/automagic/mac.py | 6 +++--- volatility/framework/plugins/mac/pslist.py | 4 ++-- .../framework/symbols/mac/extensions/__init__.py | 15 +++++++-------- 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 49413414d..ea1bf29d5 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -220,12 +220,12 @@ class MacUtilities(object): try: num_fds = task.p_fd.fd_lastfile - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: num_fds = 1024 - + try: nfiles = task.p_fd.fd_nfiles - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: nfiles = 1024 if nfiles > num_fds: diff --git a/volatility/framework/plugins/mac/pslist.py b/volatility/framework/plugins/mac/pslist.py index 1fff11bda..531c7744b 100644 --- a/volatility/framework/plugins/mac/pslist.py +++ b/volatility/framework/plugins/mac/pslist.py @@ -74,7 +74,7 @@ class PsList(interfaces.plugins.PluginInterface): mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) kernel = contexts.Module(context, darwin_symbols, layer_name, 0) - + kernel_as = context.layers[layer_name] proc = kernel.object_from_symbol(symbol_name = "allproc").lh_first @@ -92,7 +92,7 @@ class PsList(interfaces.plugins.PluginInterface): try: proc = proc.p_list.le_next.dereference() - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: break def run(self): diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index a03bd5ae9..1a21aec66 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -349,16 +349,16 @@ class inpcb(objects.StructType): def get_ipv4_info(self): try: lip = self.inp_dependladdr.inp46_local.ia46_addr4.s_addr - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: return None lport = self.inp_lport try: rip = self.inp_dependfaddr.inp46_foreign.ia46_addr4.s_addr - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: return None - + rport = self.inp_fport return [lip, lport, rip, rport] @@ -366,16 +366,16 @@ class inpcb(objects.StructType): def get_ipv6_info(self): try: lip = self.inp_dependladdr.inp6_local.member(attr = '__u6_addr').member(attr = '__u6_addr32') - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: return None - + lport = self.inp_lport try: rip = self.inp_dependfaddr.inp6_foreign.member(attr = '__u6_addr').member(attr = '__u6_addr32') - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: return None - + rport = self.inp_fport return [lip, lport, rip, rport] @@ -392,4 +392,3 @@ class queue_entry(objects.StructType): while p is not None and p.vol.offset != list_head: yield p p = p.member(attr = member_name).prev.dereference().cast(type_name) -