diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 2def7f15c..3fedc4135 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -257,6 +257,6 @@ class MacUtilities(object): vnode = f.f_fglob.fg_data.dereference().cast("vnode") path = vnode.full_path() else: - path = "<%s>" % ftype.replace("DTYPE_", "").lower() + path = "<{}>".format(ftype.replace("DTYPE_", "").lower()) yield f, path, fd_num diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 0d9d0a614..22104bcb7 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -137,7 +137,7 @@ class vnode(generic.GenericIntelProcess): def full_path(self): if self.v_flag & 0x000001 != 0 and self.v_mount != 0 and self.v_mount.mnt_flag & 0x00004000 != 0: - ret = "/" + ret = b"/" else: elements = [] files = [] @@ -152,8 +152,7 @@ class vnode(generic.GenericIntelProcess): if ret: ret = b"/" + ret - return ret - + return ret.decode("utf-8") class vm_map_entry(generic.GenericIntelProcess):