From c9adc6a0fa90f104d2d5da86e1c78649e3d93138 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 26 Feb 2019 13:05:28 -0600 Subject: [PATCH] remove usage of old string methods --- volatility/framework/automagic/mac.py | 2 +- volatility/framework/symbols/mac/extensions/__init__.py | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility/framework/automagic/mac.py b/volatility/framework/automagic/mac.py index 2def7f15c..3fedc4135 100644 --- a/volatility/framework/automagic/mac.py +++ b/volatility/framework/automagic/mac.py @@ -257,6 +257,6 @@ class MacUtilities(object): vnode = f.f_fglob.fg_data.dereference().cast("vnode") path = vnode.full_path() else: - path = "<%s>" % ftype.replace("DTYPE_", "").lower() + path = "<{}>".format(ftype.replace("DTYPE_", "").lower()) yield f, path, fd_num diff --git a/volatility/framework/symbols/mac/extensions/__init__.py b/volatility/framework/symbols/mac/extensions/__init__.py index 0d9d0a614..22104bcb7 100644 --- a/volatility/framework/symbols/mac/extensions/__init__.py +++ b/volatility/framework/symbols/mac/extensions/__init__.py @@ -137,7 +137,7 @@ class vnode(generic.GenericIntelProcess): def full_path(self): if self.v_flag & 0x000001 != 0 and self.v_mount != 0 and self.v_mount.mnt_flag & 0x00004000 != 0: - ret = "/" + ret = b"/" else: elements = [] files = [] @@ -152,8 +152,7 @@ class vnode(generic.GenericIntelProcess): if ret: ret = b"/" + ret - return ret - + return ret.decode("utf-8") class vm_map_entry(generic.GenericIntelProcess):