WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mac: Update all plugins to ModuleRequirement

Browse Source
This commit is contained in:
Mike Auty
2021-07-22 22:42:06 +01:00
parent 1480aca453
commit cd2f40bc34
22 changed files with 202 additions and 261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/mac/bash.py
+7 -9
View File
@@ -20,16 +20,13 @@ from volatility3.plugins.mac import pslist
class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
"""Recovers bash command history from memory."""
_required_framework_version = (1, 0, 0)
_required_framework_version = (1, 2, 0)
@classmethod
def get_requirements(cls):
return [
requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (2, 0, 0)),
requirements.ModuleRequirement(name = 'darwin', description = 'Kernel module for the OS'),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (3, 0, 0)),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
@@ -37,7 +34,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
]
def _generator(self, tasks):
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin"])
is_32bit = not symbols.symbol_table_is_64bit(self.context, self.config["darwin.symbol_table_name"])
if is_32bit:
pack_format = "I"
bash_json_file = "bash32"
@@ -96,7 +93,6 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
("Command", str)],
self._generator(
list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
@@ -105,7 +101,9 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
list_tasks = pslist.PsList.get_list_tasks(self.config.get('pslist_method', pslist.PsList.pslist_methods[0]))
for row in self._generator(
list_tasks(self.context, self.config['primary'], self.config['darwin'], filter_func = filter_func)):
list_tasks(self.context,
self.config['darwin'],
filter_func = filter_func)):
_depth, row_data = row
description = f"{row_data[0]} ({row_data[1]}): \"{row_data[3]}\""
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])