From d7f5a13c467878e7927fe55c8ba7b28a3fc56e77 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 3 Jan 2020 13:39:03 -0600 Subject: [PATCH] Mac - properly check for broken proc pointers --- volatility/framework/plugins/mac/tasks.py | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/volatility/framework/plugins/mac/tasks.py b/volatility/framework/plugins/mac/tasks.py index 57fb56bc4..ddfad8e52 100644 --- a/volatility/framework/plugins/mac/tasks.py +++ b/volatility/framework/plugins/mac/tasks.py @@ -5,7 +5,7 @@ import logging from typing import Callable, Dict, Iterable -from volatility.framework import interfaces, contexts +from volatility.framework import interfaces, contexts, exceptions from volatility.framework.automagic import mac from volatility.plugins.mac import pslist @@ -37,6 +37,8 @@ class Tasks(pslist.PsList): mac.MacUtilities.aslr_mask_symbol_table(context, darwin_symbols, layer_name) kernel = contexts.Module(context, darwin_symbols, layer_name, 0) + + kernel_as = context.layers[layer_name] queue_entry = kernel.object_from_symbol(symbol_name = "tasks") @@ -48,10 +50,13 @@ class Tasks(pslist.PsList): else: seen[task.vol.offset] = 1 - proc = task.bsd_info.dereference().cast("proc") - - if not context.layers[layer_name].is_valid(proc.vol.offset, proc.vol.size): - break - - if not filter_func(proc): + try: + proc = task.bsd_info.dereference().cast("proc") + except exceptions.PagedInvalidAddressException: + continue + + if not filter_func(proc) and kernel_as.is_valid(proc.vol.offset, proc.vol.size): yield proc + + +