WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update code for better variable names and minor version bump

Browse Source
This commit is contained in:
Andrew Case
2020-09-16 17:35:49 +01:00
committed by ikelos
parent afe39eee1b
commit e58e55b433
2 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/pslist.py
+10 -9
View File
@@ -26,6 +26,7 @@ class PsList(interfaces.plugins.PluginInterface):
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols"),
requirements.VersionRequirement(name = 'macutils', component = mac.MacUtilities, version = (1, 1, 0)),
requirements.ChoiceRequirement(name = 'pslist_method',
description = 'Method to determine for processes',
choices = cls.pslist_methods,
@@ -209,9 +210,9 @@ class PsList(interfaces.plugins.PluginInterface):
subtype = kernel.get_type("sesshashhead"))
for proc_list in proc_array:
for p in mac.MacUtilities.walk_list_head(proc_list, "s_hash"):
if p.s_leader.is_readable() and not filter_func(p.s_leader):
yield p.s_leader
for proc in mac.MacUtilities.walk_list_head(proc_list, "s_hash"):
if proc.s_leader.is_readable() and not filter_func(proc.s_leader):
yield proc.s_leader
@classmethod
def list_tasks_process_group(cls,
@@ -245,9 +246,9 @@ class PsList(interfaces.plugins.PluginInterface):
for proc_list in proc_array:
for pgrp in mac.MacUtilities.walk_list_head(proc_list, "pg_hash"):
for p in mac.MacUtilities.walk_list_head(pgrp.pg_members, "p_pglist"):
if not filter_func(p):
yield p
for proc in mac.MacUtilities.walk_list_head(pgrp.pg_members, "p_pglist"):
if not filter_func(proc):
yield proc
@classmethod
def list_tasks_pid_hash_table(cls,
@@ -280,9 +281,9 @@ class PsList(interfaces.plugins.PluginInterface):
subtype = kernel.get_type("pidhashhead"))
for proc_list in proc_array:
for p in mac.MacUtilities.walk_list_head(proc_list, "p_hash"):
if not filter_func(p):
yield p
for proc in mac.MacUtilities.walk_list_head(proc_list, "p_hash"):
if not filter_func(proc):
yield proc
def run(self):
return renderers.TreeGrid([("PID", int), ("PPID", int), ("COMM", str)], self._generator())
volatility/framework/symbols/mac/__init__.py
+6 -1
View File
@@ -31,7 +31,12 @@ class MacKernelIntermedSymbols(intermed.IntermediateSymbolTable):
class MacUtilities(interfaces.configuration.VersionableInterface):
"""Class with multiple useful mac functions."""
_version = (1, 0, 0)
"""
Version History:
1.1.0 -> added walk_list_head API
"""
_version = (1, 1, 0)
@classmethod
def mask_mods_list(cls, context: interfaces.context.ContextInterface, layer_name: str,