WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 20:29:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mac - smear protection in network address enumeration

Browse Source
This commit is contained in:
Andrew Case
2019-09-26 22:08:47 -05:00
parent 3af593c16a
commit eeb04655e6
1 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/mac/extensions/__init__.py
+22 -5
View File
@@ -4,7 +4,7 @@
from typing import Generator, Iterable, Optional, Set, Tuple
from volatility.framework import constants, objects
from volatility.framework import constants, objects, renderers
from volatility.framework import exceptions, interfaces
from volatility.framework.objects import utility
from volatility.framework.renderers import conversion
@@ -347,19 +347,35 @@ class inpcb(objects.StructType):
return state
def get_ipv4_info(self):
lip = self.inp_dependladdr.inp46_local.ia46_addr4.s_addr
try:
lip = self.inp_dependladdr.inp46_local.ia46_addr4.s_addr
except exceptions.PagedInvalidAddressException:
return None
lport = self.inp_lport
rip = self.inp_dependfaddr.inp46_foreign.ia46_addr4.s_addr
try:
rip = self.inp_dependfaddr.inp46_foreign.ia46_addr4.s_addr
except exceptions.PagedInvalidAddressException:
return None
rport = self.inp_fport
return [lip, lport, rip, rport]
def get_ipv6_info(self):
lip = self.inp_dependladdr.inp6_local.member(attr = '__u6_addr').member(attr = '__u6_addr32')
try:
lip = self.inp_dependladdr.inp6_local.member(attr = '__u6_addr').member(attr = '__u6_addr32')
except exceptions.PagedInvalidAddressException:
return None
lport = self.inp_lport
rip = self.inp_dependfaddr.inp6_foreign.member(attr = '__u6_addr').member(attr = '__u6_addr32')
try:
rip = self.inp_dependfaddr.inp6_foreign.member(attr = '__u6_addr').member(attr = '__u6_addr32')
except exceptions.PagedInvalidAddressException:
return None
rport = self.inp_fport
return [lip, lport, rip, rport]
@@ -376,3 +392,4 @@ class queue_entry(objects.StructType):
while p is not None and p.vol.offset != list_head:
yield p
p = p.member(attr = member_name).prev.dereference().cast(type_name)