WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 09:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Mac: Ensure queues error check all entries, not just the first.

Browse Source
This commit is contained in:
Mike Auty
2020-01-28 01:37:21 +00:00
committed by ikelos
parent beed68b8bf
commit f111e9e051
1 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/symbols/mac/extensions/__init__.py
+16 -16
View File
@@ -4,7 +4,7 @@
from typing import Generator, Iterable, Optional, Set, Tuple
from volatility.framework import constants, objects, renderers
from volatility.framework import constants, objects
from volatility.framework import exceptions, interfaces
from volatility.framework.objects import utility
from volatility.framework.renderers import conversion
@@ -392,25 +392,25 @@ class queue_entry(objects.StructType):
try:
n = self.next.dereference().cast(type_name)
except exceptions.PagedInvalidAddressException:
return
while n is not None and n.vol.offset != list_head:
yield n
yielded = yielded + 1
if yielded == max_size:
return
n = n.member(attr = member_name).next.dereference().cast(type_name)
while n is not None and n.vol.offset != list_head:
yield n
yielded = yielded + 1
if yielded == max_size:
return
n = n.member(attr = member_name).next.dereference().cast(type_name)
except exceptions.InvalidAddressException:
pass
try:
p = self.prev.dereference().cast(type_name)
except exceptions.PagedInvalidAddressException:
while p is not None and p.vol.offset != list_head:
yield p
yielded = yielded + 1
if yielded == max_size:
return
p = p.member(attr = member_name).prev.dereference().cast(type_name)
except exceptions.InvalidAddressException:
return
while p is not None and p.vol.offset != list_head:
yield p
yielded = yielded + 1
if yielded == max_size:
return
p = p.member(attr = member_name).prev.dereference().cast(type_name)
class ifnet(objects.StructType):