From f13f5e438d06d0b22281e9750361e263e2bf1a66 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 19 Jan 2021 14:27:24 -0600 Subject: [PATCH] Address comments --- volatility/framework/plugins/mac/lsmod.py | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/volatility/framework/plugins/mac/lsmod.py b/volatility/framework/plugins/mac/lsmod.py index 66dc82e5a..0372eb79b 100644 --- a/volatility/framework/plugins/mac/lsmod.py +++ b/volatility/framework/plugins/mac/lsmod.py @@ -3,7 +3,7 @@ # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" -from volatility.framework import renderers, interfaces, contexts +from volatility.framework import exceptions, renderers, interfaces, contexts from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins from volatility.framework.objects import utility @@ -42,11 +42,17 @@ class Lsmod(plugins.PluginInterface): kmod_ptr = kernel.object_from_symbol(symbol_name = "kmod") - kmod = kmod_ptr.dereference().cast("kmod_info") + try: + kmod = kmod_ptr.dereference().cast("kmod_info") + except exceptions.InvalidAddressException: + return [] yield kmod - kmod = kmod.next + try: + kmod = kmod.next + except exceptions.InvalidAddressException: + return [] seen = set() @@ -54,14 +60,19 @@ class Lsmod(plugins.PluginInterface): kmod not in seen and \ len(seen) < 1024: - if not kernel_layer.is_valid(kmod.dereference().vol.offset, kmod.dereference().vol.size): + kmod_obj = kmod.dereference() + + if not kernel_layer.is_valid(kmod_obj.vol.offset, kmod_obj.vol.size): break seen.add(kmod) yield kmod - kmod = kmod.next + try: + kmod = kmod.next + except exceptions.InvalidAddressException: + return def _generator(self): for module in self.list_modules(self.context, self.config['primary'], self.config['darwin']):