WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-22 01:24:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor SymbolRequirement to SymbolTableRequirement for clarity.

Browse Source
This commit is contained in:
Mike Auty
2019-02-06 21:26:32 +00:00
parent d23e6474ce
commit f898dca296
44 changed files with 67 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/check_syscall.py
+5 -6
View File
@@ -10,6 +10,7 @@ from volatility.framework.renderers import format_hints
vollog = logging.getLogger(__name__)
class Check_syscall(plugins.PluginInterface):
"""Check system call table for hooks"""
@@ -18,16 +19,14 @@ class Check_syscall(plugins.PluginInterface):
return [
requirements.TranslationLayerRequirement(
name = 'primary', description = 'Memory layer for the kernel', architectures = ["Intel32", "Intel64"]),
requirements.SymbolRequirement(name = "darwin", description = "Mac kernel symbols")]
requirements.SymbolTableRequirement(name = "darwin", description = "Mac kernel symbols")
]
def _generator(self):
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
kernel = contexts.Module(
self._context, self.config['darwin'], self.config['primary'], 0, absolute_symbol_addresses = True)
nsysent = kernel.object(symbol_name = "nsysent")
table = kernel.object(symbol_name = "sysent")