WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

switch mac_trustedbsd to absolute_symbol_addresses interface

Browse Source
This commit is contained in:
Andrew Case
2018-12-27 22:43:19 +00:00
committed by ikelos
parent 9eeac53d8d
commit f8fab3a71d
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/trustedbsd.py
+9 -6
View File
@@ -45,17 +45,20 @@ class Check_syscall(plugins.PluginInterface):
]
def _generator(self, mods: Iterator[Any]):
aslr_shift = mac.MacUtilities.find_aslr(self.context, self.config['darwin'], self.config['primary'])
darwin = self.context.module(self.config['darwin'], self.config['primary'], aslr_shift)
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'])
mac.MacUtilities.aslr_mask_symbol_table(self.context, self.config['darwin'], self.config['primary'], aslr_shift)
kernel = contexts.Module(self._context,
self.config['darwin'],
self.config['primary'],
0,
absolute_symbol_addresses = True)
policy_list = darwin.object(symbol_name = "_mac_policy_list").cast("mac_policy_list")
policy_list = kernel.object(symbol_name = "_mac_policy_list").cast("mac_policy_list")
entries = darwin.object(
entries = kernel.object(
type_name = "array",
offset = policy_list.entries.dereference().vol.offset,
subtype = darwin.get_type('mac_policy_list_element'),
subtype = kernel.get_type('mac_policy_list_element'),
count = policy_list.staticmax + 1)
mask = self.context.memory[self.config['primary']].address_mask