WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-11 04:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

layers: Fix up uses of is_valid.

Browse Source
This commit is contained in:
Mike Auty
2019-11-12 09:09:51 +00:00
committed by ikelos
parent 5b04492463
commit face38436e
11 changed files with 26 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/mac/bash.py
+6 -6
View File
@@ -90,18 +90,18 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface):
("Command", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
def generate_timeline(self):
filter_func = tasks.Tasks.create_pid_filter([self.config.get('pid', None)])
for row in self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)):
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)):
_depth, row_data = row
description = "{} ({}): \"{}\"".format(row_data[0], row_data[1], row_data[3])
yield (description, timeliner.TimeLinerType.CREATED, row_data[2])
volatility/framework/plugins/mac/psaux.py
+3 -3
View File
@@ -91,6 +91,6 @@ class Psaux(plugins.PluginInterface):
return renderers.TreeGrid([("PID", int), ("Process", str), ("Argc", int), ("Arguments", str)],
self._generator(
tasks.Tasks.list_tasks(self.context,
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
self.config['primary'],
self.config['darwin'],
filter_func = filter_func)))
volatility/framework/plugins/mac/pslist.py
+1 -1
View File
@@ -87,7 +87,7 @@ class PsList(interfaces.plugins.PluginInterface):
else:
seen[proc.vol.offset] = 1
if not filter_func(proc) and kernel_as.is_valid(proc.vol.offset):
if not filter_func(proc) and kernel_as.is_valid(proc.vol.offset, proc.vol.size):
yield proc
try:
volatility/framework/plugins/mac/tasks.py
+1 -1
View File
@@ -50,7 +50,7 @@ class Tasks(pslist.PsList):
proc = task.bsd_info.dereference().cast("proc")
if not context.layers[layer_name].is_valid(proc.vol.offset):
if not context.layers[layer_name].is_valid(proc.vol.offset, proc.vol.size):
break
if not filter_func(proc):