Source code for volatility3.cli.volshell.mac

# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at

from typing import Any, List, Tuple, Union

from volatility3.cli.volshell import generic
from volatility3.framework import constants, interfaces
from volatility3.framework.configuration import requirements
from volatility3.plugins.mac import pslist

[docs]class Volshell(generic.Volshell): """Shell environment to directly interact with a mac memory image."""
[docs] @classmethod def get_requirements(cls): return [ requirements.ModuleRequirement( name="kernel", description="Darwin kernel module" ), requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True ), ]
[docs] def change_task(self, pid=None): """Change the current process and layer, based on a process ID""" tasks = self.list_tasks() for task in tasks: if task.p_pid == pid: process_layer = task.add_process_layer() if process_layer is not None: self.change_layer(process_layer) return None print(f"Layer for task ID {pid} could not be constructed") return None print(f"No task with task ID {pid} found")
[docs] def list_tasks(self, method=None): """Returns a list of task objects from the primary layer""" # We always use the main kernel memory and associated symbols return list( pslist.PsList.get_list_tasks(method)(self.context, self.current_kernel_name) )
[docs] def construct_locals(self) -> List[Tuple[List[str], Any]]: result = super().construct_locals() result += [ (["ct", "change_task", "cp"], self.change_task), (["lt", "list_tasks", "ps"], self.list_tasks), (["symbols"], self.context.symbol_space[self.current_symbol_table]), ] if self.config.get("pid", None) is not None: self.change_task(self.config["pid"]) return result
[docs] def display_type( self, object: Union[ str, interfaces.objects.ObjectInterface, interfaces.objects.Template ], offset: int = None, ): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): if constants.BANG not in object: object = self.current_symbol_table + constants.BANG + object return super().display_type(object, offset)
[docs] def display_symbols(self, symbol_table: str = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.current_symbol_table return super().display_symbols(symbol_table)
@property def current_layer(self): if self.__current_layer is None: self.__current_layer = self.kernel.layer_name return self.__current_layer