From 2e8dac8aa363f0996612fe483c542e84d8f1663b Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 21 Jan 2013 07:20:52 +0000 Subject: [PATCH] Mac - update mount --- .../plugins/mac/{mac_mount.py => mount.py} | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) rename volatility/plugins/mac/{mac_mount.py => mount.py} (70%) diff --git a/volatility/plugins/mac/mac_mount.py b/volatility/plugins/mac/mount.py similarity index 70% rename from volatility/plugins/mac/mac_mount.py rename to volatility/plugins/mac/mount.py index ad88d097..15f23ad9 100644 --- a/volatility/plugins/mac/mac_mount.py +++ b/volatility/plugins/mac/mount.py @@ -22,29 +22,28 @@ """ import volatility.obj as obj -import mac_common +import common -class mac_mount(mac_common.AbstractMacCommand): +class mac_mount(common.AbstractMacCommand): + """ Prints mounted device information """ def calculate(self): + common.set_plugin_members(self) - mountlist_addr = self.smap["_mountlist"] + mountlist_addr = self.get_profile_symbol("_mountlist") mount = obj.Object("mount", offset=mountlist_addr, vm=self.addr_space) while mount: - - mnttype = mac_common.get_string(mount.mnt_vfsstat.f_fstypename.obj_offset, self.addr_space, 16) - dev = mac_common.get_string(mount.mnt_vfsstat.f_mntonname.obj_offset, self.addr_space, 1024) - mntpoint = mac_common.get_string(mount.mnt_vfsstat.f_mntfromname.obj_offset, self.addr_space, 1024) + mnttype = common.get_string(mount.mnt_vfsstat.f_fstypename.obj_offset, self.addr_space, 16) + dev = common.get_string(mount.mnt_vfsstat.f_mntonname.obj_offset, self.addr_space, 1024) + mntpoint = common.get_string(mount.mnt_vfsstat.f_mntfromname.obj_offset, self.addr_space, 1024) yield (mnttype, dev, mntpoint) mount = mount.mnt_list.tqe_next def render_text(self, outfd, data): - for (mnttype, dev, mntpoint) in data: - outfd.write("{0:32s} {1:32} {2:32}\n".format(dev, mntpoint, mnttype))