diff --git a/volatility/plugins/mac/dmesg.py b/volatility/plugins/mac/dmesg.py index 13701beb..c9716259 100644 --- a/volatility/plugins/mac/dmesg.py +++ b/volatility/plugins/mac/dmesg.py @@ -30,9 +30,8 @@ class mac_dmesg(common.AbstractMacCommand): def calculate(self): common.set_plugin_members(self) - msgbuf_ptr = obj.Object("Pointer", offset=self.get_profile_symbol("_msgbufp"), vm=self.addr_space) - - msgbufp = obj.Object("msgbuf", offset=msgbuf_ptr, vm=self.addr_space) + msgbuf_ptr = obj.Object("Pointer", offset = self.get_profile_symbol("_msgbufp"), vm = self.addr_space) + msgbufp = msgbuf_ptr.dereference_as("msgbuf") bufx = msgbufp.msg_bufx size = msgbufp.msg_size @@ -40,19 +39,17 @@ class mac_dmesg(common.AbstractMacCommand): if bufc[bufx] == 0 and bufc[0] != 0: buf = common.get_string(bufc, self.addr_space) - else: if bufx > size: bufx = 0 # older messages - buf = bufc[bufx:bufx+size] - + buf = bufc[bufx:bufx + size] buf = buf + bufc[0:bufx] yield buf def render_text(self, outfd, data): for buf in data: - print buf + outfd.write("{0}\n".format(buf))