Re: [Vol-users] Mac support vanished in latest alpha?

Greetings, Darned '-i'. Alas, the profiles still aren't showing up.... Interesting, and new to me, Failed message there. -David bash-3.2# !push pushd volatility/plugins/overlays/mac /usr/local/src/volatility/volatility/plugins/overlays/mac /usr/local/src/volatility bash-3.2# pwd /usr/local/src/volatility/volatility/plugins/overlays/mac bash-3.2# ls -l total 2520 drwxr-xr-x 8 root wheel 272 Feb 24 15:19 .svn -rw-r--r-- 1 root wheel 217337 Feb 24 15:20 10.7.5.32bit.zip -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.7.5.64bit.zip -rw-r--r-- 1 root wheel 494428 Feb 24 15:20 10.8.2.64bit.zip -rw-r--r-- 1 root wheel 0 Feb 24 15:19 __init__.py -rw-r--r-- 1 root wheel 156 Feb 24 15:20 __init__.pyc -rw-r--r-- 1 root wheel 34737 Feb 24 15:19 mac.py -rw-r--r-- 1 root wheel 34533 Feb 24 15:20 mac.pyc bash-3.2# popd /usr/local/src/volatility bash-3.2# !py python vol.py --info | grep -i Mac Volatile Systems Volatility Framework 2.3_alpha *** Failed to import volatility.plugins.overlays.mac.mac (TypeError: 'NoneType' object is not iterable) MachOAddressSpace - Address space for mach-o files to support atc-ny memory reader linux_slabinfo - Mimics /proc/slabinfo on a running machine mac_arp - Prints the arp table mac_check_syscalls - Checks to see if system call table entries are hooked mac_check_sysctl - Checks for unknown sysctl handlers mac_check_trap_table - Checks to see if system call table entries are hooked mac_dmesg - Prints the kernel debug buffer mac_dump_maps - Dumps memory ranges of processes mac_find_aslr_shift - Find the ASLR shift value for 10.8+ images mac_get_processors - No docs mac_ifconfig - Lists network interface information for all devices mac_ip_filters - Reports any hooked IP filters mac_list_sessions - Enumerates sessions mac_list_zones - Prints active zones mac_ls_logins - Lists login contexts mac_lsmod - Lists loaded kernel modules mac_lsof - Lists per-process opened files mac_machine_info - Prints machine information about the sample mac_mount - Prints mounted device information mac_netstat - Lists active per-process network connections mac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext) mac_pgrp_hash_table - Walks the process group hash table mac_pid_hash_table - Walks the pid hash table mac_print_boot_cmdline - Prints kernel boot arguments mac_proc_maps - Gets memory maps of processes mac_psaux - Prints processes with arguments in userland (**argv) mac_pslist - List Running Processes mac_pstree - Show parent/child relationship of processes mac_psxview - Find hidden processes with various process listings mac_route - Prints the routing table mac_runq - No docs mac_task_zone - Prints active zones mac_tasks - List Active Tasks mac_trustedbsd - Lists malicious trustedbsd policies mac_version - Prints the Mac version mac_vfs_events - Lists Mac VFS Events mac_volshell - Shell in the memory image -David On Feb 24, 2013, at 3:29 PM, Jamie Levy <jamie.levy(a)gmail.com> wrote: a new atc-ny from instructions on well profiles. using?