Mac - smear protection on process maps walking and task enumeration

Author: atcuno

volatility/plugins/mac/pstasks.py

@@ -37,12 +37,18 @@ def allprocs(self):
         tasksaddr = self.addr_space.profile.get_symbol("_tasks")
         queue_entry = obj.Object("queue_entry", offset = tasksaddr, vm = self.addr_space)
 
-        seen = [tasksaddr]
+        seen = { tasksaddr : 1 }
 
         for task in queue_entry.walk_list(list_head = tasksaddr):
-            if (task.bsd_info and task.obj_offset not in seen):
-                proc = task.bsd_info.dereference_as("proc") 
-                yield proc
-            
-            seen.append(task.obj_offset)
+            if task.obj_offset not in seen:
+                seen[task.obj_offset] = 0
+
+                if task.bsd_info:
+                    proc = task.bsd_info.dereference_as("proc") 
+                    yield proc
+            else:
+                if seen[task.obj_offset] > 3:
+                    break
+
+                seen[task.obj_offset] = seen[task.obj_offset] + 1
 

volatility/plugins/overlays/mac/mac.py

@@ -1099,7 +1099,13 @@ def get_dyld_maps(self):
     def get_proc_maps(self):
         map = self.task.map.hdr.links.next
 
+        seen = set()
+
         for i in xrange(self.task.map.hdr.nentries):
+            if map.v() in seen:
+                break
+            seen.add(map.v())
+
             if not map:
                 break
             yield map
@@ -1517,9 +1523,12 @@ def get_path(self):
             ret = vnode  
         elif vnode:
             path = []
-            while vnode:
+            seen = set()
+            while vnode and vnode.v() not in seen:
+                seen.add(vnode.v())
                 path.append(str(vnode.v_name.dereference() or ''))
                 vnode = vnode.v_parent
+
             path.reverse()
             ret = "/".join(path)
         else: