Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

macOS: Latest kernels support #1115

Draft
wants to merge 30 commits into
base: develop
Choose a base branch
from
Draft

macOS: Latest kernels support #1115

Show file tree
Hide file tree
Changes from 29 commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
5214601
MH_FILESET kernelcache macOS support
Abyss-W4tcher Mar 20, 2024
ffcae1c
set join_path and add _KERNEL_MIN_ADDRESS constant
Abyss-W4tcher Mar 20, 2024
606d6be
use _KERNEL_MIN_ADDRESS constant in virtual_to_physical_address
Abyss-W4tcher Mar 20, 2024
4bc21a1
remove unnecessary import
Abyss-W4tcher Mar 20, 2024
2c3db89
add seen_banners mechanism
Abyss-W4tcher Mar 20, 2024
6ea2f16
more explicit symbol table variable name
Abyss-W4tcher Mar 20, 2024
78fc8f7
find_aslr caller and logging messages changes
Abyss-W4tcher Mar 20, 2024
3678ac5
logging message improvement
Abyss-W4tcher Mar 20, 2024
a8c55ef
use lowGlo scanning for aslr calculation
Abyss-W4tcher Mar 20, 2024
de50148
vm_kernel_slide calculations
Abyss-W4tcher Mar 20, 2024
a01c9c9
aslr validation
Abyss-W4tcher Mar 20, 2024
83b7d40
kernelcache calculations utilities
Abyss-W4tcher Mar 20, 2024
0d19dbc
save needed constants for later shift use
Abyss-W4tcher Mar 20, 2024
e601ccc
add constant config prefix helper for kernelcache
Abyss-W4tcher Mar 20, 2024
4fd0228
save kernelcache config options in a specific intel layer, if needed
Abyss-W4tcher Mar 20, 2024
b99c688
add logging and import path_join
Abyss-W4tcher Mar 20, 2024
e079d99
introduce kernelcache unslide, to circumvent the additional kernelcac…
Abyss-W4tcher Mar 20, 2024
f6b4996
revert symbol table sliding, for macOS kernelcache
Abyss-W4tcher Mar 23, 2024
37f25b5
add kernelcache support module
Abyss-W4tcher Mar 23, 2024
3e0f975
automagic: use kernelcache module if needed
Abyss-W4tcher Mar 23, 2024
e1b7151
remove unnecessary macos requirement
Abyss-W4tcher Mar 23, 2024
2e6f675
revert logging and path_join imports
Abyss-W4tcher Mar 23, 2024
781d1f0
additional documentation
Abyss-W4tcher Mar 23, 2024
09db071
remove irrelevant sqlitecache line
Abyss-W4tcher Mar 24, 2024
6b57710
clean comparison
Abyss-W4tcher Mar 24, 2024
a5c58a7
use a regex pattern to determine banner major and minor versions
Abyss-W4tcher Mar 24, 2024
fd37a00
lowglo scanner return type hinting
Abyss-W4tcher Mar 24, 2024
16979f7
check if offset in kernel boundaries checker is absolute or not
Abyss-W4tcher Mar 24, 2024
bd5f3f3
remove unnecessary processing in get_symbols_by_absolute_location
Abyss-W4tcher Mar 24, 2024
bfdee3d
Merge branch 'volatilityfoundation:develop' into macos_automagic_update
Abyss-W4tcher Aug 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading