1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 __author__ = "Michael Cohen <scudette@google.com>"
20
21 from rekall import plugin
22 from rekall.plugins.darwin import common
23
24
25 -class DarwinHandles(common.ProcessFilterMixin, common.AbstractDarwinProducer):
26 """Walks open files of each proc and collects the fileproc.
27
28 This is the same algorithm as lsof, but aimed at just collecting the
29 fileprocs, without doing anything with them, or sorting.
30 """
31
32 name = "handles"
33 type_name = "fileproc"
34
39
40
42 """Walks open files of each proc in order and prints PID, FD and the handle.
43
44 Each process has an array of pointers to fileproc structs - the offset into
45 the array is the file descriptor and each fileproc struct represents a
46 handle on some resource. A type field in the fileproc determines the type
47 of the resource pointed to from the fileproc (e.g. vnode, socket, pipe...).
48 """
49
50 name = "lsof"
51
52 table_header = [
53 dict(name="proc", type="proc",
54 columns=[
55 dict(name="command", width=16),
56 dict(name="pid", width=8),
57 dict(name="p_uid", width=8)
58 ]),
59 dict(name="fd", width=5),
60 dict(name="fileproc", type="fileproc")
61 ]
62
69