heimdall.os_related.macos package

Submodules

heimdall.os_related.macos.filesystem module

class heimdall.os_related.macos.filesystem.MacOSFileSystem

Bases: object

Provides utilities for interacting with the macOS file system, specifically for vnode operations.

static vnode_full_path(v_node: Symbol) → str

Return the full path of a vnode by traversing its parent hierarchy.

Parameters:

v_node (Symbol) – The vnode for which to retrieve the full path.

Returns:

The full path of the vnode.

Return type:

str

static vnode_traversal(v_node: Symbol) → Iterator[Any]

Traverse the vnode hierarchy starting from a given vnode.

Parameters:

v_node (Symbol) – The vnode from which to start traversal.

Yields:

Symbol – Each vnode in the hierarchy from the given vnode up to the root.

heimdall.os_related.macos.macos_client module

class heimdall.os_related.macos.macos_client.MacOSClient(vmi: libvmi.Libvmi, profile: Path)

Bases: HeimdallClient

__init__(vmi: libvmi.Libvmi, profile: Path)

Initialize MacOSClient.

property kslide: int

Return kernel slide value.

property processes: MacOSProcesses

Return MacOS processes.

heimdall.os_related.macos.processes module

class heimdall.os_related.macos.processes.MacOSProcess(ks: Any, ctx: Context)

Bases: Process

Represents a macOS process, providing access to attributes such as PID, name, and path.

property name: str

Process name.

Returns:

The name of the process.

Return type:

str

property path: str

Process path.

Returns:

The full path of the process executable.

Return type:

str

property pid: int

Process ID (PID).

Returns:

The process ID.

Return type:

int

class heimdall.os_related.macos.processes.MacOSProcesses(heimdall_client: HeimdallClient)

Bases: Processes

Manages a collection of macOS processes, providing methods to retrieve processes by various attributes.

__init__(heimdall_client: HeimdallClient)

Initialize the MacOSProcesses manager with a Heimdall client.

Parameters:

heimdall_client (HeimdallClient) – The client used for interacting with the system kernel.

list() → list[MacOSProcess]

List all processes.

Returns:

A list of all macOS processes.

Return type:

list of MacOSProcess

Module contents