bug in mac_trustedbsd

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Run the mac_trustedbsd command against any OS X memory sample

What is the expected output? What do you see instead?
It should list nothing or malicious trustedbsd policies if present.
Instead:

Check                                    Name                 Pointer           
---------------------------------------- -------------------- ------------------
Traceback (most recent call last):
  File "vol.py", line 186, in <module>
    main()
  File "vol.py", line 177, in main
    command.execute()
  File "/Users/what/tools/volatility-test2/volatility/plugins/mac/common.py", line 43, in execute
    commands.Command.execute(self, *args, **kwargs)
  File "/Users/what/tools/volatility-test2/volatility/commands.py", line 111, in execute
    func(outfd, data)
  File "/Users/what/tools/volatility-test2/volatility/plugins/mac/trustedbsd.py", line 73, in render_text
    for (good, check, name, ptr) in data:
  File "/Users/what/tools/volatility-test2/volatility/plugins/mac/trustedbsd.py", line 67, in calculate
    good = common.is_known_address(ptr, kernel_symbol_addresses, kmods, 0) 
TypeError: is_known_address() takes exactly 3 arguments (4 given)

What version of the product are you using? On what operating system?
r3420 on MacMountainLion_10_8_3_AMDx64

Please provide any additional information below.
Code in 
https://code.google.com/p/volatility/source/browse/trunk/volatility/plugins/mac/
trustedbsd.py#67 needs to be: 

  good = common.is_known_address(ptr, kernel_symbol_addresses, kmods)

instead of:

  good = common.is_known_address(ptr, kernel_symbol_addresses, kmods, 0) 

This is where the 'problem' was introduced:

https://code.google.com/p/volatility/source/diff?spec=svn3420&r=3311&format=side
&path=/trunk/volatility/plugins/mac/common.py&old_path=/trunk/volatility/plugins
/mac/common.py&old=3174

Original issue reported on code.google.com by cemgur...@gmail.com on 20 May 2013 at 8:00

[GoogleCodeExporter]

Original comment by mike.auty@gmail.com on 20 May 2013 at 8:25

[GoogleCodeExporter]

nice triage of the bug cem! Will have it fixed by tonight.

Original comment by atc...@gmail.com on 20 May 2013 at 8:30

[GoogleCodeExporter]

Thanks Andrew!

Original comment by cemgur...@gmail.com on 21 May 2013 at 4:41

[GoogleCodeExporter]

This issue was closed by revision r3424.

Original comment by michael.hale@gmail.com on 24 May 2013 at 2:31

• Changed state: Fixed