macOS: Plugin enhancements for latest kernel compatibility

[Abyss-W4tcher]

Hi 👋,

This Pull Request provides updates to existing macOS plugins, for compatibility with recent kernels. It indirectly depends on the work produced in #1115. It is marked as "Draft" for now, but is available for anyone to try !

Instead of opening one PR for each change, I thought it would be easier to track down the global update here.

Changes are mostly small fixes on types and structures naming changes, while keeping the compatibility for older kernels. A couple reworks were necessary for some plugins, and extensions.

Tested on kernels :

• 10.9.3_build-13D65
• 10.12.6_build-16G29
• 10.15.7_build-19H15
• 12.0.1_build-21A559
• 13.6.4_build-22G513
• 14.0_build-23A5257q

Plugins version haven't been bumped for now.

Details

Here are the justifications, in the form of a before/after on kernel structures :

volatility3/framework/symbols/mac/init.py

filedesc :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/filedesc.h#L90
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/filedesc.h#L123

fileproc :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/file_internal.h#L91
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/file_internal.h#L120

fileglob :

• https://github.com/apple-open-source/macos/blob/12.0.1/xnu/bsd/sys/file_internal.h#L185
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/file_internal.h#L187

vnode :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/vnode_internal.h#L127
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/vnode_internal.h#L159

mac.pslist

bsd_info :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/osfmk/kern/task.h#L234
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/kern/task.h#L275

mac.kevents

• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/event_private.h#L467

mac.list_files

Recursive logic was updated to an iterative one, as "maximum recursion depth exceeded in comparison" were encountered when deep recursion occured.

volatility3/framework/symbols/mac/extensions/init.py

proc (impacts mac.pslist) :

• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/proc_internal.h#L262

mac.malfind

Fixes #848. As vm_map_object was removed from the kernel, updates on the logic to get vm_object from a vm_map_entry were done. See :

• https://github.com/apple-open-source/macos/blob/12.0.1/xnu/osfmk/vm/vm_map.h#L140
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/vm/vm_map.h#L239

Here is an article brieflly talking about it :

https://saaramar.github.io/kmem_guard_t_blogpost/#bookkeeping

mac.timers

/!\ 1-1 changes were done, but results don't seem really useful/accurate in recent kernels

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/osfmk/kern/call_entry.h#L45
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/kern/timer_call.h

[ikelos]

Where are we with this? Is it still draft, or ready for review? Happy for either, just interested in an update so it doesn't get forgotten accidentally...

[Abyss-W4tcher]

The MH fileset dual modules thing can be reviewed, but I put this to draft as it might need to be reworked the same way the LinuxIntelStacker is reworked in the AArch64 PR, to enhance scalability of the MacStacker.

Currently, we had a few issues determining where to put the modules requirements : #1118

edit: What I said applies to PR #1115, not this one sorry.

---

This PR is still draft as I am waiting for the main MacOS rework to be finished, reviewed and validated before checking plugins. However, if you want to review it as-is, I'll be happy to check out your comments :)