macOS : plugins updates, for recent kernels support

[Abyss-W4tcher]

Hi 👋,

This Pull Request provides updates to existing macOS plugins, for compatibility with recent kernels. It indirectly depends on the work produced in #1115. It is marked as "Draft" for now, but is available for anyone to try !

Instead of opening one PR for each change, I thought it would be easier to track down the global update here.

Changes are mostly small fixes on types and structures naming changes, while keeping the compatibility for older kernels. A couple reworks were necessary for some plugins, and extensions.

Tested on kernels :

• 10.9.3_build-13D65
• 10.12.6_build-16G29
• 10.15.7_build-19H15
• 12.0.1_build-21A559
• 13.6.4_build-22G513
• 14.0_build-23A5257q

Plugins version haven't been bumped for now.

Details

Here are the justifications, in the form of a before/after on kernel structures :

volatility3/framework/symbols/mac/init.py

filedesc :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/filedesc.h#L90
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/filedesc.h#L123

fileproc :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/file_internal.h#L91
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/file_internal.h#L120

fileglob :

• https://github.com/apple-open-source/macos/blob/12.0.1/xnu/bsd/sys/file_internal.h#L185
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/file_internal.h#L187

vnode :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/bsd/sys/vnode_internal.h#L127
• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/vnode_internal.h#L159

mac.pslist

bsd_info :

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/osfmk/kern/task.h#L234
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/kern/task.h#L275

mac.kevents

• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/event_private.h#L467

mac.list_files

Recursive logic was updated to an iterative one, as "maximum recursion depth exceeded in comparison" were encountered when deep recursion occured.

volatility3/framework/symbols/mac/extensions/init.py

proc (impacts mac.pslist) :

• https://github.com/apple-open-source/macos/blob/14.3/xnu/bsd/sys/proc_internal.h#L262

mac.malfind

Fixes #848. As vm_map_object was removed from the kernel, updates on the logic to get vm_object from a vm_map_entry were done. See :

• https://github.com/apple-open-source/macos/blob/12.0.1/xnu/osfmk/vm/vm_map.h#L140
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/vm/vm_map.h#L239

Here is an article brieflly talking about it :

https://saaramar.github.io/kmem_guard_t_blogpost/#bookkeeping

mac.timers

/!\ 1-1 changes were done, but results don't seem really useful/accurate in recent kernels

• https://github.com/apple-open-source/macos/blob/10.9.3/xnu/osfmk/kern/call_entry.h#L45
• https://github.com/apple-open-source/macos/blob/14.3/xnu/osfmk/kern/timer_call.h