
    #f                         d Z ddlZddlmZ ddlmZmZ ddlmZ ddlm	Z	 ddl
mZ ddlmZ  ej                  e      Z G d	 d
ej"                        Zy)zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)List)
exceptions
interfaces)	renderers)requirements)plugins)format_hintsc                   v    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zd Zd Zd	 Zy
)Check_afinfoz>Verifies the operation function pointers of network protocols.)   r   r   returnc                 8    t        j                  ddg d      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures)r   ModuleRequirement)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/check_afinfo.pyget_requirementszCheck_afinfo.get_requirements   s%     ***?
 	
    c                 z    t        | j                  j                  j                  |            }t	        |      dkD  S )Nr   )listcontextsymbol_spaceget_symbols_by_locationlen)selfhandler_addrsymbolss      r   _is_known_addresszCheck_afinfo._is_known_address"   s0    t||00HHVW7|ar   c              #      K   |D ]Y  }|j                  d      r|dk(  r|j                  d      }nt        ||      }|s<|dk7  sB| j                  |      rT||f [ y w)N__UNIQUE_ID_rh_kabi_hidewrite)attrr   )
startswithmembergetattrr$   )r!   var_opsvar_namememberscheckaddrs         r   _check_memberszCheck_afinfo._check_members'   sk      	"E :;~~7~3w.	$*@*@*FTk!	"s   >A"A"A"	A"c              #     K   g d}t        |D cg c]  }|j                  |       c}      }|sgt        j                  | dt	        |j
                  j                         ddj                  |D cg c]  }| c}              t        j                  |j                  d      r,| j                  |j                  ||      D ]  \  }}	|||	f  |j                  d      r-| j                  |j                  ||      D ]  \  }}	|||	f  y |j                  d      r.| j                  |j                        s|d|j                  f y y y c c}w c c}w w)	N)seq_fopsseq_opsseq_showz object at z# had none of the required members: z, r3   r4   r5   show)any
has_membervollogdebughexvoloffsetjoinr   PluginRequirementExceptionr1   r3   r4   r$   r5   )
r!   r-   var
op_membersseq_membersrequired_membersr*   has_required_memberhooked_memberhook_addresss
             r   _check_afinfozCheck_afinfo._check_afinfo5   sv    >!2BCS^^F#C
 #LL*KCGGNN(;'<<_`d`i`i  AQ  kRv|kq  kR  aS  `T  U 777>>*%/3/B/Bh
0 <+| |;;< >>)$/3/B/BX{0 <+| |;;< ~~j)--cll;"FCLL88 < */ D kRs   EEA
E2	E;C"Ec           	   #     K   | j                   j                  | j                  d      }|j                  d      j                  }|j                  d      j                  }dddgf}dg df}||g}t               }t               }|D ]  \  }	}
|
D ]|  }	 |j                  |      }|j                  |	|j                  	      }|j                  |       	 | j                  ||||      D ]"  \  }}}d
||t        j                  |      ff $ ~  ||k(  rt         j#                  d       y y # t        j                  $ r Y w xY w# t        j                  $ r |j                  |       Y w xY ww)Nr   file_operationsseq_operationstcp_seq_afinfotcp6_seq_afinfotcp4_seq_afinfoudp_seq_afinfo)udplite6_seq_afinfoudp6_seq_afinfoudplite4_seq_afinfoudp4_seq_afinfo)object_typer=   r   zThis plugin was not able to check for hooks. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.)r   modulesconfigget_typer.   set
get_symbolr   SymbolErrorobjectaddressaddrG   r	   Hexr?   r9   warning)r!   vmlinuxrA   rB   tcpudp	protocolssymbols_checkedsymbols_with_errorsstruct_typeglobal_varsglobal_var_name
global_varr   r*   r[   s                   r   
_generatorzCheck_afinfo._generatorT   s    ,,&&t{{8'<=%%&78@@
&&'78@@"35F!GH
 #J	 %!e )2 	=$K#. =!(!3!3O!DJ %^^ +J4F4F , 
  ##O4=151C1C'Z2 K-fg  $0@0@0I!JJJK=	=, 11NN g 2# "--  "<< ='++O<=sN   BE-D*".E-9E
 E-*E =E-?E  E-$E*'E-)E**E-c                     t        j                  dt        fdt        fdt        j                  fg| j                               S )NzSymbol NameMemberzHandler Address)r   TreeGridstrr	   r]   ri   )r!   s    r   runzCheck_afinfo.run   sC    !!$3"L$4$45
 OO
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer   r$   r1   rG   ri   rn    r   r   r   r      sO    H"+
j&>&>&S&S!T 
 
 
"9>1f
r   r   )rr   loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr	   	getLoggerro   r9   PluginInterfacer   rw   r   r   <module>r      sE   '   8 + < 4 8			8	$}
7** }
r   