
    :#f                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  e j        e          Z G d d	ej        j                  ZdS )
    N)List)
interfaces	rendererssymbols)requirements)format_hints)linux)lsmodc                   ^    e Zd ZdZdZedeej        j	                 fd            Z
d Zd ZdS )	Check_idtz"Checks if the IDT has been altered   r   r   returnc                     t          j        ddg d          t          j        dt          j        d          t          j        dt          j        d	          gS )
NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures
linuxutilsr   )r   	componentversionr
   )r   pluginr   )r   ModuleRequirementVersionRequirementr	   LinuxUtilitiesPluginRequirementr
   Lsmod)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/check_idt.pyget_requirementszCheck_idt.get_requirements   ss     **???  
 +!U-A9   *U[)  
 	
    c              #   L  K   | j         j        | j        d                  }t          j                            | j         |j                  }t          j        	                    | j         |j        |          }t          j        | j         |j                   }d}| j         j        |j                 j        }t!          t#          dd                    dgz   }|r|                    d          rd}n5d}n2|                    d          rd}n|                    d          rd}nd	}|                    d
          }	|                    d|	j        j        |                    |          |d          }
|D ]}|
|         }|st1          |d          r|j        }n;|j        }|j        }t1          |d          r|j        }nd}|dz  |dz  z  |z  }||z  }t          j                            |||          \  }}dt=          j        |          t=          j        |          ||gfV  d S )Nr      r         gate_structdesc_structgate_struct64idt_desc	idt_tablearrayT)object_typeoffsetsubtypecountabsoluteAddressoffset_high       ) contextmodulesconfigr
   r    list_modulesr   r	   r   generate_kernel_handler_infor   symbol_table_is_64bitsymbol_table_namelayers
layer_nameaddress_masklistrangehas_typeobject_from_symbolobjectvolr0   get_typehasattrr4   
offset_lowoffset_middler5   lookup_module_addressr   Hex)selfvmlinuxr9   handlersis_32bitidt_table_sizerA   
check_idxsidt_typeaddrstableientidt_addrlowmiddlehighmodule_namesymbol_names                      r"   
_generatorzCheck_idt._generator&   sr     ,&t{8'<=+**4<FF'DDL',
 
 4L'3
 
 
 |*7+=>K %2,,''3%/
 	&.. )((00 &*!!-00 &(%**;779#$$X..   
 
  !	 !	A(C sI&& 3;n*3.. ?DDD BJ6R<83>#l2',';'Q'Q8( ($K
  $Q'' $X..	    3!	 !	r$   c                     t          j        dt          j        fdt          j        fdt          fdt          fg|                                           S )NIndexr4   ModuleSymbol)r   TreeGridr   rM   strr_   )rN   s    r"   runzCheck_idt.runt   sO    !,*+L,-33	 OO
 
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer#   r_   rf    r$   r"   r   r      sr        ,,"+
j&>&S!T 
 
 
 [
L L L\	
 	
 	
 	
 	
r$   r   )loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr	   volatility3.plugins.linuxr
   	getLoggerrg   vollogpluginsPluginInterfacer   ro   r$   r"   <module>r{      s   
        @ @ @ @ @ @ @ @ @ @ < < < < < < 8 8 8 8 8 8 / / / / / / + + + + + +		8	$	$l
 l
 l
 l
 l

"2 l
 l
 l
 l
 l
r$   