
    :#f                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  e j                  e      Z G d d	ej$                  j&                        Zy)
    N)List)
interfaces	rendererssymbols)requirements)format_hints)linux)lsmodc                   d    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zy)	Check_idtz"Checks if the IDT has been altered   r   r   returnc                     t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dt        j                  d	      gS )
NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures
linuxutilsr   )r   	componentversionr
   )r   pluginr   )r   ModuleRequirementVersionRequirementr	   LinuxUtilitiesPluginRequirementr
   Lsmod)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/check_idt.pyget_requirementszCheck_idt.get_requirements   s]     ***?
 ++!U-A-A9 **U[[)
 	
    c              #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   |j                        }t        j                  j                  | j                   |j                  |      }t        j                  | j                   |j                         }d}| j                   j                  |j                     j                  }t!        t#        dd            dgz   }|r|j%                  d      rd}n-d}n*|j%                  d      rd}n|j%                  d      rd}nd	}|j'                  d
      }	|j)                  d|	j*                  j,                  |j/                  |      |d      }
|D ]  }|
|   }|st1        |d      r|j2                  }nF|j4                  }|j6                  }t1        |d      r|j8                  }nd}|dz  |dz  z  |z  }||z  }t        j                  j;                  |||      \  }}dt=        j>                  |      t=        j>                  |      ||gf  y w)Nr      r         gate_structdesc_structgate_struct64idt_desc	idt_tablearrayT)object_typeoffsetsubtypecountabsoluteAddressoffset_high       ) contextmodulesconfigr
   r    list_modulesr   r	   r   generate_kernel_handler_infor   symbol_table_is_64bitsymbol_table_namelayers
layer_nameaddress_masklistrangehas_typeobject_from_symbolobjectvolr0   get_typehasattrr4   
offset_lowoffset_middler5   lookup_module_addressr   Hex)selfvmlinuxr9   handlersis_32bitidt_table_sizerA   
check_idxsidt_typeaddrstableientidt_addrlowmiddlehighmodule_namesymbol_names                      r"   
_generatorzCheck_idt._generator&   s1    ,,&&t{{8'<=++**4<<F''DDLL',,
 44LL'33
 
 ||**7+=+=>KK %2,'3%/
.((0*!!-0(%**;799##$$X.   
  !	A(CsI&;;nn**3.??DD BJ6R<83>#l2',';';'Q'Q8($K
  $$Q' $$X.	 3!	s   IIc                     t        j                  dt        j                  fdt        j                  fdt        fdt        fg| j                               S )NIndexr4   ModuleSymbol)r   TreeGridr   rM   strr_   )rN   s    r"   runzCheck_idt.runt   sP    !!,**+L,,-33	 OO
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer#   r_   rf    r$   r"   r   r      sA    ,"+
j&>&>&S&S!T 
 
L\	
r$   r   )loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr	   volatility3.plugins.linuxr
   	getLoggerrg   vollogpluginsPluginInterfacer   ro   r$   r"   <module>r{      sK   
   @ @ < 8 / +			8	$l

""22 l
r$   