
    Z#f                         d Z ddlZddlZddlmZ ddlmZmZmZm	Z	 ddl
mZ ddlmZ ddlmZ  ej        e          Z	 ddlZdZn# e$ r d	ZY nw xY w G d
 dej                  ZdS )zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)List)	constants
exceptions
interfaces	renderers)requirements)plugins)format_hintsTFc                   |    e Zd ZdZdZedeej        j	                 fd            Z
d Zd Zd Zd Zd	 Zd
 Zd ZdS )Check_syscallz"Check system call table for hooks.)   r   r   returnc                 6    t          j        ddg d          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures)r   ModuleRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/check_syscall.pyget_requirementszCheck_syscall.get_requirements   s2     **???  
 	
    c                 h   d}g }|j         D ]g}t          j        t          j                  5  |                    |                    |          j        |f           ddd           n# 1 swxY w Y   ht          |          }d}|D ]\  }	}
|	|k    r|	} n|dk    rt          ||z
  |z            }|S )z7Returns the size of the table based on the next symbol.r   N)
symbols
contextlibsuppressr   SymbolErrorappend
get_symboladdresssortedint)self
table_addrptr_szvmlinuxretsymbol_listsnsorted_symbolssym_addresstmp_sym_addresssym_names              r   _get_table_size_next_symbolz)Check_syscall._get_table_size_next_symbol(   s-   / 	I 	IB$Z%;<< I I""G$6$6r$:$:$BB#GHHHI I I I I I I I I I I I I I I  ,,)7 	 	%OX++- , ??{Z/69::C
s   0A((A,	/A,	c                 h    t          d | j        j        |j                 j        D                       S )zreturns the number of symbols that start with __syscall_meta__ this
        is a fast way to determine the number of system calls, but not the most
        accurate.c                 <    g | ]}|                     d           |S )__syscall_meta__)
startswith).0syms     r   
<listcomp>z6Check_syscall._get_table_size_meta.<locals>.<listcomp>E   s;       >>"455  r   )lencontextsymbol_spacesymbol_table_namer   )r&   r)   s     r   _get_table_size_metaz"Check_syscall._get_table_size_meta?   sB    
  <4W5NOW  
 
 	
r   c                     |                      |          }|                     |||          }d ||fD             }t          |          }|S )Nc                     g | ]
}|d k    |S )r    )r6   sizes     r   r8   z7Check_syscall._get_table_info_other.<locals>.<listcomp>P   s    QQQ$qr   )r=   r1   min)r&   r'   r(   r)   table_size_metatable_size_symssizes
table_sizes           r   _get_table_info_otherz#Check_syscall._get_table_info_otherL   sU    33G<<:::vwWWQQ?O"DQQQZZ
r   c                 ^   d}t           s|S |dk    rd}t          j        }nd}t          j        }t          j        t          j        |          }	 |                    |          j        }n# t          j	        $ r}Y d}~dS d}~ww xY w| j
        j        | j        d                  }| j
        j                            |j        |d          }	|                    |	|          D ]L\  }
}}}|dk    r?t#          |                    d	          d
                                                   dz  } nM|S )zFind the size of the system call table by disassembling functions
        that immediately reference it in their first instruction This is in the
        form 'cmp reg,NR_syscalls'.r      sysenter_do_callsystem_call_fastpathNr      CMP,   i  )has_capstonecapstone
CS_MODE_32
CS_MODE_64CsCS_ARCH_X86r"   r#   r   r    r:   modulesconfiglayersread
layer_namedisasm_liter%   splitstrip)r&   r(   r)   rF   syscall_entry_funcmodemd	func_addredatar#   rA   mnemonicop_strs                 r   _get_table_info_disassemblyz)Check_syscall._get_table_info_disassemblyV   sH    
 	Q;;!3&DD!7&D[-t44	**+=>>FII% 	 	 	11111	 ,&t{8'<=|"''(:IqII/1~~dI/N/N 	 	+GT8V5   c!2!21!5!;!;!=!=>>G
 ! s   A* *B?Bc                     |                     |          }|                     ||          }|dk    r>|                     |j        ||          }|dk    rt                              d           dS |j        |fS )Nr   z$Unable to get system call table size)r   r   )r"   rf   rG   r#   vollogerror)r&   r)   
table_namer(   	table_symrF   s         r   _get_table_infozCheck_syscall._get_table_infox   s|    &&z22	55fgFF
??33I4EvwWWJQCDDDt *,,r   c           	   #     K   | j         j        | j        d                  }|                    d          j        }|dk    rd}nd}	 |                     |d|          }n0# t          j        $ r t          	                    d           Y d S w xY w||fg}	 |
                    d          }n# t          j        $ r d }Y nw xY w|.|                     |d|          }|                    d|f           |D ]\  }\  }}	|                    d	|                    d          ||	
          }
t          |
          D ]\  }}|st          |                    |                    }t!          |          dk    rbt"          j        |d         v r8t'          |d                             t"          j                  d                   nt'          |d                   }nd}dt+          j        |          ||t+          j        |          |ffV  ѐd S )Nr   pointerrI   32bit64bitsys_call_tablez.Unable to find the system call table. Exiting.ia32_sys_call_tablearray)object_typesubtypeoffsetcountr   rO   UNKNOWN)r:   rV   rW   get_typerA   rl   r   r    rh   ri   r"   r!   object	enumeratelist get_symbols_by_absolute_locationr9   r   BANGstrr\   r
   Hex)r&   r)   r(   rj   
table_infotablesia32_symbol	ia32_info	tableaddrtblsztablei	call_addrr   r0   s                  r   
_generatorzCheck_syscall._generator   ss     ,&t{8'<=!!),,1Q;; JJ J	--g7GPPJJ% 	 	 	LLIJJJ44	 z*+
	!,,-BCCKK% 	 	 	KKK	 ",,W6KVTTIMM7I.///.4  	  	*J*ENN#((33 	 #  E !*% 0 0  9  wGG	RRSSw<<!## %>WQZ77 GAJ,,Y^<<Q?@@@ __ H  )H $(33"$(33 	 	 	 	 	 	  	s$   A )B
BB* *B>=B>c                     t          j        dt          j        fdt          fdt
          fdt          j        fdt          fg|                                           S )NzTable Addressz
Table NameIndexzHandler AddresszHandler Symbol)r   TreeGridr
   r   r   r%   r   )r&   s    r   runzCheck_syscall.run   sX    ! ,"23s##"L$45!3' OO	
 	
 		
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer   r1   r=   rG   rf   rl   r   r   r@   r   r   r   r      s        ,,"+
j&>&S!T 
 
 
 [
  .
 
 
       D- - -= = =~

 

 

 

 

r   r   )r   r   loggingtypingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.renderersr
   	getLoggerr   rh   rQ   rP   ImportErrorPluginInterfacer   r@   r   r   <module>r      s  ' '            N N N N N N N N N N N N < < < < < < 4 4 4 4 4 4 8 8 8 8 8 8		8	$	$OOOLL   LLLw
 w
 w
 w
 w
G+ w
 w
 w
 w
 w
s    A AA