
    Z#f                         d Z ddlZddlZddlmZ ddlmZmZmZm	Z	 ddl
mZ ddlmZ ddlmZ  ej                   e      Z	 ddlZdZ G d
 dej,                        Zy# e$ r d	ZY w xY w)zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)List)	constants
exceptions
interfaces	renderers)requirements)plugins)format_hintsTFc                       e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zd Zd Zd	 Zd
 Zd Zy)Check_syscallz"Check system call table for hooks.)   r   r   returnc                 8    t        j                  ddg d      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures)r   ModuleRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/check_syscall.pyget_requirementszCheck_syscall.get_requirements   s%     ***?
 	
    c                 d   d}g }|j                   D ]Z  }t        j                  t        j                        5  |j                  |j                  |      j                  |f       ddd       \ t        |      }d}|D ]  \  }	}
|	|kD  s|	} n |dkD  rt        ||z
  |z        }|S # 1 sw Y   xY w)z7Returns the size of the table based on the next symbol.r   N)
symbols
contextlibsuppressr   SymbolErrorappend
get_symboladdresssortedint)self
table_addrptr_szvmlinuxretsymbol_listsnsorted_symbolssym_addresstmp_sym_addresssym_names              r   _get_table_size_next_symbolz)Check_syscall._get_table_size_next_symbol(   s    // 	IB$$Z%;%;< I""G$6$6r$:$B$BB#GHI I	I  ,)7 	%OX+-	
 ?{Z/69:C
I Is   -B&&B/	c                     t        | j                  j                  |j                     j                  D cg c]  }|j                  d      r| c}      S c c}w )zreturns the number of symbols that start with __syscall_meta__ this
        is a fast way to determine the number of system calls, but not the most
        accurate.__syscall_meta__)lencontextsymbol_spacesymbol_table_namer   
startswith)r&   r)   syms      r   _get_table_size_metaz"Check_syscall._get_table_size_meta?   sV    
   <<44W5N5NOWW>>"45 
 	
s   Ac                     | j                  |      }| j                  |||      }||fD cg c]
  }|dkD  s	| }}t        |      }|S c c}w )Nr   )r:   r1   min)	r&   r'   r(   r)   table_size_metatable_size_symssizesizes
table_sizes	            r   _get_table_info_otherz#Check_syscall._get_table_info_otherL   sY    33G<:::vwW#2O"DQ$qQQZ
	 Rs
   
A	A	c                    d}t         s|S |dk(  rd}t        j                  }nd}t        j                  }t        j                  t        j
                  |      }	 |j                  |      j                  }| j                  j                  | j                  d      }| j                  j                  j                  |j                  |d      }	|j!                  |	|      D ]=  \  }
}}}|dk(  st#        |j%                  d	      d
   j'                               dz  } |S  |S # t        j                  $ r
}Y d}~yd}~ww xY w)zFind the size of the system call table by disassembling functions
        that immediately reference it in their first instruction This is in the
        form 'cmp reg,NR_syscalls'.r      sysenter_do_callsystem_call_fastpathNr      CMP,   i  )has_capstonecapstone
CS_MODE_32
CS_MODE_64CsCS_ARCH_X86r"   r#   r   r    r5   modulesconfiglayersread
layer_namedisasm_liter%   splitstrip)r&   r(   r)   rA   syscall_entry_funcmodemd	func_addredatar#   r?   mnemonicop_strs                 r   _get_table_info_disassemblyz)Check_syscall._get_table_info_disassemblyV   s-    
Q;!3&&D!7&&D[[--t4	**+=>FFI
 ,,&&t{{8'<=||""''(:(:IqI/1~~dI/N 	+GT8V5  c!21!5!;!;!=>G
	
  %% 		s   D   D=8D=c                     |j                  |      }| j                  ||      }|dk(  r8| j                  |j                  ||      }|dk(  rt        j                  d       y|j                  |fS )Nr   z$Unable to get system call table size)r   r   )r"   ra   rB   r#   vollogerror)r&   r)   
table_namer(   	table_symrA   s         r   _get_table_infozCheck_syscall._get_table_infox   sm    &&z2	55fgF
?33I4E4EvwWJQCD  *,,r   c           	   #     K   | j                   j                  | j                  d      }|j                  d      j                  }|dk(  rd}nd}	 | j                  |d|      }||fg}	 |j                  d      }|&| j                  |d|      }|j                  d|f       |D ]  \  }\  }}	|j                  d	|j                  d      ||	
      }
t        |
      D ]  \  }}|s	t        |j                  |            }t!        |      dkD  rRt"        j$                  |d   v r.t'        |d   j)                  t"        j$                        d         nt'        |d         }nd}dt+        j,                  |      ||t+        j,                  |      |ff   y # t        j                  $ r t        j                  d       Y y w xY w# t        j                  $ r d }Y cw xY ww)Nr   pointerrD   32bit64bitsys_call_tablez.Unable to find the system call table. Exiting.ia32_sys_call_tablearray)object_typesubtypeoffsetcountr   rJ   UNKNOWN)r5   rQ   rR   get_typer?   rg   r   r    rc   rd   r"   r!   object	enumeratelist get_symbols_by_absolute_locationr4   r   BANGstrrW   r
   Hex)r&   r)   r(   re   
table_infotablesia32_symbol	ia32_info	tableaddrtblsztablei	call_addrr   r0   s                  r   
_generatorzCheck_syscall._generator   s     ,,&&t{{8'<=!!),11Q; J J	--g7GPJ
 z*+
	!,,-BCK ",,W6KVTIMM7I./.4  	*J*ENN#((3 	 # E !*% 0 9 wGG	RSw<!# %>>WQZ7 GAJ,,Y^^<Q?@ _   )H $((3"$((3 	 	 	% %% 	LLIJ	 %% 	K	sO   AG F "G (G 9DG (G>G  GG GG GG c                     t        j                  dt        j                  fdt        fdt
        fdt        j                  fdt        fg| j                               S )NzTable Addressz
Table NameIndexzHandler AddresszHandler Symbol)r   TreeGridr
   r{   rz   r%   r   )r&   s    r   runzCheck_syscall.run   sY    !! ,"2"23s##"L$4$45!3' OO	
 		
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer   r1   r:   rB   ra   rg   r   r    r   r   r   r      sZ    ,"+
j&>&>&S&S!T 
 
.
 D-=~

r   r   )r   r   loggingtypingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.renderersr
   	getLoggerr   rc   rL   rK   ImportErrorPluginInterfacer   r   r   r   <module>r      sk   '    N N < 4 8			8	$L
w
G++ w
	  Ls   A A('A(