
    [
#g3
                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ  e j                  e      Z G d de
j                         Zy)	    N)List)	renderers
interfaces
exceptions)format_hints)plugins)requirementsc                       e Zd ZdZdZdZedeej                  j                     fd       Zdej                  j                  dedej                  j                   fdZd	 Zd
 Zy)EBPFzEnumerate eBPF programs)   r   r   )   r   r   returnc                 8    t        j                  ddddg      gS )NkernelzLinux kernelIntel32Intel64)namedescriptionarchitectures)r	   ModuleRequirement)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/ebpf.pyget_requirementszEBPF.get_requirements   s*     ***()4
 	
    contextvmlinux_module_namec              #      K   |j                   |   }|j                  d      st        j                  d      |j	                  d      }|j                         D ]  }|j                  d|d      }|  yw)a   Enumerate eBPF programs walking its IDR.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            vmlinux_module_name: The name of the kernel module on which to operate
        Yields:
            eBPF program objects
        prog_idrz1Cannot find the eBPF prog idr. Unsupported kernelbpf_progT)offsetabsoluteN)modules
has_symbolr   VolatilityExceptionobject_from_symbolget_entriesobject)selfr   r   vmlinuxr   	page_addrr   s          r   get_ebpf_programszEBPF.get_ebpf_programs    sy      //"56!!*-00C  --j9!--/I~~jT~RHN 0s   A5A7c              #     K   | j                  | j                  | j                  d         D ]  }|j                  j                  }|j                         xs t        j                         }|j                         xs t        j                         }|j                         xs t        j                         }t        j                  |      |||f}d|f  y w)Nr   r   )r+   r   configvolr    get_typer   NotAvailableValueget_tagget_namer   Hex)r(   prog	prog_addr	prog_typeprog_tag	prog_namefieldss          r   
_generatorzEBPF._generator9   s     **4<<X9NODIH9+F+F+HI||~F)D)D)FHH9+F+F+HI"&&y19h	RFf+ Ps   CCc                     dt         j                  fdt        fdt        fdt        fg}t        j                  || j                               S )NAddressNameTagType)r   r3   strr   TreeGridr:   )r(   headerss     r   runzEBPF.runB   sH    (()SMCLSM	
 !!'4??+<==r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer   r   ContextInterfacer@   objectsObjectInterfacer+   r:   rC    r   r   r   r      s}    !"+H
j&>&>&S&S!T 
 
##44 ! 
			+	+	2>r   r   )loggingtypingr   volatility3.frameworkr   r   r   volatility3.framework.renderersr    volatility3.framework.interfacesr   #volatility3.framework.configurationr	   	getLoggerrD   vollogPluginInterfacer   rP   r   r   <module>rZ      s@      C C 8 4 <			8	$:>7"" :>r   