
    *1f                         d dl Z d dlmZmZ d dlmZmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 dej        j                  ZdS )    N)IterableTuple)
interfaces	renderers	constants
exceptions)requirements)format_hints)utility)intermed)elf)pslistc            	       p   e Zd ZdZdZdZed             Zdede	de
j        j        fdZd	e
j        j        dede
j        j        fd
Zd	e
j        j        dee	ef         fdZdee
j        j                 deeee	e	ef                  fdZd Zdee
j        j                 deee	ef                  fdZd ZdS )LibraryListz)Enumerate libraries loaded into processes)   r   r   )   r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	d
t          d          gS )NkernelzLinux kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionpidszFilter on specific process IDsT)r   r   element_typeoptional)r	   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/library_list.pyget_requirementszLibraryList.get_requirements   st     **()4  
 *fmY   (< 	  
 	
    proc_layer_name	vma_startreturnc              #     K   t           j                            | j        | j        ddt
          j                  }| j                            |t          j	        z   dz   ||          }|r|
                                sdS | j        j        | j        d                  }	 |                    |j                  D ]}|j        r|j        r|V  dS # t"          j        $ r Y dS w xY w)a  Get the ELF link map objects for the given VMA address

        Args:
            proc_layer_name (str): Name of the process layer
            vma_start (int): VMA start address

        Yields:
            ELF link map objects for the given VMA address
        linuxr   )class_typesElf)offset
layer_nameNr   )r   IntermediateSymbolTablecreatecontextconfig_pathr   r-   objectr   BANGis_validmodulesconfigget_link_mapssymbol_table_namel_addrl_namer   InvalidAddressException)selfr(   r)   elf_table_name
elf_objectr   link_maps          r%   _get_libdl_librariesz LibraryList._get_libdl_libraries.   s      "9@@L A 
 
 \((Y^+e3& ) 
 

  	!4!4!6!6 	4%dk(&;<	&44V5MNN # #? #x #"NNN# # 1 	 	 	DD	s   /C C"!C"taskc              #      K   t                      }|j                                        D ]H}|                     ||j                  D ]*}|j        |v r|V  |                    |j                   +IdS )zGet the ELF link maps objects for a task

        Args:
            task (task_struct): A reference task
            proc_layer_name (str): Name of the process layer

        Yields:
            ELF link map objects
        N)setmmget_vma_iterrC   vm_startr<   add)r?   rD   r(   link_map_seenvmarB   s         r%   _get_libdl_mapszLibraryList._get_libdl_mapsT   s       7'')) 	3 	3C 55os|TT 3 3?m33!!(/22223	3 	3r'   c              #      K   |                                 }|sdS |                     ||          D ]$}|                                }|s|j        |fV  %dS )zGet the task libraries from the ELF headers found within the memory maps

        Args:
            task (task_struct): The reference task

        Yields:
            Tuples with a ELF link map address and name
        N)add_process_layerrM   get_namer<   )r?   rD   r(   elf_link_mapr   s        r%   _get_task_librarieszLibraryList._get_task_librariesj   s       0022 	F 00GG 	, 	,L((**D %t+++++		, 	,r'   tasksc              #      K   |D ]C}t          j        |j                  }|                     |          D ]\  }}||j        ||fV  DdS )a  Get the task libraries from the ELF headers found within the memory maps for
        all the tasks.

        Args:
            tasks: An iterable of tasks

        Yields:
            Tuples with a task name, task tgid, an ELF link map address and name
        N)r   array_to_stringcommrR   tgid)r?   rS   rD   	task_namelinkmap_addrlinkmap_names         r%   _get_tasks_librariesz LibraryList._get_tasks_libraries   s{        	G 	GD/	::I.2.F.Ft.L.L G G*lL,FFFFFG	G 	Gr'   c                 @    |\  }}}}||t          j        |          |fS )N)r
   Hex)r?   fieldsrX   task_pidaddrr   s         r%   _format_fieldszLibraryList._format_fields   s*    *0'	8T4(L$4T$:$:D@@r'   c              #   l   K   |                      |          D ]}d|                     |          fV  d S )Nr   )r[   ra   )r?   rS   r^   s      r%   
_generatorzLibraryList._generator   sQ       //66 	1 	1FT((0000000	1 	1r'   c                 v   | j                             d          }t          j                            |          }t          j                            | j        | j         d         |          }dt          fdt          fdt          j
        fdt          fg}t          j        ||                     |                    S )Nr   r   )filter_funcNamePidLoadAddressPath)r9   getr   r!   create_pid_filter
list_tasksr3   strr#   r
   r]   r   TreeGridrc   )r?   r   
pid_filterrS   headerss        r%   runzLibraryList.run   s    {v&&]44T::
((L$+h/Z ) 
 

 SMCLL,-SM	
 !'4??5+A+ABBBr'   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr&   rm   r#   r   objectsObjectInterfacerC   rM   r   rR   r   r[   ra   rc   rq    r'   r%   r   r      s       33"+H
 
 [
$$"$/2$			+$ $ $ $L3&63IL3			+3 3 3 3,,&6,	sCx, , , ,*G
*:;G 
%S#s*+	,G G G G$A A A1j0@A1	%U
#	$1 1 1 1C C C C Cr'   r   )loggingtypingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.renderersr
   volatility3.framework.objectsr   volatility3.framework.symbolsr   .volatility3.framework.symbols.linux.extensionsr   volatility3.plugins.linuxr   	getLoggerrr   vollogpluginsPluginInterfacer   r{   r'   r%   <module>r      s  
  " " " " " " " " N N N N N N N N N N N N < < < < < < 8 8 8 8 8 8 1 1 1 1 1 1 2 2 2 2 2 2 > > > > > > , , , , , , 
	8	$	$UC UC UC UC UC*$4 UC UC UC UC UCr'   