
    *1f                         d dl Z d dlmZmZ d dlmZmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j*                  e      Z G d
 dej0                  j2                        Zy)    N)IterableTuple)
interfaces	renderers	constants
exceptions)requirements)format_hints)utility)intermed)elf)pslistc            	          e Zd ZdZdZdZed        Zdede	de
j                  j                  fdZd	e
j                  j                  dede
j                  j                  fd
Zd	e
j                  j                  dee	ef   fdZdee
j                  j                     deeee	e	ef      fdZd Zdee
j                  j                     deee	ef      fdZd Zy)LibraryListz)Enumerate libraries loaded into processes)   r   r   )   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      gS )NkernelzLinux kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionpidszFilter on specific process IDsT)r   r   element_typeoptional)r	   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/library_list.pyget_requirementszLibraryList.get_requirements   sa     ***()4
 **fmmY ((< 	
 	
    proc_layer_name	vma_startreturnc              #     K   t         j                  j                  | j                  | j                  ddt
        j                        }| j                  j                  |t        j                  z   dz   ||      }|r|j                         sy| j                  j                  | j                  d      }	 |j                  |j                        D ]   }|j                  s|j                   s| " y# t"        j$                  $ r Y yw xY ww)a  Get the ELF link map objects for the given VMA address

        Args:
            proc_layer_name (str): Name of the process layer
            vma_start (int): VMA start address

        Yields:
            ELF link map objects for the given VMA address
        linuxr   )class_typesElf)offset
layer_nameNr   )r   IntermediateSymbolTablecreatecontextconfig_pathr   r-   objectr   BANGis_validmodulesconfigget_link_mapssymbol_table_namel_addrl_namer   InvalidAddressException)selfr(   r)   elf_table_name
elf_objectr   link_maps          r%   _get_libdl_librariesz LibraryList._get_libdl_libraries.   s      "99@@LL A 
 \\((Y^^+e3& ) 

 !4!4!6%%dkk(&;<	&44V5M5MN #??x"N# 11 		s6   B2D5*C4  C4 -C4 3D4D
D	D

Dtaskc              #      K   t               }|j                  j                         D ]Q  }| j                  ||j                        D ]0  }|j
                  |v r| |j                  |j
                         2 S yw)zGet the ELF link maps objects for a task

        Args:
            task (task_struct): A reference task
            proc_layer_name (str): Name of the process layer

        Yields:
            ELF link map objects
        N)setmmget_vma_iterrC   vm_startr<   add)r?   rD   r(   link_map_seenvmarB   s         r%   _get_libdl_mapszLibraryList._get_libdl_mapsT   sq      77'') 	3C 55os||T 3??m3!!(//23	3s   A:A<c              #      K   |j                         }|sy| j                  ||      D ]%  }|j                         }|s|j                  |f ' yw)zGet the task libraries from the ELF headers found within the memory maps

        Args:
            task (task_struct): The reference task

        Yields:
            Tuples with a ELF link map address and name
        N)add_process_layerrM   get_namer<   )r?   rD   r(   elf_link_mapr   s        r%   _get_task_librarieszLibraryList._get_task_librariesj   s]      002 00G 	,L((*D%%t++		,s   AAtasksc              #      K   |D ]L  }t        j                  |j                        }| j                  |      D ]  \  }}||j                  ||f  N yw)a  Get the task libraries from the ELF headers found within the memory maps for
        all the tasks.

        Args:
            tasks: An iterable of tasks

        Yields:
            Tuples with a task name, task tgid, an ELF link map address and name
        N)r   array_to_stringcommrR   tgid)r?   rS   rD   	task_namelinkmap_addrlinkmap_names         r%   _get_tasks_librariesz LibraryList._get_tasks_libraries   sa       	GD//		:I.2.F.Ft.L G*lL,FFG	Gs   AAc                 B    |\  }}}}||t        j                  |      |fS )N)r
   Hex)r?   fieldsrX   task_pidaddrr   s         r%   _format_fieldszLibraryList._format_fields   s*    *0'	8T4(L$4$4T$:D@@r'   c              #   b   K   | j                  |      D ]  }d| j                  |      f  y w)Nr   )r[   ra   )r?   rS   r^   s      r%   
_generatorzLibraryList._generator   s8      //6 	1FT((000	1s   -/c                    | j                   j                  d      }t        j                  j	                  |      }t        j                  j                  | j                  | j                   d   |      }dt        fdt        fdt        j                  fdt        fg}t        j                  || j                  |            S )Nr   r   )filter_funcNamePidLoadAddressPath)r9   getr   r!   create_pid_filter
list_tasksr3   strr#   r
   r]   r   TreeGridrc   )r?   r   
pid_filterrS   headerss        r%   runzLibraryList.run   s    {{v&]]44T:
((LL$++h/Z ) 

 SMCLL,,-SM	
 !!'4??5+ABBr'   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr&   rm   r#   r   objectsObjectInterfacerC   rM   r   rR   r   r[   ra   rc   rq    r'   r%   r   r      s(   3"+H
 
$$"$/2$				+	+$L3&&663IL3				+	+3,,&&66,	sCx,*G
**::;G 
%S#s*+	,G$A1j00@@A1	%U
#	$1Cr'   r   )loggingtypingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.renderersr
   volatility3.framework.objectsr   volatility3.framework.symbolsr   .volatility3.framework.symbols.linux.extensionsr   volatility3.plugins.linuxr   	getLoggerrr   vollogpluginsPluginInterfacer   r{   r'   r%   <module>r      sU   
  " N N < 8 1 2 > , 
		8	$UC*$$44 UCr'   