
    #f2                         d dl mZ d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  ej        e          Z G d	 d
ej        j                  ZdS )    )ListN)	constants
interfaces)	renderers)requirements)utility)format_hints)pslistc                   d    e Zd ZdZdZedeej        j	                 fd            Z
d Zd Zd ZdS )	MalfindzCLists process memory ranges that potentially contain injected code.   r   r   returnc                     t          j        ddg d          t          j        dt          j        d          t          j        dd	t          d
          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr
   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/malfind.pyget_requirementszMalfind.get_requirements   su     **???  
 *fmY   (< 	  
 	
    c              #     K   |                                 }|sdS | j        j        |         }|j                                        D ]}|                    | j        |          }t                              d|j         d| dt          |j
                   dt          |j                              |                    |          rB|                    | j        |          dk    r#|                    |j
        dd	          }||fV  dS )
zMGenerate memory regions for a process that may contain injected
        code.NzInjections : processing PID z : VMA z : -z[vdso]@   T)pad)add_process_layercontextlayersmmget_vma_iterget_namevollogdebugr   hexvm_startvm_endis_suspiciousread)selftaskproc_layer_name
proc_layervmavma_namedatas          r#   _list_injectionszMalfind._list_injections)   s      0022 	4\(9
7'')) 
	  
	 C||DL$77HLLrtxrrrrSQTQ]M^M^rradeheoapaprr   !!*-- LLt44@@!s|RTBB4i
	  
	 r%   c              #   \  K   | j         j        | j        d                  }| j         j                            |j        t          j        z   dz             j        dk    rd}nd}|D ]}t          j
        |j                  }|                     |          D ]\  }}|rd}nd}t          j                            ||j        |          }	d|j        |t%          j        |j                  t%          j        |j                  |                                t%          j        |          |	ffV  d S )	Nr   pointer   TFintelintel64r   )r+   modulesconfigsymbol_spaceget_typesymbol_table_namer   BANGsizer   array_to_stringcommr>   r   r   Disassemblyr3   r   r	   Hexr4   get_protectionHexBytes)
r7   tasksvmlinuxis_32bit_archr8   process_namer;   r=   architecturedisasms
             r#   
_generatorzMalfind._generator?   sU     ,&t{8'<=L%..)IN:YF  
 !MM!M 	 	D"249==L!22488  	T  -#*LL#,L#-99#, 
 $$(66$(44**,,$-d33    	 	r%   c           
         t           j                            | j                            dd                     }t          j        dt          fdt          fdt          j
        fdt          j
        fdt          fdt          j        fdt          j        j        fg|                     t           j                            | j        | j        d	         |
                              S )Nr   PIDProcessStartEnd
ProtectionHexdumpDisasmr   )filter_func)r
   r   create_pid_filterrE   getr   TreeGridr!   strr	   rN   rP   r   rM   rW   
list_tasksr+   )r7   r`   s     r#   runzMalfind.runf   s    m55dkooeT6R6RSS!C ,*+()s#L12:/;< OO((L$+h"7[ )   
 
 	
r%   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer$   r>   rW   rf    r%   r#   r   r      s~        MM"+
j&>&S!T 
 
 
 [
$     ,% % %N
 
 
 
 
r%   r   )typingr   loggingvolatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr	   volatility3.plugins.linuxr
   	getLoggerrg   r0   pluginsPluginInterfacer   ro   r%   r#   <module>rz      s   
        7 7 7 7 7 7 7 7 + + + + + + < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 , , , , , ,		8	$	$g
 g
 g
 g
 g
j 0 g
 g
 g
 g
 g
r%   