
    #f2                         d dl mZ d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  ej                  e      Z G d	 d
ej$                  j&                        Zy)    )ListN)	constants
interfaces)	renderers)requirements)utility)format_hints)pslistc                   j    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zd Zy)	MalfindzCLists process memory ranges that potentially contain injected code.   r   r   returnc                     t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dd	t        d
      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr
   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/malfind.pyget_requirementszMalfind.get_requirements   s\     ***?
 **fmmY ((< 	
 	
    c              #   (  K   |j                         }|sy| j                  j                  |   }|j                  j	                         D ]  }|j                  | j                  |      }t        j                  d|j                   d| dt        |j                         dt        |j                                |j                  |      s|j                  | j                  |      dk7  s|j                  |j                  dd	      }||f  yw)
zMGenerate memory regions for a process that may contain injected
        code.NzInjections : processing PID z : VMA z : -z[vdso]@   T)pad)add_process_layercontextlayersmmget_vma_iterget_namevollogdebugr   hexvm_startvm_endis_suspiciousread)selftaskproc_layer_name
proc_layervmavma_namedatas          r#   _list_injectionszMalfind._list_injections)   s      002\\((9
77'') 
	 C||DLL$7HLL.txxjzSQTQ]Q]M^L__`adeheoeoap`qr !!*-LLt4@!s||RTB4i
	 s   CDD+'Dc              #     K   | j                   j                  | j                  d      }| j                   j                  j	                  |j
                  t        j                  z   dz         j                  dk(  rd}nd}|D ]  }t        j                  |j                        }| j                  |      D ]  \  }}|rd}nd}t        j                  j                  ||j                   |      }	d|j"                  |t%        j&                  |j                         t%        j&                  |j(                        |j+                         t%        j,                  |      |	ff   y w)	Nr   pointer   TFintelintel64r   )r+   modulesconfigsymbol_spaceget_typesymbol_table_namer   BANGsizer   array_to_stringcommr>   r   r   Disassemblyr3   r   r	   Hexr4   get_protectionHexBytes)
r7   tasksvmlinuxis_32bit_archr8   process_namer;   r=   architecturedisasms
             r#   
_generatorzMalfind._generator?   s9    ,,&&t{{8'<=LL%%..))INN:YFd
 !M!M 	D"22499=L!2248 	T #*L#,L#--99#,,
 $$((6$((4**,$--d3 	s   E E"c           
         t         j                  j                  | j                  j	                  dd             }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        fdt        j                  fdt        j
                  j                  fg| j                  t         j                  j                  | j                   | j                  d	   |
                  S )Nr   PIDProcessStartEnd
ProtectionHexdumpDisasmr   )filter_func)r
   r   create_pid_filterrE   getr   TreeGridr!   strr	   rN   rP   r   rM   rW   
list_tasksr+   )r7   r`   s     r#   runzMalfind.runf   s    mm55dkkooeT6RS!!C ,**+(()s#L112://;;< OO((LL$++h"7[ ) 
 	
r%   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer$   r>   rW   rf    r%   r#   r   r      sE    M"+
j&>&>&S&S!T 
 
$ ,%N
r%   r   )typingr   loggingvolatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr	   volatility3.plugins.linuxr
   	getLoggerrg   r0   pluginsPluginInterfacer   ro   r%   r#   <module>rz      sK   
   7 + < 1 8 ,			8	$g
j  00 g
r%   