
    [
#g                         d dl mZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  G d dej                  j                         Zy	)
    )IterableListTuple)
interfaces	renderers)requirements)format_hints)yarascan)pslistc                       e Zd ZdZdZdZedeej                  j                     fd       Zd Zedej                  j                  deeeef      fd       Zd	 Zy
)VmaYaraScanz4Scans all virtual memory areas for tasks using yara.)      r   )   r   r   returnc           	      J   t        j                  dt        dd      t        j                  dt        j
                  d      t        j                  dt        j                  d      t        j                  d	d
g d      g}t        j                  j                         }||z   S )Npidz9Process IDs to include (all other processes are excluded)T)nameelement_typedescriptionoptionalr   )r   r   r   )r   pluginversionr
   kernelzLinux kernel)Intel32Intel64AArch64)r   r   architectures)
r   ListRequirementintPluginRequirementr   PsListr
   YaraScanModuleRequirement get_yarascan_option_requirements)clsvmayarascan_requirementsyarascan_requirementss      a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/vmayarascan.pyget_requirementszVmaYaraScan.get_requirements   s     (( W	 **fmmY **(9(99 ***?$
 * !) 1 1 R R T %'???    c              #     K   t         j                  j                  t        | j                              }t
        j                  j                  | j                  j                  dd             }t
        j                  j                  | j                  | j                  d   |      D ]S  }|j                         }|s| j                  j                  |   }| j                  |      D ]  \  }}|j                  |j                  |||z
  d            D ]  }t         j                  j!                         rv|j"                  D ]f  }	|	j$                  D ]U  }
dt'        j(                  |
j*                  |z         |j,                  |j.                  |	j0                  |
j2                  ff W h |j"                  D ];  \  }}}dt'        j(                  ||z         |j4                  |j.                  ||ff =   V y w)Nr   r   )contextvmlinux_module_namefilter_funcT)datar   )r
   r#   process_yara_optionsdictconfigr   r"   create_pid_filterget
list_tasksr-   add_process_layerlayersget_vma_mapsmatchreadyara_returns_instancesstrings	instancesr	   HexoffsetUniqueProcessIdrule
identifiermatched_datatgid)selfrulesr/   taskproc_layer_name
proc_layerstartendr:   match_stringinstancer@   r   values                 r)   
_generatorzVmaYaraScan._generator1   s    !!66tDKK7HI mm55dkkooeT6RSMM,,LL $H 5# - 
D #446O" ,,_=J"//5
s"[[#eTB ) E  ((??A,1MML,8,B,B&'$0$4$4X__u5L$M$($8$8$)JJ$0$;$;$,$9$9*" '" !" -C -: 49==/FD%"# , 0 0% @ $		 %

 $ %& #  4A 6
s   G=G?rH   c              #      K   | j                   rI| j                   j                         D ]+  }|j                  |j                  z
  }|j                  |f - yyw)a  Creates a map of start/end addresses for each virtual memory area in a task.

        Args:
            task: The task object of which to read the vmas from

        Returns:
            An iterable of tuples containing start and end addresses for each descriptor
        N)mmget_vma_itervm_endvm_start)rH   vmavm_sizes      r)   r9   zVmaYaraScan.get_vma_maps]   sL      77ww++-**s||3||W-- . s   AAc                     t        j                  dt        j                  fdt        fdt
        fdt
        fdt        fg| j                               S )NOffsetPIDRule	ComponentValue)r   TreeGridr	   r?   r    strbytesrP   )rF   s    r)   runzVmaYaraScan.runn   sR    !!<++,c"%  OO	
 		
r+   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer*   rP   staticmethodobjectsObjectInterfacer   r   r    r9   ra    r+   r)   r   r      s    >"+H@j&>&>&S&S!T @ @8*X .  00.	%S/	". . 

r+   r   N)typingr   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.pluginsr
   volatility3.plugins.linuxr   pluginsPluginInterfacer   rn   r+   r)   <module>rw      s6   
 ) ( 7 < 8 ( ,j
*$$44 j
r+   