
    Xf6                         d dl Z d dlmZ d dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 de
j                  ZdS )    N)List)
exceptions
interfaces)	renderers)requirements)plugins)format_hints)mac)lsmodc                   ^    e Zd ZdZdZedeej        j	                 fd            Z
d Zd ZdS )Check_syscallz"Check system call table for hooks.   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)   r   r   )r   	componentversionr   r   )r   pluginr   )r   ModuleRequirementVersionRequirementr
   MacUtilitiesPluginRequirementr   Lsmod)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/check_syscall.pyget_requirementszCheck_syscall.get_requirements   sr     *6()4  
 +3+;Y   *U[)  
 	
    c              #     K   | j         j        | j        d                  }t          j                            | j         | j        d                   }t          j                            | j         |j	        ||          }|
                    d          }t          |          D ]\  }}	 |j                                        j        j        }n# t           j        $ r Y ;w xY w|r|dk    rHt          j                            | j         ||| j        d                   \  }}	dt'          j        |j        j                  d|t'          j        |          ||	ffV  d S )Nr   sysent)symbol_namer   SysCall)contextmodulesconfigr   r!   list_modulesr
   r   generate_kernel_handler_info
layer_nameobject_from_symbol	enumeratesy_calldereferencevoloffsetr   InvalidAddressExceptionlookup_module_addressr	   Hex)
selfr   modshandlerstableient	call_addrmodule_namer(   s
             r#   
_generatorzCheck_syscall._generator'   sv     %dk(&;<{''dk(6KLL#@@L&+VT
 
 ))h)??&& 	 	FAsK33559@		5     	Q'*'7'M'Mh	4;x3H( ($K
  $UY%566 $Y//
 
 
 
 
	 	s   '#CCCc           	          t          j        dt          j        fdt          fdt
          fdt          j        fdt          fdt          fg|                                           S )NzTable Addressz
Table NameIndexzHandler AddresszHandler ModulezHandler Symbol)r   TreeGridr	   r8   strintrA   )r9   s    r#   runzCheck_syscall.runK   s`    ! ,"23s##"L$45!3'!3' OO

 

 
	
r%   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer$   rA   rG    r%   r#   r   r      so        ,,"+
j&>&S!T 
 
 
 [
" " "H
 
 
 
 
r%   r   )loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr	   volatility3.framework.symbolsr
   volatility3.plugins.macr   	getLoggerrH   vollogPluginInterfacer   rP   r%   r#   <module>r\      s           8 8 8 8 8 8 8 8 + + + + + + < < < < < < 4 4 4 4 4 4 8 8 8 8 8 8 - - - - - - ) ) ) ) ) )		8	$	$D
 D
 D
 D
 D
G+ D
 D
 D
 D
 D
r%   