
    Xf                         d dl Z d dlmZ d dlZd dlmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ  e j        e          Z G d dej                  ZdS )    N)List)
exceptions
interfaces)	renderers)requirements)plugins)utility)format_hints)mac)lsmodc                   l    e Zd ZdZdZedeej        j	                 fd            Z
d ZddZd Zd	 Zd
S )Check_sysctlz Check sysctl handlers for hooks.   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)   r   r   )r   	componentversionr   r   )r   pluginr   )r   ModuleRequirementVersionRequirementr   MacUtilitiesPluginRequirementr   Lsmod)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/check_sysctl.pyget_requirementszCheck_sysctl.get_requirements   sr     *6()4  
 +3+;Y   *U[)  
 	
    c                     ddd}d}||v rM||         }	 |                     |          }n# t          j        $ r d }Y nw xY w|t          j        |          }|S )Nhostname
domainname)r(   nisdomainname symbol_name)object_from_symbolr   SymbolErrorr	   array_to_string)selfr   r   known_sysctlsvar_strvar_name	var_arrays          r$   _parse_global_variable_sysctlsz+Check_sysctl._parse_global_variable_sysctls)   s    ")
 

 =  $T*H!"55(5KK		) ! ! ! 			! $!1)<<s   , A A r   c              #     K   t          |          t          j        j        j        k    r'|                                                    d          }|j        }|dk    r6	 |j        j	                                        }n# t          j        $ r Y d S w xY w|r	 t          j        |j        d          }n# t          j        $ r d}Y nw xY wt          |          dk    rd S |                                }	 |j                                        j        j        }n# t          j        $ r d}Y nw xY w|j        }|dk    s|dk    r|                     ||          }	n|dk    r2|j        dk    r$|                     ||j        d          D ]}
|
V  d}	n|d	v rM	 t/          |                                                    d
                    }	nR# t          j        $ r d}	Y n?w xY w|dk    r3	 t          j        |j        d          }	n# t          j        $ r d}	Y nw xY w|}	|||	fV  	 |j        j	        }n# t          j        $ r Y d S w xY w|d S d S )Nsysctl_oid_listr      r+   CTLTYPE_NODEr   )	recursiveNode)CTLTYPE_INTCTLTYPE_QUADCTLTYPE_OPAQUEintz-1CTLTYPE_STRING@   )typevolatility3	frameworkobjectsPointerdereferencecast	slh_firstoid_linksle_nextr   InvalidAddressExceptionr	   pointer_to_stringoid_namelenget_ctltypeoid_arg1voloffsetr6   oid_handler_process_sysctl_liststr)r1   r   sysctl_listr;   sysctlr   ctltypearg1_ptrarg1valinfos              r$   rV   z!Check_sysctl._process_sysctl_list>   s      5 = EEE%1133889JKKK&>>1==??5   tt  0	0#FF5    4yyA~~((**G!?6688<C5    ?DqyyHMM99&$GGN**%** $ 9 91 !: ! ! # # #



MMMd..0055e<<==CC!9   CCC ,,,!3FORHHCC!9   CCC 4%%%%15   _  0	 0	 0	 0	 0	sl   A> >BBB3 3CC4#D D,+D,4G GG)H HH%H2 2IIc           	   #   t  K   | j         j        | j        d                  }t          j                            | j         | j        d                   }t          j                            | j         |j	        ||          }|
                    d          }|                     ||          D ]\  }}}	 |j        }n# t          j        $ r Y  w xY wt          j                            | j         ||| j        d                   \  }	}
d||j        |                                t%          j        |          ||	|
ffV  d S )Nr   sysctl__childrenr,   r   )contextmodulesconfigr   r"   list_modulesr   r    generate_kernel_handler_info
layer_namer.   rV   rU   r   rM   lookup_module_address
oid_number	get_permsr
   Hex)r1   r   modshandlersrX   rY   r   r]   
check_addrmodule_namer-   s              r$   
_generatorzCheck_sysctl._generator|   s`     %dk(&;<{''dk(6KLL#@@L&+VT
 
 //<N/OO!%!:!:6;!O!O 	 	FD##/

5    (+'7'M'Mh
DK4I( ($K
 %$$&& $Z00    	 	s   /B77C	C	c           
          t          j        dt          fdt          fdt          fdt          j        fdt          fdt          fdt          fg|                                           S )NNameNumberPermszHandler AddressValuezHandler ModulezHandler Symbol)r   TreeGridrW   r@   r
   rj   ro   )r1   s    r$   runzCheck_sysctl.run   sb    !3#"L$45#!3'!3' OO
 
 	
r&   N)r   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer%   r6   rV   ro   rv    r&   r$   r   r      s        **"+
j&>&S!T 
 
 
 [
  *< < < <|     D
 
 
 
 
r&   r   )loggingtypingr   rD   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr	   volatility3.framework.renderersr
   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrw   vollogPluginInterfacer   r   r&   r$   <module>r      s              8 8 8 8 8 8 8 8 + + + + + + < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 - - - - - - ) ) ) ) ) )		8	$	$V
 V
 V
 V
 V
7* V
 V
 V
 V
 V
r&   