
    Xf                         d dl Z d dlmZ d dlZd dlmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ  e j(                  e      Z G d dej.                        Zy)    N)List)
exceptions
interfaces)	renderers)requirements)plugins)utility)format_hints)mac)lsmodc                   r    e Zd ZdZdZedeej                  j                     fd       Z
d Zd
dZd Zd Zy	)Check_sysctlz Check sysctl handlers for hooks.   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)   r   r   )r   	componentversionr   r   )r   pluginr   )r   ModuleRequirementVersionRequirementr   MacUtilitiesPluginRequirementr   Lsmod)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/check_sysctl.pyget_requirementszCheck_sysctl.get_requirements   sb     **6()4
 ++3+;+;Y **U[[)
 	
    c                     ddd}d}||v r/||   }	 |j                  |      }|t        j                  |      }|S # t        j                  $ r d }Y 0w xY w)Nhostname
domainname)r(   nisdomainname symbol_name)object_from_symbolr   SymbolErrorr	   array_to_string)selfr   r   known_sysctlsvar_strvar_name	var_arrays          r$   _parse_global_variable_sysctlsz+Check_sysctl._parse_global_variable_sysctls)   sy    ")

 = $T*H!"55(5K	 $!11)< )) ! 	!s   = AAc              #     K   t        |      t        j                  j                  j                  k(  r|j                         j                  d      }|j                  }|dk7  r%	 |j                  j                  j                         }|rP	 t        j                  |j                  d      }t        |      dk(  ry |j!                         }	 |j"                  j                         j$                  j&                  }|j"                  }|dk(  s|dk(  r| j)                  ||      }	n|dk(  r9|j*                  dk(  r'| j-                  ||j"                  d      D ]  }
|
  d}	nW|d	v r*	 t/        |j                         j                  d
            }	n)|dk(  r"	 t        j                  |j"                  d      }	n|}	|||	f 	 |j                  j                  }|rOy y # t        j                  $ r Y y w xY w# t        j                  $ r d}Y aw xY w# t        j                  $ r d}Y /w xY w# t        j                  $ r d}	Y w xY w# t        j                  $ r d}	Y w xY w# t        j                  $ r Y y w xY ww)Nsysctl_oid_listr      r+   CTLTYPE_NODEr   )	recursiveNode)CTLTYPE_INTCTLTYPE_QUADCTLTYPE_OPAQUEintz-1CTLTYPE_STRING@   )typevolatility3	frameworkobjectsPointerdereferencecast	slh_firstoid_linksle_nextr   InvalidAddressExceptionr	   pointer_to_stringoid_namelenget_ctltypeoid_arg1voloffsetr6   oid_handler_process_sysctl_liststr)r1   r   sysctl_listr;   sysctlr   ctltypearg1_ptrarg1valinfos              r$   rV   z!Check_sysctl._process_sysctl_list>   se     5 5 = = E EE%113889JKK&&>11==? 00#F 4yA~((*G!??668<<CC ??DqyHM99&$GN*%%* $ 9 91 !: ! # #
#
 MMd..055e<=C ,,!33FOORHC 4%%11]  55  55  55 & "99 C "99 C 55 s   A!I<$$G I< G5 ,I<.H :A+I<&(H- I< I 5
I< I# I<I<G2/I<1G22I<5H
I<HI<H*&I<)H**I<-II<II<I I<I  I<#I96I<8I99I<c           	   #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  d         }t        j                  j                  | j                   |j                  ||      }|j                  d      }| j                  ||      D ]  \  }}}	 |j                  }t        j                  j                  | j                   ||| j                  d         \  }	}
d||j                   |j#                         t%        j&                  |      ||	|
ff  y # t        j                  $ r Y w xY ww)Nr   sysctl__childrenr,   r   )contextmodulesconfigr   r"   list_modulesr   r    generate_kernel_handler_info
layer_namer.   rV   rU   r   rM   lookup_module_address
oid_number	get_permsr
   Hex)r1   r   modshandlersrX   rY   r   r]   
check_addrmodule_namer-   s              r$   
_generatorzCheck_sysctl._generator|   sG    %%dkk(&;<{{''dkk(6KL##@@LL&++VT
 //<N/O!%!:!:6;!O 	FD##//
 (+'7'7'M'Mh
DKK4I($K
 %%$$& $$Z0 	 55 s+   B?EEA7EEEEEc           
          t        j                  dt        fdt        fdt        fdt        j
                  fdt        fdt        fdt        fg| j                               S )NNameNumberPermszHandler AddressValuezHandler ModulezHandler Symbol)r   TreeGridrW   r@   r
   rj   ro   )r1   s    r$   runzCheck_sysctl.run   s`    !!3#"L$4$45#!3'!3' OO
 	
r&   N)r   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer%   r6   rV   ro   rv    r&   r$   r   r      sK    *"+
j&>&>&S&S!T 
 
*<| D
r&   r   )loggingtypingr   rD   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr	   volatility3.framework.renderersr
   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrw   vollogPluginInterfacer   r   r&   r$   <module>r      sN       8 + < 4 1 8 - )			8	$V
7** V
r&   