
    *1f                         d dl Z d dlmZmZmZ d dlmZ d dlmZ  e j                  e
      Z G d dej                  j                        Zy)    N)
interfaces	renderers
exceptions)requirements)utilityc                   v    e Zd ZdZdZdZed        Zedej                  j                  defd       Zd Zd	 Zy
)DmesgzPrints the kernel log buffer.)   r   r   )   r   r   c                 8    t        j                  ddddg      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitectures)r   ModuleRequirement)clss    Y/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/dmesg.pyget_requirementszDmesg.get_requirements   s*     **6()4
 	
    contextkernel_module_namec              #     K   |j                   |   }|j                  d      s!t        j                  d|j                  d      |j                  d      }|j                  }|j                  }|j                  }t        j                  ||      }||k  r|nd}||d }	|	|d| z  }	|	j                         D ]  }
|
f 	 yw)a  
        Online documentation :
            - https://github.com/apple-open-source/macos/blob/master/xnu/bsd/sys/msgbuf.h
            - https://github.com/apple-open-source/macos/blob/ea4cd5a06831aca49e33df829d2976d6de5316ec/xnu/bsd/kern/subr_log.c#L751
        Volatility 2 plugin :
            - https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/mac/dmesg.py
        msgbufpzThe provided symbol table does not include the "msgbufp" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.)symbol_namer   N)modules
has_symbolr   SymbolErrorsymbol_table_nameobject_from_symbolmsg_sizemsg_bufxmsg_bufcr   pointer_to_string
splitlines)r   r   r   r   r   r"   r#   r$   msg_bufc_datadmesg
dmesg_lines              r   get_kernel_log_bufferzDmesg.get_kernel_log_buffer   s      !34  +(((( {  ++	+B###### %66xJ'838 hi(y))  **, 	 J-	 s   B?Cc              #   v   K   | j                  | j                  | j                  d         D ]  }d|f 
 y w)Nr   )r   r   r   )r*   r   config)selfvalues     r   
_generatorzDmesg._generatorC   sC     //LLT[[5J 0 
 	E e*	s   79c                 X    t        j                  dt        fg| j                               S )Nline)r   TreeGridstrr/   )r-   s    r   runz	Dmesg.runI   s-    !! OO	
 	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   ContextInterfacer3   r*   r/   r4    r   r   r	   r	      s]    '"+H
 
 #  ((99# OR#  # J
r   r	   )loggingvolatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   	getLoggerr5   vollogpluginsPluginInterfacer	   r=   r   r   <module>rF      sB   
  C C < 1			8	$B
J.. B
r   