X fddlmZmZmZddlmZmZmZddlm Z ddl m Z ddl m Z ddlmZGddej j"Zy ) )IterableCallableTuple) renderers interfaces exceptions) requirements)utility)mac)pslistceZdZdZdZdZdddddd d d d d dd ZgdZgdZgdZ eee dZ e dZ dZ e dZe dZe dfdej"j$dedeegefdeeej2j4ej2j4ej2j4ffdZdZdZy )!Keventsz,Lists event handlers registered by processes)rr)rr EVFILT_READ EVFILT_WRITE EVFILT_AIO EVFILT_VNODE EVFILT_PROC EVFILT_SIGNAL EVFILT_TIMEREVFILT_MACHPORT EVFILT_FS EVFILT_USER EVFILT_VM) rr )) NOTE_DELETEr) NOTE_WRITEr) NOTE_EXTENDr) NOTE_ATTRIBr!) NOTE_LINK) NOTE_RENAME ) NOTE_REVOKE@)) NOTE_EXITl)NOTE_EXITSTATUSi) NOTE_FORKi@) NOTE_EXECi ) NOTE_SIGNALi) NOTE_REAPi)) NOTE_SECONDSr) NOTE_USECONDSr) NOTE_NSECONDSr) NOTE_ABSOLUTEr!)rrr c tjddddgtjdtjdtj d t jd tjd d tdgS)NkernelzKernel module for the OSIntel32Intel64)name description architecturesr )rrr)r=pluginversionmacutils)rrr)r= componentrApidzFilter on specific process IDsT)r=r> element_typeoptional) r ModuleRequirementPluginRequirementr PsListVersionRequirementr MacUtilitiesListRequirementint)clss [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/kevents.pyget_requirementszKevents.get_requirementsBs~  * *6()4   * *fmmY   + +3+;+;Y   ( (<     c|dk(s||jvryg}|j|}|D]\}}||z|k(s|j|!dj|S)Nr,) all_filtersappendjoin)self filter_index filter_flagscontextfiltersflagindexs rO _parse_flagszKevents._parse_flagsXsl 1  D4D4D D""<0" %KD%e#u,t$ %xx  rQc#K t||}t||}|jd||dz|jd}|D]+}t j j|dD]} | -y#tj$rYywxYww)z Convenience wrapper for walking an array of lists of kernel events Handles invalid address references arrayrklist) object_typeoffsetcountsubtypeNkn_link)getattrobjectget_typerInvalidAddressExceptionr rK walk_slist) rNr:fdparray_pointer_memberarray_size_memberklist_array_pointer array_size klist_arrayrbkns rO_walk_klist_arrayzKevents._walk_klist_arrayes ")#/C"D  &78J --#* 1n0 (K! E&&11%C   11  s(B ?A41B 4B B  B  B c#6K|j}|j||ddD]}||j||ddD]}| |j}t j j|dD]}|y#tj$rYywxYww)z Enumerates event filters per task. Uses smear-safe APIs throughout as these data structures see a significant amount of smear fd_knlist fd_knlistsize fd_knhash fd_knhashmaskNrg)p_fdrtp_klistrrkr rKrl)rNr:taskrmrsr{s rO_get_task_keventszKevents._get_task_kevents}sii''[/R BH ''[/R BH  llG""--gyA BH 11  s*AB B*BBBBBcy)NF)_s rOzKevents.srQr[kernel_module_name filter_funcreturnc#NK|j|}tjjtjjd}||||D]K}t j |j}|j}|j||D] } ||| f Myw)aN Returns the kernel event filters registered Return values: A tuple of 3 elements: 1) The name of the process that registered the filter 2) The process ID of the process that registered the filter 3) The object of the associated kernel event filter rN) modulesr rIget_list_taskspslist_methodsr array_to_stringp_commp_pidr}) rNr[rrr: list_tasksr| task_namerDrss rOlist_kernel_eventszKevents.list_kernel_eventss,!34]]11&--2N2Nq2QR w(:KH )D// rs9 -,CC<1-*F j  00F rQ