
    Xf|                         d dl Z d dlmZmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 dej                  ZdS )    N)IterableOptional)	renderers
interfaces
exceptions)requirements)plugins)utility)format_hints)mac)mountc                      e Zd ZdZdZed             Zedej        j	        de
e         fd            Zed             Zed             Zed	             Zed
             Zedej        j        dedeej        j	                 fd            Zed             Zedej        j        dedeej        j	                 fd            Zd Zd ZdS )
List_Filesz2Lists all open file descriptors for all processes.   r   r   c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   Mount)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/list_files.pyget_requirementszList_Files.get_requirements   sQ     *6()4  
 *U[)  	
 		
    vnodereturnc                     |j         dz  dk    r|                                }n3	 t          j        |j        d          }n# t
          j        $ r d }Y nw xY w|S )N      )v_flag	full_pathr
   pointer_to_stringv_namer   InvalidAddressException)r   r"   r*   s      r   _vnode_namezList_Files._vnode_name$   sp     <!q  __&&FF 25<EE5    s   A   AAc                     	 |j                                         }n# t          j        $ r Y d S w xY w|rA|j        |j        j                                     |j        j        |j        j	                  sd S |S N)
v_parentdereferencer   r+   layersvolnative_layer_nameis_validoffsetsize)r   contextr"   parents       r   _get_parentzList_Files._get_parent1   s    	^//11FF1 	 	 	44	  	'.)DENNJvz
 
 	 4s    //c                 @   |j         |j        j                                     |j        j        |j        j                  sdS |j        j        }d}||vrJ|                     |          }||S |                     ||          }|r|j        j        }nd}|||f||<   d}|S )z
        Adds the given vnode to loop_vnodes.

        loop_vnodes is key off the address of a vnode
        and holds its name, parent address, and object
        FNT)r1   r2   r3   r4   r5   r6   r,   r9   )	r   r7   r"   loop_vnodeskeyaddedr*   r8   
parent_vals	            r   
_add_vnodezList_Files._add_vnodeA   s     ~ei9:CCIein
 
 	 5ik!!__U++F~__We44F "#Z.

!
 &
E:KEr!   c                 \   d}|r||v r|S |                      |||          snd}|                     ||          }|r8||vr4|                     |||          sn|                     ||          }|r||v4	 |j        j                                        }n# t          j        $ r Y nw xY w||S )z
        Iterates over the list of vnodes associated with the given one.
        Also traverses the parent chain for the vnode and adds each one.
        FT)r?   r9   _walk_vnodev_mntvnodestqe_nextr0   r   r+   )r   r7   r"   r;   r=   r8   s         r   rA   zList_Files._walk_vnoded   s      	##>>'5+>> E__We44F :V;66wDD &99	  :V;66)2>>@@5   %  	* s   6B B'&B'c                 z    t           j                            |d          D ]}|                     |||           d S )NrB   )r   MacUtilities
walk_tailqrA   )r   r7   	list_headr;   r"   s        r   _walk_vnodelistzList_Files._walk_vnodelist   sG    %00MJJ 	9 	9EOOGUK8888	9 	9r!   r7   kernel_module_namec                    i }t           j                            ||          }|D ]}|                     ||j        |           |                     ||j        |           |                     ||j        |           |                     ||j        |           |                     ||j	        |           |                     ||j
        |           |S r.   )r   r   list_mountsrH   mnt_vnodelistmnt_workerqueuemnt_newvnodesrA   mnt_vnodecoveredmnt_realrootvp	mnt_devvp)r   r7   rI   r;   rK   mnts         r   _walk_mountszList_Files._walk_mounts   s      k--g7IJJ 	A 	AC):KHHH)<kJJJ):KHHHOOGS%9;GGGOOGS%7EEEOOGS]K@@@@r!   c                 R   |g}t                      }||v rG||         \  }}}|d}n||v rg }n/|                    |           |                    d|           ||v Gt          |          dk    rd                    |          }n|}|                    d          r
|dd          }|S )Nr   r%   /z//)setaddinsertlenjoin
startswith)r   vnodes
vnode_nameparent_offsetpathseen_offsetsparent_name_s           r   _build_pathzList_Files._build_path   s    |uuv%%,2=,A)K$ ! ,..   ///KK;''' v%% t99q==88D>>DDD??4   	8Dr!   c              #      K   |                      ||          }|                                D ]&\  }\  }}}|                     |||          }||fV  'd S r.   )rS   itemsrc   )	r   r7   rI   r\   voffr]   r^   r"   r(   s	            r   
list_fileszList_Files.list_files   st       !!'+=>>8> 	# 	#4D4:}e
MJJI"""""	# 	#r!   c              #      K   |                      | j        | j        d                   D ])\  }}dt          j        |j        j                  |ffV  *d S )Nr   r   )rg   r7   configr   Hexr2   r5   )selfr"   r(   s      r   
_generatorzList_Files._generator   sh       $dk(>S T T 	G 	GE9|'	(8999EFFFFF	G 	Gr!   c                 z    t          j        dt          j        fdt          fg|                                           S )NAddressz	File Path)r   TreeGridr   rj   strrl   )rk   s    r   runzList_Files.run   s8    !)*[#,>?ARAR
 
 	
r!   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr    r   objectsObjectInterfacer   rp   r,   r9   r?   rA   rH   r7   ContextInterfacer   rS   rc   rg   rl   rq    r!   r   r   r      s       <<"+

 

 [

 

 2 B 
xPS} 
 
 
 [
   [     [ D   [< 9 9 [9  (9OR	*$4	5   ["   [: # (9#OR#	*$4	5# # # [#G G G
 
 
 
 
r!   r   )loggingtypingr   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrr   vollogPluginInterfacer   r{   r!   r   <module>r      s    % % % % % % % % C C C C C C C C C C < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 - - - - - - ) ) ) ) ) )		8	$	$x
 x
 x
 x
 x
( x
 x
 x
 x
 x
r!   