
    Xf|                         d dl Z d dlmZmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j(                  e      Z G d
 dej.                        Zy)    N)IterableOptional)	renderers
interfaces
exceptions)requirements)plugins)utility)format_hints)mac)mountc                      e Zd ZdZdZed        Zedej                  j                  de
e   fd       Zed        Zed        Zed	        Zed
        Zedej"                  j$                  dedeej                  j                     fd       Zed        Zedej"                  j$                  dedeej                  j                     fd       Zd Zd Zy)
List_Filesz2Lists all open file descriptors for all processes.   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   Mount)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/list_files.pyget_requirementszList_Files.get_requirements   sE     **6()4
 **U[[)	
 		
    vnodereturnc                     |j                   dz  dk(  r|j                         }|S 	 t        j                  |j                  d      }|S # t
        j                  $ r d }Y |S w xY w)N      )v_flag	full_pathr
   pointer_to_stringv_namer   InvalidAddressException)r   r"   r*   s      r   _vnode_namezList_Files._vnode_name$   sk     <<!q __&F  225<<E  55 s    A A! A!c                 *   	 |j                   j                         }|r\|j                  |j
                  j                     j                  |j
                  j                  |j
                  j                        sy |S # t        j                  $ r Y y w xY wN)
v_parentdereferencer   r+   layersvolnative_layer_nameis_validoffsetsize)r   contextr"   parents       r   _get_parentzList_Files._get_parent1   sy    	^^//1F '..)D)DENNJJvzz
  11 		s   A< <BBc                    |j                   |j                  j                     j                  |j                  j                  |j                  j
                        sy|j                  j                  }d}||vrL| j                  |      }||S | j                  ||      }|r|j                  j                  }nd}|||f||<   d}|S )z
        Adds the given vnode to loop_vnodes.

        loop_vnodes is key off the address of a vnode
        and holds its name, parent address, and object
        FNT)r1   r2   r3   r4   r5   r6   r,   r9   )	r   r7   r"   loop_vnodeskeyaddedr*   r8   
parent_vals	            r   
_add_vnodezList_Files._add_vnodeA   s     ~~eii99:CCIIeiinn
 iik!__U+F~__We4F#ZZ..
!
 &
E:KEr!   c                 X   d}|r||v r|S | j                  |||      s	 |S d}| j                  ||      }|r1||vr-| j                  |||      sn| j                  ||      }|r||vr-	 |j                  j                  j                         }|r|S # t        j                  $ r Y |S w xY w)z
        Iterates over the list of vnodes associated with the given one.
        Also traverses the parent chain for the vnode and adds each one.
        FT)r?   r9   _walk_vnodev_mntvnodestqe_nextr0   r   r+   )r   r7   r"   r;   r=   r8   s         r   rA   zList_Files._walk_vnoded   s     #>>'5+>   E__We4FV;6wD&9	 V;6))22>>@# *  55 s   )$B B)(B)c                 t    t         j                  j                  |d      D ]  }| j                  |||        y )NrB   )r   MacUtilities
walk_tailqrA   )r   r7   	list_headr;   r"   s        r   _walk_vnodelistzList_Files._walk_vnodelist   s4    %%00MJ 	9EOOGUK8	9r!   r7   kernel_module_namec                    i }t         j                  j                  ||      }|D ]  }| j                  ||j                  |       | j                  ||j
                  |       | j                  ||j                  |       | j                  ||j                  |       | j                  ||j                  |       | j                  ||j                  |        |S r.   )r   r   list_mountsrH   mnt_vnodelistmnt_workerqueuemnt_newvnodesrA   mnt_vnodecoveredmnt_realrootvp	mnt_devvp)r   r7   rI   r;   rK   mnts         r   _walk_mountszList_Files._walk_mounts   s      kk--g7IJ 	AC):):KH)<)<kJ):):KHOOGS%9%9;GOOGS%7%7EOOGS]]K@	A r!   c                    |g}t               }||v r=||   \  }}}|d}n||v rg }n(|j                  |       |j                  d|       ||v r=t        |      dkD  rdj	                  |      }n|}|j                  d      r|dd  }|S )Nr   r%   /z//)setaddinsertlenjoin
startswith)r   vnodes
vnode_nameparent_offsetpathseen_offsetsparent_name_s           r   _build_pathzList_Files._build_path   s    |uv%,2=,A)K$ ! ,.   /KK;' v% t9q=88D>DD??4 8Dr!   c              #      K   | j                  ||      }|j                         D ]"  \  }\  }}}| j                  |||      }||f $ y wr.   )rS   itemsrc   )	r   r7   rI   r\   voffr]   r^   r"   r(   s	            r   
list_fileszList_Files.list_files   sY      !!'+=>8> 	#4D4:}e
MJI""	#s   A	Ac              #      K   | j                  | j                  | j                  d         D ]4  \  }}dt        j                  |j
                  j                        |ff 6 y w)Nr   r   )rg   r7   configr   Hexr2   r5   )selfr"   r(   s      r   
_generatorzList_Files._generator   sY      $dkk(>S T 	GE9|''		(8(899EFF	Gs   A"A$c                 z    t        j                  dt        j                  fdt        fg| j                               S )NAddressz	File Path)r   TreeGridr   rj   strrl   )rk   s    r   runzList_Files.run   s6    !!))*[#,>?AR
 	
r!   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr    r   objectsObjectInterfacer   rp   r,   r9   r?   rA   rH   r7   ContextInterfacer   rS   rc   rg   rl   rq    r!   r   r   r      sR   <"+

 

 

 2 2 B B 
xPS} 
 
      D  < 9 9  ((99OR	*$$44	5 "  : # ((99#OR#	*$$44	5# #G
r!   r   )loggingtypingr   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrr   vollogPluginInterfacer   r{   r!   r   <module>r      sK     % C C < 4 1 8 - )			8	$x
(( x
r!   