§
    XÒfª  ã                   ó~   — d dl mZ d dl mZ d dlmZ d dlmZ d dlmZ d dl	m
Z
  G d„ dej        j        ¦  «        Zd	S )
é    )Ú
interfaces)Ú	renderers)Úrequirements)Úutility)Úformat_hints)Úpslistc                   ó>   — e Zd ZdZdZed„ ¦   «         Zd„ Zd„ Zd„ Z	dS )ÚMalfindzCLists process memory ranges that potentially contain injected code.)é   r   r   c                 ó®   — t          j        ddddg¬¦  «        t          j        dt          j        d¬¦  «        t          j        d	d
t          d¬¦  «        gS )NÚkernelzKernel module for the OSÚIntel32ÚIntel64)ÚnameÚdescriptionÚarchitecturesr   )é   r   r   )r   ÚpluginÚversionÚpidzFilter on specific process IDsT)r   r   Úelement_typeÚoptional)r   ÚModuleRequirementÚPluginRequirementr   ÚPsListÚListRequirementÚint)Úclss    ú[/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/malfind.pyÚget_requirementszMalfind.get_requirements   st   € õ Ô*ØØ6Ø(¨)Ð4ðñ ô õ
 Ô*Ø¥f¤m¸Yðñ ô õ Ô(ØØ<Ý Øð	ñ ô ð
ð 	
ó    c              #   óR  K  — |                      ¦   «         }|€dS | j        j        |         }|                     ¦   «         D ]e}|                     | j        | j        j        | j        d                  j        ¦  «        s(|                     |j	        j
        dd¬¦  «        }||fV — ŒfdS )zMGenerate memory regions for a process that may contain injected
        code.Nr   é@   T)Úpad)Úadd_process_layerÚcontextÚlayersÚget_map_iterÚis_suspiciousÚmodulesÚconfigÚsymbol_table_nameÚreadÚlinksÚstart)ÚselfÚtaskÚproc_layer_nameÚ
proc_layerÚvmaÚdatas         r   Ú_list_injectionszMalfind._list_injections%   s·   è è € ð ×0Ò0Ñ2Ô2ˆØÐ"Ø4à”\Ô(¨Ô9ˆ
à×$Ò$Ñ&Ô&ð 	 ð 	 ˆCØ×$Ò$Ø”Ø”Ô$ T¤[°Ô%:Ô;ÔMñô ð  ð "—’ s¤y¤¸ÀÑEÔEØ˜4iøð	 ð 	 r!   c              #   ó8  K  — | j         j        | j        d                                       d¦  «        j        dk    rd}nd}|D ]Ö}t          j        |j        ¦  «        }|                      |¦  «        D ]¥\  }}|rd}nd}t          j
                             ||j        j        |¦  «        }d|j        |t          j        |j        j        ¦  «        t          j        |j        j        ¦  «        |                     ¦   «         t          j        |¦  «        |ffV — Œ¦Œ×d S )	Nr   Úpointeré   TFÚintelÚintel64r   )r&   r*   r+   Úget_typeÚsizer   Úarray_to_stringÚp_commr6   r   r   ÚDisassemblyr.   r/   Úp_pidr   ÚHexÚendÚ	get_permsÚHexBytes)	r0   ÚtasksÚis_32bit_archr1   Úprocess_namer4   r5   ÚarchitectureÚdisasms	            r   Ú
_generatorzMalfind._generator7   s3  è è € àŒ<Ô ¤¨HÔ 5Ô6×?Ò?À	ÑJÔJÔOÐSTÒTÐTØ ˆMˆMà!ˆMàð 	ð 	ˆDÝ"Ô2°4´;Ñ?Ô?ˆLà!×2Ò2°4Ñ8Ô8ð ð ‘	TØ ð -Ø#*LLà#,Lå#Ô-×9Ò9Ø˜#œ)œ/¨<ñô ð
 àœ
Ø$Ý$Ô(¨¬¬Ñ9Ô9Ý$Ô(¨¬¬Ñ7Ô7ØŸš™œÝ$Ô-¨dÑ3Ô3Øððð ð ð ð ðð	ð 	r!   c           
      ó6  — t           j                             | j                             dd ¦  «        ¦  «        }t           j                             | j                             dt           j        j        d         ¦  «        ¦  «        }t          j        dt          fdt          fdt          j        fdt          j        fdt          fd	t          j        fd
t          j        j        fg|                       || j        | j        d         |¬¦  «        ¦  «        ¦  «        S )Nr   Úpslist_methodr   ÚPIDÚProcessÚStartÚEndÚ
ProtectionÚHexdumpÚDisasmr   )Úfilter_func)r   r   Úcreate_pid_filterr+   ÚgetÚget_list_tasksÚpslist_methodsr   ÚTreeGridr   Ústrr   rB   rE   r   r@   rK   r&   )r0   rU   Ú
list_taskss      r   ÚrunzMalfind.runX   sí   € Ý”m×5Ò5°d´k·o²oÀeÈTÑ6RÔ6RÑSÔSˆÝ”]×1Ò1ØŒKOŠO˜O­V¬]Ô-IÈ!Ô-LÑMÔMñ
ô 
ˆ
õ Ô!àØCÐ Ø,Ô*Ð+ØÔ(Ð)ØsÐ#ØLÔ1Ð2Ø:Ô/Ô;Ð<ðð OŠOØ
˜4œ<¨¬°XÔ)>ÈKÐXÑXÔXñô ñ
ô 
ð 	
r!   N)
Ú__name__Ú
__module__Ú__qualname__Ú__doc__Ú_required_framework_versionÚclassmethodr    r6   rK   r]   © r!   r   r
   r
      sg   € € € € € ØMÐMà"+Ðàð
ð 
ñ „[ð
ð$ ð  ð  ð$ð ð ðB
ð 
ð 
ð 
ð 
r!   r
   N)Úvolatility3.frameworkr   r   Ú#volatility3.framework.configurationr   Úvolatility3.framework.objectsr   Úvolatility3.framework.renderersr   Úvolatility3.plugins.macr   ÚpluginsÚPluginInterfacer
   rd   r!   r   ú<module>rl      s·   ðð
 -Ð ,Ð ,Ð ,Ð ,Ð ,Ø +Ð +Ð +Ð +Ð +Ð +Ø <Ð <Ð <Ð <Ð <Ð <Ø 1Ð 1Ð 1Ð 1Ð 1Ð 1Ø 8Ð 8Ð 8Ð 8Ð 8Ð 8Ø *Ð *Ð *Ð *Ð *Ð *ð^
ð ^
ð ^
ð ^
ð ^
ˆjÔ Ô0ñ ^
ô ^
ð ^
ð ^
ð ^
r!   