
    Xf                         d dl mZ d dl mZ d dlmZ d dlmZ d dlmZ d dl	m
Z
  G d dej                  j                        Zy	)
    )
interfaces)	renderers)requirements)utility)format_hints)pslistc                   6    e Zd ZdZdZed        Zd Zd Zd Z	y)MalfindzCLists process memory ranges that potentially contain injected code.)   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/malfind.pyget_requirementszMalfind.get_requirements   sa     **6()4
 **fmmY ((< 	
 	
    c              #     K   |j                         }|y| j                  j                  |   }|j                         D ]{  }|j	                  | j                  | j                  j
                  | j                  d      j                        rN|j                  |j                  j                  dd      }||f } yw)zMGenerate memory regions for a process that may contain injected
        code.Nr   @   T)pad)add_process_layercontextlayersget_map_iteris_suspiciousmodulesconfigsymbol_table_namereadlinksstart)selftaskproc_layer_name
proc_layervmadatas         r   _list_injectionszMalfind._list_injections%   s      002"\\((9
$$& 	 C$$$$T[[%:;MM "syyE4i	 s   B
B>1B>c              #     K   | j                   j                  | j                  d      j                  d      j                  dk(  rd}nd}|D ]  }t        j                  |j                        }| j                  |      D ]  \  }}|rd}nd}t        j                  j                  ||j                  j                  |      }d|j                  |t        j                   |j                  j                        t        j                   |j                  j"                        |j%                         t        j&                  |      |ff   y w)	Nr   pointer   TFintelintel64r   )r&   r*   r+   get_typesizer   array_to_stringp_commr6   r   r   Disassemblyr.   r/   p_pidr   Hexend	get_permsHexBytes)	r0   tasksis_32bit_archr1   process_namer4   r5   architecturedisasms	            r   
_generatorzMalfind._generator7   s    <<H 56??	JOOSTT M!M 	D"224;;?L!2248 	T #*L#,L#--99#))//<
 

$$((9$((7$--d3 	s   E
Ec           
      l   t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  j	                  dt         j                  j                  d               }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        fd	t        j                  fd
t        j                  j                  fg| j!                   || j"                  | j                  d   |                  S )Nr   pslist_methodr   PIDProcessStartEnd
ProtectionHexdumpDisasmr   )filter_func)r   r   create_pid_filterr+   getget_list_taskspslist_methodsr   TreeGridr   strr   rB   rE   r   r@   rK   r&   )r0   rU   
list_taskss      r   runzMalfind.runX   s    mm55dkkooeT6RS]]11KKOOOV]]-I-I!-LM

 !!C ,**+(()s#L112://;;< OO4<<X)>KX
 	
r!   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr    r6   rK   r]    r!   r   r
   r
      s-    M"+
 
$ $B
r!   r
   N)volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.macr   pluginsPluginInterfacer
   rd   r!   r   <module>rl      s3   
 - + < 1 8 *^
j  00 ^
r!   