
    Xf                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j*                  e      Z G d
 dej0                        Zy)    N)IterableCallableTuple)
exceptions	renderers
interfaces)requirements)plugins)utility)format_hints)mac)pslistc                      e Zd ZdZdZed        Zed fdej                  j                  de
deegef   deeej                   j"                  ej                   j"                  ej                   j"                  f      fd	       Zd
 Zd Zy)Netstatz0Lists all network connections for all processes.)   r   r   c           	         t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      t        j                  ddt        d      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionmacutils)   r   r   )r   	componentr   pidzFilter on specific process IDsT)r   r   element_typeoptional)
r	   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   MacUtilitiesListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/netstat.pyget_requirementszNetstat.get_requirements   s~     **6()4
 **fmmY ++3+;+;Y ((< 	
 	
    c                      y)NF )_s    r*   <lambda>zNetstat.<lambda>3   s    r,   contextkernel_module_namefilter_funcreturnc              #   N  K   t         j                  j                  t         j                  j                  d         } ||||      D ]'  }t	        j
                  |j                        }|j                  }t        j                  j                  ||j                  |   j                  |      D ]  \  }}	}		 |j                  j                         }
|
dk7  r(	 |j                  j"                  j%                         j'                  d      }|j(                  |j*                  j,                     j/                  |j*                  j0                  |j*                  j2                        s|||f  * y# t        j                   $ r Y w xY w# t        j                   $ r Y w xY ww)aK  
        Returns the open socket descriptors of a process

        Return values:
            A tuple of 3 elements:
                1) The name of the process that opened the socket
                2) The process ID of the processed that opened the socket
                3) The address of the associated socket structure
        r   SOCKETsocketN)r   r$   get_list_taskspslist_methodsr   array_to_stringp_commp_pidr   r&   files_descriptors_for_processmodulessymbol_table_namef_fglobget_fg_typer   InvalidAddressExceptionfg_datadereferencecastlayersvolnative_layer_nameis_validoffsetsize)r)   r1   r2   r3   
list_taskstask	task_namer   filpr/   ftyper7   s               r*   list_socketszNetstat.list_sockets.   si    . ]]11&--2N2Nq2QR
w(:KH 	-D//<I**C!..LL);<NNPT -
a LL446E H$!\\11==?DDXNF ~~dhh&@&@AJJJJ%%vzz f,,+-		- "99  "99 sO   B3F%6E3F%3F
A)F%3F	F%F		F%F"F%!F""F%c              #   Z  K   t         j                  j                  | j                  j	                  dd             }| j                  | j                  | j                  d   |      D ]%  \  }}}|j                         }|dk(  r	 |j                  j                         j                  d      }t        j                  |j                  j                        }dt#        j$                  |j&                  j(                        d|dddd| d	|d
ff |dv s|j+                         }|j-                         }	|j/                         }
|
s|
\  }}}}dt#        j$                  |j&                  j(                        |	|||||| d	|d
ff ( y # t        j                   $ r Y @w xY ww)Nr   r   )r3   r   unpcbr   UNIX /d)r      )r   r$   create_pid_filterconfiggetrQ   r1   
get_familyso_pcbrD   rE   r   r:   unp_addrsun_pathr   rB   r   HexrG   rJ   	get_stateget_protocol_as_stringget_converted_connection_info)selfr3   rN   r   r7   familyupcbpathstateprotovalsliplportriprports                  r*   
_generatorzNetstat._generatora   s    mm55dkkooeT6RS&*&7&7LL$++h/[ '8 '
 /	"IsF &&(F{!==446;;GDD"224==3I3IJD
 $(():):;$+Qs1g.	  7"((*557;;=/3,S%e (,,VZZ->->?!!!!(k3q'2	 G/	 "99 s9   BF+AFA F+2F+AF+F($F+'F((F+c                     t        j                  dt        j                  fdt        fdt        fdt
        fdt        fdt
        fdt        fdt        fg| j                               S )	NOffsetProtozLocal IPz
Local Portz	Remote IPzRemote PortStateProcess)r   TreeGridr   r`   strr(   ro   )rd   s    r*   runzNetstat.run   sj    !!<++,#S!s#c"$#C 	 OO
 	
r,   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr+   r   r1   ContextInterfacerv   r   r(   boolr   r   objectsObjectInterfacerQ   ro   rw   r.   r,   r*   r   r      s    :"+
 
* 
 .=	0-##440-  0- seTk*	0-
 
......0	

0- 0-d2h
r,   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrx   vollogPluginInterfacer   r.   r,   r*   <module>r      sN   
  , , C C < 4 1 8 - *			8	$O
g%% O
r,   