
    Xf,                         d dl Z d dlmZ d dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 de
j                  ZdS )    N)List)
exceptions
interfaces)	renderers)requirements)plugins)format_hints)mac)lsmodc                   ^    e Zd ZdZdZedeej        j	                 fd            Z
d Zd ZdS )Timersz"Check for malicious kernel timers.   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)      r   )r   	componentversionr   r   )r   pluginr   )r   ModuleRequirementVersionRequirementr
   MacUtilitiesPluginRequirementr   Lsmod)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/timers.pyget_requirementszTimers.get_requirements   sr     *6()4  
 +3+;Y   *U[)  
 	
    c           
   #   b  K   | j         j        | j        d                  }t          j                            | j         | j        d                   }t          j                            | j         |j	        ||          }|
                    d          }|                    d          j        }|                    d||                    d                    }|                    d|d	|                    d
          |          }|D ]'}	 |j        j        j        }	n# t$          j        $ r Y  d S w xY w|	                    |	dd          D ]}
	 |
j                                        j        j        }n# t$          j        $ r Y 8w xY w|
                    d          r|
j        }nd}t          j                            | j         ||| j        d                   \  }}dt9          j        |          t9          j        |
j                  t9          j        |
j                  |
j         |||ffV  )d S )Nr   
real_ncpus)symbol_namecpu_data_ptrpointerzlong unsigned int)object_typeoffsetsubtypearrayTcpu_data)r,   r-   absoluter.   countq_link
call_entry
entry_timer   )!contextmodulesconfigr   r"   list_modulesr
   r    generate_kernel_handler_info
layer_nameobject_from_symbol
get_symboladdressobjectget_typertclock_timerqueueheadr   InvalidAddressException	walk_listfuncdereferencevolr-   
has_memberr5   lookup_module_addressr	   Hexparam0param1deadline)selfr   modshandlersr(   cpu_data_ptrs_ptrcpu_data_ptrs_addrcpu_data_ptrsr*   rC   timerhandlerr5   module_namer)   s                  r$   
_generatorzTimers._generator'   sl     %dk(&;<{''dk(6KLL#@@L&+VT
 
 ..<.HH
"--n==E $]]!$OO$788 + 
 
 %OOJ// & 
 
 *  	  	L$28=5    ,GG  #j4466:AGG!9   H ##L11 $!&!1JJ!#J+.+;+Q+QL(GT[5J, ,([
 $(11$(66$(66"##     	  	s$   
DD0/D0#E11FFc           
          t          j        dt          j        fdt          j        fdt          j        fdt          fdt          fdt
          fdt
          fg|                                           S )NFunctionzParam 0zParam 1Deadlinez
Entry TimeModuleSymbol)r   TreeGridr	   rL   intstrrY   )rP   s    r$   runz
Timers.rune   sj    !\-.L,-L,-S!s#33 OO
 
 	
r&   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer%   rY   rb    r&   r$   r   r      so        ,,"+
j&>&S!T 
 
 
 [
< < <|
 
 
 
 
r&   r   )loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr	   volatility3.framework.symbolsr
   volatility3.plugins.macr   	getLoggerrc   vollogPluginInterfacer   rk   r&   r$   <module>rw      s           8 8 8 8 8 8 8 8 + + + + + + < < < < < < 4 4 4 4 4 4 8 8 8 8 8 8 - - - - - - ) ) ) ) ) )		8	$	$_
 _
 _
 _
 _
W$ _
 _
 _
 _
 _
r&   