
    Xf,                         d dl Z d dlmZ d dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d d	lmZ  e j"                  e      Z G d
 de
j(                        Zy)    N)List)
exceptions
interfaces)	renderers)requirements)plugins)format_hints)mac)lsmodc                   d    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zy)Timersz"Check for malicious kernel timers.   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)      r   )r   	componentversionr   r   )r   pluginr   )r   ModuleRequirementVersionRequirementr
   MacUtilitiesPluginRequirementr   Lsmod)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/timers.pyget_requirementszTimers.get_requirements   sb     **6()4
 ++3+;+;Y **U[[)
 	
    c           
   #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  d         }t        j                  j                  | j                   |j                  ||      }|j                  d      }|j                  d      j                  }|j                  d||j                  d            }|j                  d|d	|j                  d
      |      }|D ]+  }	 |j                  j                   j"                  }	|	j)                  |	dd      D ]  }
	 |
j*                  j-                         j.                  j0                  }|
j3                  d      r|
j4                  }nd}t        j                  j7                  | j                   ||| j                  d         \  }}dt9        j:                  |      t9        j:                  |
j<                        t9        j:                  |
j>                        |
j@                  |||ff  . y # t$        j&                  $ r Y  y w xY w# t$        j&                  $ r Y (w xY ww)Nr   
real_ncpus)symbol_namecpu_data_ptrpointerzlong unsigned int)object_typeoffsetsubtypearrayTcpu_data)r,   r-   absoluter.   countq_link
call_entry
entry_timer   )!contextmodulesconfigr   r"   list_modulesr
   r    generate_kernel_handler_info
layer_nameobject_from_symbol
get_symboladdressobjectget_typertclock_timerqueueheadr   InvalidAddressException	walk_listfuncdereferencevolr-   
has_memberr5   lookup_module_addressr	   Hexparam0param1deadline)selfr   modshandlersr(   cpu_data_ptrs_ptrcpu_data_ptrs_addrcpu_data_ptrsr*   rC   timerhandlerr5   module_namer)   s                  r$   
_generatorzTimers._generator'   s8    %%dkk(&;<{{''dkk(6KL##@@LL&++VT
 ..<.H
"--n=EE $]]!$OO$78 + 
 %OOJ/ & 
 *  	L$2288== ,G #jj446::AAG ##L1!&!1!1J!#J+.+;+;+Q+QLL(GT[[5J,([
 $((1$((6$((6"##  	 55  "99 sO   DI1 H=2I1	.I7CI1=II1II1I.*I1-I..I1c           
          t        j                  dt        j                  fdt        j                  fdt        j                  fdt        fdt        fdt
        fdt
        fg| j                               S )NFunctionzParam 0zParam 1Deadlinez
Entry TimeModuleSymbol)r   TreeGridr	   rL   intstrrY   )rP   s    r$   runz
Timers.rune   sn    !!\--.L,,-L,,-S!s#33 OO
 	
r&   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer%   rY   rb    r&   r$   r   r      s@    ,"+
j&>&>&S&S!T 
 
<|
r&   r   )loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr	   volatility3.framework.symbolsr
   volatility3.plugins.macr   	getLoggerrc   vollogPluginInterfacer   rk   r&   r$   <module>rw      sH      8 + < 4 8 - )			8	$_
W$$ _
r&   