
    Xf                         d dl Z d dlmZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ  e j        e          Z G d dej                  ZdS )    N)ListIteratorAny)
exceptions
interfaces)	renderers)requirements)plugins)utility)format_hints)mac)lsmodc                   p    e Zd ZdZdZedeej        j	                 fd            Z
dee         fdZd ZdS )	
Trustedbsdz'Checks for malicious trustedbsd modules   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)      r   )r   	componentversionr   r   )r   pluginr   )r	   ModuleRequirementVersionRequirementr   MacUtilitiesPluginRequirementr   Lsmod)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/trustedbsd.pyget_requirementszTrustedbsd.get_requirements   sr     *6()4  
 +3+;Y   *U[)  
 	
    modsc           	   #     K   | j         j        | j        d                  }t          j                            | j         |j        ||          }|                    d                              d          }|	                    d|j
                                        j        j        |                    d          d|j        dz             }t!          |          D ]\  }}	 |j                                        }|j                                        }	n# t&          j        $ r Y Jw xY w	 t+          j        |j        d	          }
n# t&          j        $ r d
}
Y nw xY w|	j        j        D ]m}t3          |	|          }||dk    rt          j                            | j         ||| j        d                   \  }}d||
t7          j        |          ||ffV  nd S )Nr   mac_policy_list)symbol_namearraymac_policy_list_elementTr   )object_typeoffsetsubtypeabsolutecount   zN/Ar   )contextmodulesconfigr   r#   generate_kernel_handler_info
layer_nameobject_from_symbolcastobjectentriesdereferencevolr1   get_type	staticmax	enumeratempcmpc_opsr   InvalidAddressExceptionr   pointer_to_stringmpc_namemembersgetattrlookup_module_addressr   Hex)selfr*   r   handlerspolicy_listr>   ientrD   opsent_namecheck	call_addrmodule_namer-   s                  r'   
_generatorzTrustedbsd._generator)   s      %dk(&;<#@@L&+VT
 
 //<M/NNSS
 
 --&22448?OO$=>>'!+   
 
  (( !	 !	FAsg))++k--//5   !"4S\3GG5 ! ! ! !   #C//	$	Q+.+;+Q+QL(It{87L, ,([
  $(33##	 	 	 	 	!	 !	s$    2DD%$D%)EEEc           
         t          j        dt          fdt          fdt          j        fdt          fdt          fg|                     t          j                            | j	        | j
        d                                       S )NMemberzPolicy NamezHandler AddresszHandler ModulezHandler Symbolr   )r   TreeGridstrr   rL   rW   r   r%   list_modulesr6   r8   )rM   s    r'   runzTrustedbsd.run_   sw    !3$"L$45!3'!3' OO((t{87LMM 
 
 	
r)   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer(   r   r   rW   r]    r)   r'   r   r      s        11"+
j&>&S!T 
 
 
 [
4x} 4 4 4 4l
 
 
 
 
r)   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerr^   vollogPluginInterfacer   rf   r)   r'   <module>rs      s  
  & & & & & & & & & & 8 8 8 8 8 8 8 8 + + + + + + < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 - - - - - - ) ) ) ) ) )		8	$	$W
 W
 W
 W
 W
( W
 W
 W
 W
 W
r)   