
    Xf                         d dl Z d dlmZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ  e j*                  e      Z G d dej0                        Zy)    N)ListIteratorAny)
exceptions
interfaces)	renderers)requirements)plugins)utility)format_hints)mac)lsmodc                   p    e Zd ZdZdZedeej                  j                     fd       Z
dee   fdZd Zy)	
Trustedbsdz'Checks for malicious trustedbsd modules   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesmacutils)      r   )r   	componentversionr   r   )r   pluginr   )r	   ModuleRequirementVersionRequirementr   MacUtilitiesPluginRequirementr   Lsmod)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/trustedbsd.pyget_requirementszTrustedbsd.get_requirements   sb     **6()4
 ++3+;+;Y **U[[)
 	
    modsc           	   #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   |j                  ||      }|j                  d      j                  d      }|j                  d|j                  j                         j                  j                  |j                  d      d|j                  dz         }t!        |      D ]  \  }}	 |j"                  j                         }|j$                  j                         }		 t+        j,                  |j.                  d	      }
|	j                  j0                  D ]p  }t3        |	|      }||dk(  rt        j                  j5                  | j                   ||| j                  d         \  }}d||
t7        j8                  |      ||ff r  y # t&        j(                  $ r Y w xY w# t&        j(                  $ r d
}
Y w xY ww)Nr   mac_policy_list)symbol_namearraymac_policy_list_elementTr   )object_typeoffsetsubtypeabsolutecount   zN/Ar   )contextmodulesconfigr   r#   generate_kernel_handler_info
layer_nameobject_from_symbolcastobjectentriesdereferencevolr1   get_type	staticmax	enumeratempcmpc_opsr   InvalidAddressExceptionr   pointer_to_stringmpc_namemembersgetattrlookup_module_addressr   Hex)selfr*   r   handlerspolicy_listr>   ientrD   opsent_namecheck	call_addrmodule_namer-   s                  r'   
_generatorzTrustedbsd._generator)   s    %%dkk(&;<##@@LL&++VT
 //<M/NSS
 --&&22488??OO$=>''!+   
  ( !	FAsgg))+kk--/!"44S\\3G  #C/	$	Q+.+;+;+Q+QLL(It{{87L,([
  $((3##	 	!	 55 
 55 ! !sI   C-H04G% G*BHG'$H&G''H*H?HHHc           
         t        j                  dt        fdt        fdt        j                  fdt        fdt        fg| j                  t        j                  j                  | j                  | j                  d                     S )NMemberzPolicy NamezHandler AddresszHandler ModulezHandler Symbolr   )r   TreeGridstrr   rL   rW   r   r%   list_modulesr6   r8   )rM   s    r'   runzTrustedbsd.run_   sv    !!3$"L$4$45!3'!3' OO((t{{87LM
 	
r)   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer(   r   r   rW   r]    r)   r'   r   r      sK    1"+
j&>&>&S&S!T 
 
4x} 4l
r)   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerr^   vollogPluginInterfacer   rf   r)   r'   <module>rs      sN   
  & & 8 + < 4 1 8 - )			8	$W
(( W
r)   