
    Xfn	                     b    d dl mZmZmZ d dlmZ d dlmZ  G d dej        j	                  Z
dS )    )	renderers
interfaces
exceptions)requirements)utilityc                   @    e Zd ZdZdZg dZed             Zd Zd Z	dS )	VFSeventsz5Lists processes that are filtering file system events)   r   r   )CREATE_FILEDELETESTAT_CHANGEDRENAMECONTENT_MODIFIEDEXCHANGEFINDER_INFO_CHANGED
CREATE_DIRCHOWNXATTR_MODIFIEDXATTR_REMOVEDDOCID_CREATEDDOCID_CHANGEDc                 6    t          j        ddddg          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitectures)r   ModuleRequirement)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/vfsevents.pyget_requirementszVFSevents.get_requirements   s1     *6()4  
 	
    c           
   #     K   | j         j        | j        d                  }|                    d          }|D ]}|dk    r	t	          j        |j                  }|j        }g }	 |                    d|j	        dd|
                    d                    }n# t          j        $ r Y pw xY wt          |          D ]+\  }}	|	d	k    r |                    | j        |                    ,|g k    rd||d
                    |          ffV  dS )z
        Lists the registered VFS event watching processes
        Also lists which event(s) a process is registered for
        r   watcher_tabler   arrayT   zunsigned char)object_typeoffsetabsolutecountsubtype   ,N)contextmodulesconfigobject_from_symbolr   array_to_string	proc_namepidobject
event_listget_typer   InvalidAddressException	enumerateappendevent_typesjoin)
selfr   r%   watcher	task_nametask_pideventsevent_arrayievents
             r!   
_generatorzVFSevents._generator)   sJ      %dk(&;<11/BB$ 	C 	CG!||/0ABBI{HF
$mm '"-!"OOO<< ,   5    &k22 7 75A::MM$"21"5666||9h0@0@ABBBB5	C 	Cs   #2BB('B(c                     t          j        dt          fdt          fdt          fg|                                           S )NNamePIDEvents)r   TreeGridstrintrF   )r>   s    r!   runzVFSevents.runO   s9    !c]UCL8S/:DOO<M<M
 
 	
r#   N)
__name__
__module____qualname____doc___required_framework_versionr<   classmethodr"   rF   rN    r#   r!   r	   r	   
   sn        ??"+  K  
 
 [
$C $C $CL
 
 
 
 
r#   r	   N)volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   pluginsPluginInterfacer	   rU   r#   r!   <module>r[      s   
 D C C C C C C C C C < < < < < < 1 1 1 1 1 1H
 H
 H
 H
 H

"2 H
 H
 H
 H
 H
r#   