
    Xfn	                     n    d dl mZmZmZ d dlmZ d dlmZ  G d dej                  j                        Z
y)    )	renderers
interfaces
exceptions)requirements)utilityc                   8    e Zd ZdZdZg dZed        Zd Zd Z	y)	VFSeventsz5Lists processes that are filtering file system events)   r   r   )CREATE_FILEDELETESTAT_CHANGEDRENAMECONTENT_MODIFIEDEXCHANGEFINDER_INFO_CHANGED
CREATE_DIRCHOWNXATTR_MODIFIEDXATTR_REMOVEDDOCID_CREATEDDOCID_CHANGEDc                 8    t        j                  ddddg      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitectures)r   ModuleRequirement)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/vfsevents.pyget_requirementszVFSevents.get_requirements   s*     **6()4
 	
    c           
   #   *  K   | j                   j                  | j                  d      }|j                  d      }|D ]  }|dk(  r	t	        j
                  |j                        }|j                  }g }	 |j                  d|j                  dd|j                  d            }t        |      D ])  \  }}	|	d	k(  s|j                  | j                  |          + |g k7  sd||d
j!                  |      ff  y# t        j                  $ r Y w xY ww)z
        Lists the registered VFS event watching processes
        Also lists which event(s) a process is registered for
        r   watcher_tabler   arrayT   zunsigned char)object_typeoffsetabsolutecountsubtype   ,N)contextmodulesconfigobject_from_symbolr   array_to_string	proc_namepidobject
event_listget_typer   InvalidAddressException	enumerateappendevent_typesjoin)
selfr   r%   watcher	task_nametask_pideventsevent_arrayievents
             r!   
_generatorzVFSevents._generator)   s     %%dkk(&;<11/B$ 	CG!|//0A0ABI{{HF
$mm '"--!"OOO< ,  &k2 75A:MM$"2"21"567 |9h0@ABB5	C$ 55 s6   A0D3/C:"D9%DD:DDDDc                 t    t        j                  dt        fdt        fdt        fg| j	                               S )NNamePIDEvents)r   TreeGridstrintrF   )r>   s    r!   runzVFSevents.runO   s4    !!c]UCL8S/:DOO<M
 	
r#   N)
__name__
__module____qualname____doc___required_framework_versionr<   classmethodr"   rF   rN    r#   r!   r	   r	   
   s2    ?"+K  
 
$CL
r#   r	   N)volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   pluginsPluginInterfacer	   rU   r#   r!   <module>r[      s.   
 D C < 1H

""22 H
r#   