
    *1fo                        d dl Zd dlZd dlZd dlmZmZmZm	Z	m
Z
mZ d dlmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZmZ d dlmZmZ d dlmZmZ d d	lmZ d d
lmZ d dl m!Z! d dl"m#Z#m$Z$m%Z% d dl&m'Z'  ej(        e)          Z* G d de#j+                  Z, G d de#j+                  Z- G d dej.                  Z/ G d dej.                  Z0 G d dej.                  Z1 G d dej.                  Z2 G d dej.                  Z3 G d dej.                  Z4 G d dej.                  Z5 G d  d!ej.                  Z6 G d" d#ej.        ej7        j                  Z8 G d$ d%ej.                  Z9 G d& d'ej.                  Z: G d( d)ej.                  Z; G d* d+ej.                  Z< G d, d-ej.                  Z= G d. d/ej.                  Z> G d0 d1ej.                  Z G d2 d3ej.                  Z? G d4 d5ej.                  Z@ G d6 d7ej.                  ZA G d8 d9ej.                  ZB G d: d;ej.                  ZC G d< d=ej.                  ZD G d> d?ej.                  ZE G d@ dAej.                  ZF G dB dCej.                  ZG G dD dEej.                  ZH G dF dGej.                  ZI G dH dIeI          ZJdS )J    N)	GeneratorIterableIteratorOptionalTupleList)	constants
exceptionsobjects
interfacessymbols)
SOCK_TYPESSOCK_FAMILY)IP_PROTOCOLSIPV6_PROTOCOLS)
TCP_STATESNETLINK_PROTOCOLS)ETH_PROTOCOLSBLUETOOTH_STATES)BLUETOOTH_PROTOCOLSSOCKET_STATES)CAPABILITIES)linear)utility)genericlinuxintermed)elfc                        e Zd Z fdZed             Zd Zd Zd Zd Z	d Z
d Zd	 Zd
 Zd Zd Zdeeef         fdZd Zd Zed             Zed             Zed             Z xZS )modulec                 H     t                      j        |i | d | _        d S N)super__init___mod_mem_type)selfargskwargs	__class__s      i/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/extensions/__init__.pyr$   zmodule.__init__   s-    $)&)))!    c                 $   | j         	 | j        j                            |                                 t
          j        z   dz             j        | _         n6# t          j	        $ r$ t                              d           i | _         Y nw xY w| j         S )zIReturn the mod_mem_type enum choices if available or an empty dict if notNmod_mem_typezOUnable to find mod_mem_type enum. This message can be ignored for kernels < 6.4)r%   _contextsymbol_spaceget_enumerationget_symbol_table_namer	   BANGchoicesr
   SymbolErrorvollogdebugr&   s    r*   r-   zmodule.mod_mem_type!   s     %	(%)]%?%O%O..009>ANR& & "" ) ( ( (f   &("""( !!s   AA 0BBc                 :   |                      d          r;	 | j        | j        d                  j        S # t          $ r t          d          w xY w|                      d          r| j        j        S |                      d          r| j        S t          d          )NmemMOD_TEXTzUmodule -> get_module_base: Unable to get module base. Cannot read base from MOD_TEXT.core_layoutmodule_corez4module -> get_module_base: Unable to get module base
has_memberr9   r-   baseKeyErrorAttributeErrorr;   r<   r7   s    r*   get_module_basezmodule.get_module_base5       ??5!! 
	$x 1* =>CC   $k   __]++ 	$#((__]++ 	$##STTT	   4 Ac                    |                      d          rw	 | j        | j        d                  j        | j        | j        d                  j        z   | j        | j        d                  j        z   S # t          $ r t          d          w xY w|                      d          r| j        j        S |                      d          r| j        S t          d          )	Nr9   MOD_INIT_TEXTMOD_INIT_DATAMOD_INIT_RODATAzmodule -> get_init_size: Unable to determine .init section size of module. Cannot read size of MOD_INIT_TEXT, MOD_INIT_DATA, and MOD_INIT_RODATAinit_layout	init_sizezImodule -> get_init_size: Unable to determine .init section size of module)r>   r9   r-   sizer@   rA   rI   rJ   r7   s    r*   get_init_sizezmodule.get_init_sizeC   s    ??5!! 	"	HT.?@Eht0ABGHht01BCDIJ
    $ g   __]++ 	"#((__[)) 	">!W
 
 	
s   AA0 0B
c                    |                      d          r	 | j        | j        d                  j        | j        | j        d                  j        z   | j        | j        d                  j        z   | j        | j        d                  j        z   S # t          $ r t          d          w xY w|                      d          r| j        j        S |                      d          r| j        S t          d	          )
Nr9   r:   MOD_DATA
MOD_RODATAMOD_RO_AFTER_INITzmodule -> get_core_size: Unable to determine core size of module. Cannot read size of MOD_TEXT, MOD_DATA, MOD_RODATA, and MOD_RO_AFTER_INIT.r;   	core_sizez@module -> get_core_size: Unable to determine core size of module)r>   r9   r-   rK   r@   rA   r;   rQ   r7   s    r*   get_core_sizezmodule.get_core_sizeW   s   ??5!! 	"
HT.z:;@ht0<=BCht0>?DE ht01DEFKL    $ c   __]++ 	"#((__[)) 	">!N
 
 	
s   A6B B(c                 :   |                      d          r;	 | j        | j        d                  j        S # t          $ r t          d          w xY w|                      d          r| j        j        S |                      d          r| j        S t          d          )Nr9   r:   zUmodule -> get_module_core: Unable to get module core. Cannot read base from MOD_TEXT.r;   r<   z4module -> get_module_core: Unable to get module corer=   r7   s    r*   get_module_corezmodule.get_module_corel   rC   rD   c                 :   |                      d          r;	 | j        | j        d                  j        S # t          $ r t          d          w xY w|                      d          r| j        j        S |                      d          r| j        S t          d          )Nr9   rF   zZmodule -> get_module_core: Unable to get module init. Cannot read base from MOD_INIT_TEXT.rI   module_initz4module -> get_module_init: Unable to get module init)r>   r9   r-   r?   r@   rA   rI   rV   r7   s    r*   get_module_initzmodule.get_module_initz   s    ??5!! 
	$x 1/ BCHH   $p   __]++ 	$#((__]++ 	$##STTTrD   c                 4    t          j        | j                  S )z&Get the name of the module as a string)r   array_to_stringnamer7   s    r*   get_namezmodule.get_name   s    &ty111r+   c           	      R   | j                             |                                 t          j        z   dz   | j        j        |j        | j         j        	                    |                                 t          j        z   dz             d          }d}||         r|dz   }||         |S )z-Try to determine the number of valid sectionsarraypointer   
layer_nameoffsetsubtypecountr      )
r.   objectr1   r	   r2   volra   attrsr/   get_type)r&   grparridxs       r*   _get_sect_countzmodule._get_sect_count   s    m""&&((9>9GCx*9M.77**,,y~=	I   # 
 
 #h 	'C #h 	
r+   c           	   #     K   | j                             d          r| j         j        }n|                     | j         j                  }| j                            |                                 t          j	        z   dz   | j
        j        | j         j        j
        j        | j        j                            |                                 t          j	        z   dz             |          }|D ]}|V  dS )zGet sections of the module	nsectionsr]   module_sect_attrr`   N)
sect_attrsr>   ro   rm   rj   r.   rf   r1   r	   r2   rg   ra   rh   rb   r/   ri   )r&   	num_sectsrk   attrs       r*   get_sectionszmodule.get_sections   s      ?%%k22 	B1II,,T_-@AAIm""&&((9>9GCx*?(,3M.77**,,y~=@RR   # 
 
  	 	DJJJJ	 	r+   c                 n    t           j                            | j        dddd t          j                  }|S )Nelf_symbol_tabler   r   )native_typesclass_types)r   IntermediateSymbolTablecreater.   r   rx   )r&   elf_table_names     r*   get_elf_table_namezmodule.get_elf_table_name   s>    !9@@M A 
 
 r+   c           	   #     K   t          | d          s|                                 | _        t          j        | j        |                                           rd}nd}| j                            |                                 t          j	        z   dz   | j
        j        | j        | j        j                            | j        t          j	        z   |z   dz             | j        dz             }| j        r	|D ]}|V  dS dS )	zSGet symbols of the module

        Yields:
                A symbol object
        _elf_table_nameElf64_Elf32_r]   Symre   r`   N)hasattrr|   r~   r   symbol_table_is_64bitr.   r1   rf   r	   r2   rg   ra   section_symtabr/   ri   
num_symtabsection_strtab)r&   prefixsymssyms       r*   get_symbolszmodule.get_symbols   s      t.// 	=#'#:#:#<#<D (8R8R8T8TUU 	FFF}##&&((9>9GCx*&M.77$y~5>F  /A% $ 
 
  	  					 	 r+   returnc              #     K   |                                  D ]}| j                            |                                 t          j        z   dz   | j        j        | j        |j	        z             }	 t          j        |d          }n# t          j        $ r Y w xY w|dk    r1| j        j        | j        j                 j        }|j        |z  }||fV  dS )zGet names and addresses for each symbol of the module

        Yields:
                A tuple for each symbol containing the symbol name and its corresponding value
        r]   ra   rb       N)r   r.   rf   r1   r	   r2   rg   native_layer_namer   st_namer   rY   r
   InvalidAddressExceptionlayersra   address_maskst_value)r&   r   sym_arrsym_namemasksym_addresss         r*   get_symbols_names_and_addressesz&module.get_symbols_names_and_addresses   s       ##%% 	. 	.Cm****,,y~=G85*S[8 +  G
"2S  5   2~~}+DH,?@M!lT1----!	. 	.s   0BBBc                 N    |                                  D ]\  }}||k    r|c S dS )z(Get symbol value for a given symbol nameNr   )r&   wanted_sym_namer   r   s       r*   
get_symbolzmodule.get_symbol   sE    %)%I%I%K%K 	# 	#!Hk(**"""" + tr+   c                 N    |                                  D ]\  }}||k    r|c S dS )z*Get symbol name for a given symbol addressNr   )r&   wanted_sym_addressr   r   s       r*   get_symbol_by_addresszmodule.get_symbol_by_address   sB    %)%I%I%K%K 	  	 !Hk![00 1 tr+   c                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nkallsymssymtabz&module -> symtab: Unable to get symtab)r>   r   r   rA   r7   s    r*   r   zmodule.section_symtab   sL    ??:&& 	=''__X&& 	;EFFFr+   c                     |                      d          rt          | j        j                  S |                      d          rt          | j                  S t	          d          )Nr   r   z;module -> num_symtab: Unable to determine number of symbols)r>   intr   r   rA   r7   s    r*   r   zmodule.num_symtab  sb    ??:&& 	(t}/000__\** 	(t'''I
 
 	
r+   c                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nr   strtabz&module -> strtab: Unable to get strtab)r>   r   r   rA   r7   s    r*   r   zmodule.section_strtab  sN     ??:&& 	=''__X&& 	;EFFFr+   )__name__
__module____qualname__r$   propertyr-   rB   rL   rR   rT   rW   r[   rm   rt   r|   r   r   strr   r   r   r   r   r   r   __classcell__)r)   s   @r*   r    r       s       " " " " " " " X"&U U U
 
 
(
 
 
*U U UU U U2 2 2  "  &	 	 	  4.sCx . . . .2     G G XG 
 
 X
 G G XG G G G Gr+   r    c                       e Zd Z	 ddededee         fdZ	 ddedeee	e	f         ddf         fdZ
edefd	            Zedefd
            Zedefd            Zdeej        j                 fdZdS )task_structNconfig_prefixpreferred_namer   c                 x   | j         j        | j        j                 }	 | j        j        }n# t          j        $ r Y dS w xY wt          |t          j
                  st          d          |                    |          \  }}|sdS || j        j        d| j         z   }|                     | j         |||          S )zkConstructs a new layer based on the process's DTB.

        Returns the name of the Layer or None.
        NzJParent layer is not a translation layer, unable to construct process layer_Process)r.   r   rg   ra   mmpgdr
   r   
isinstancer   LinearlyMappedLayer	TypeError	translatepid_add_process_layer)r&   r   r   parent_layerr   dtbra   s          r*   add_process_layerztask_struct.add_process_layer  s     }+DH,?@	'+CC1 	 	 	44	,(BCC 	\   '0055Z 	4!!X03Hdh3H3HHN&&M3~
 
 	
s   + >>F	heap_onlyc              #   f  K   | j                                         D ]}t          |j                  }t          |j                  }|r!|| j         j        k    r|| j         j        k    sMt                              d|dd| j         j        dd|dd| j         j        d           |||z
  fV  dS )zdReturns a list of sections based on the memory manager's view of
        this task's virtual memory.zadding vma: x z | N)	r   get_vma_iterr   vm_startvm_endbrk	start_brkr5   info)r&   r   vmastartends        r*   get_process_memory_sectionsz'task_struct.get_process_memory_sections7  s      
 7'')) 	' 	'C%%Ecj//C %47;"6"63$'BS;S;S \5\\\TW[\\\s\\\twGX\\\   #+&&&&&	' 	'r+   c                 <    | j         t          j        j        z  dk    S )zChecks if this task is a kernel thread.

        Returns:
            bool: True, if this task is a kernel thread. Otherwise, False.
        r   )flagsr	   r   
PF_KTHREADr7   s    r*   is_kernel_threadztask_struct.is_kernel_threadI  s     
Y_77A==r+   c                 "    | j         | j        k    S )zChecks if this task is a thread group leader.

        Returns:
            bool: True, if this task is a thread group leader. Otherwise, False.
        )tgidr   r7   s    r*   is_thread_group_leaderz"task_struct.is_thread_group_leaderR  s     yDH$$r+   c                 2    | j          o| j        | j        k    S )zChecks if this task is a user thread.

        Returns:
            bool: True, if this task is a user thread. Otherwise, False.
        )r   r   r   r7   s    r*   is_user_threadztask_struct.is_user_thread[  s     ((BTY$(-BBr+   c              #      K   |                                  }| j                            | t          j         dd          D ]}|V  dS )zWReturns a list of the task_struct based on the list_head
        thread_node structure.r   thread_groupN)r1   r   to_listr	   r2   )r&   task_symbol_table_nametasks      r*   get_threadsztask_struct.get_threadsd  sj       "&!;!;!=!= %--%By~BBBN
 
 	 	D JJJJ	 	r+   )NN)F)r   r   r   r   r   r   boolr   r   r   r   r   r   r   r   r   r   r   ObjectInterfacer    r+   r*   r   r     s.       ?C
 
 
9<
	#
 
 
 
8 !&' ''	5c?D$.	/' ' ' '$ >$ > > > X> % % % % X% C C C C XCXj&8&HI      r+   r   c                       e Zd Zd Zd ZdS )	fs_structc                     |                      d          r| j        S | j                             d          r| j        j        S t          d          )NrootmntdentryzUnable to find the root dentry)r>   rootr   rA   r7   s    r*   get_root_dentryzfs_struct.get_root_dentryu  sP    ??9%% 	$9Y!!(++ 	$9##=>>>r+   c                     |                      d          r| j        S | j                             d          r| j        j        S t	          d          )Nr   mntzUnable to find the root mount)r>   r   r   r   rA   r7   s    r*   get_root_mntzfs_struct.get_root_mnt}  sO    ??9%% 	!<Y!!%(( 	!9= <===r+   N)r   r   r   r   r   r   r+   r*   r   r   t  s2        ? ? ?> > > > >r+   r   c                   D    e Zd ZdZdZdZdZdZdZdZ	dZ
dZd Z	 	 dd
Zd	S )
maple_tree|               r   re   c              #      K   | j         j        | j         z  }| j        | j        z  | j        z	  }|                     | j        ||          E d{V  dS )z4Parse the Maple Tree and return every non zero slot.N)rg   rb   MAPLE_NODE_POINTER_MASKma_flagsMT_FLAGS_HEIGHT_MASKMT_FLAGS_HEIGHT_OFFSET_parse_maple_tree_nodema_root)r&   maple_tree_offsetexpected_maple_tree_depths      r*   get_slot_iterzmaple_tree.get_slot_iter  s       HO0L.MMMD55(%)! ..L+-F
 
 	
 	
 	
 	
 	
 	
 	
 	
 	
r+   Nc           	   #     K   |t                      }||v r-t                              dt          |           d           dS |                    |           ||k     r;t                              dt          | j        j                   d| d| d           || j         z  }|| j        z	  | j	        z  }| 
                                }| j                            |t          j        z   dz   | j        j        |	          }	|	| j         z  }
|
|k    sJ | j                            |t          j        z   d
z   | j        j        |	          }|| j        k    r$|j        j        D ]}|| j	         z  dk    r|V  dS || j        k    r$|j        j        D ]}|| j	         z  dk    r|V  dS || j        k    rB|j        j        D ]3}|| j	         z  dk    r"|                     |||||dz             E d{V  4dS || j        k    rB|j        j        D ]3}|| j	         z  dk    r"|                     |||||dz             E d{V  4dS t5          d| dt          |           d          )z@Recursively parse Maple Tree Nodes and yield all non empty slotsNzThe mte zL has all ready been seen, no further results will be produced for this node.z The depth for the maple tree at z is z,, however when parsing the nodes a depth of zC was reached. This is unexpected and may lead to incorrect results.r^   r   
maple_noder   re   zUnkown Maple Tree node type z at offset .)setr5   warninghexaddrg   rb   r   MAPLE_NODE_TYPE_SHIFTMAPLE_NODE_TYPE_MASKr1   r.   rf   r	   r2   r   ra   MAPLE_DENSEallocslotMAPLE_LEAF_64mr64MAPLE_RANGE_64r   MAPLE_ARANGE_64ma64rA   )r&   maple_tree_entryparentr   seencurrent_depthr^   	node_typesymbol_table_namenode_parent_mtenode_parent_pointernoder  s                r*   r   z!maple_tree._parse_maple_tree_node  s     " <55D t##NN~3/00~~~   4HH%&&&
 %}44NNq3tx3G3G q qMf q q+q q q   #t'C%DD ::%&	
 !6688-..	.:x1 / 
 
 .$2N0OO #f,,,, }##	.=x* $ 
 
 (((
  T677A==JJJ  $,,,	  T677A==JJJ  $---	  T677A==#::1%)            $...	  T677A==#::1%)            !TyTTS\\TTT  r+   Nre   )r   r   r   r   r   r  r  r   r  r  r	  r
  r   r   r   r+   r*   r   r     s}          ! !" KMNO
 
 
 b b b b b br+   r   c                       e Zd Zdeej        j                 fdZdeej        j                 fdZdeej        j                 fdZ	deej        j                 fdZ
deej        j                 fdZdS )	mm_structr   c              #   r   K   t                               d           |                                 E d{V  dS )zL
        Deprecated: Use either get_vma_iter() or _get_mmap_iter().
        MThis method has been deprecated in favour of using the get_vma_iter() method.Nr5   r   r   r7   s    r*   get_mmap_iterzmm_struct.get_mmap_iter	  M       	[	
 	
 	
 $$&&&&&&&&&&&r+   c              #   b  K   |                      d          st          d          | j        sdS | j        V  | j        j        j        h}| j        j        }|dk    rN|j        j        |vrD|V  |                    |j        j                   |j        }|dk    r|j        j        |v>dS dS dS dS )zReturns an iterator for the mmap list member of an mm_struct. Use this only if
        required, get_vma_iter() will choose the correct _get_maple_tree_iter() or
        _get_mmap_iter() automatically as required.mmapz?_get_mmap_iter called on mm_struct where no mmap member exists.Nr   )r>   rA   r  rg   rb   vm_nextr  )r&   r  links      r*   _get_mmap_iterzmm_struct._get_mmap_iter  s      
 v&& 	 Q   y 	4i	$%y aiiDHO477JJJHHTX_%%%<D aiiDHO47777iiii77r+   c              #   r   K   t                               d           |                                 E d{V  dS )zR
        Deprecated: Use either get_vma_iter() or _get_maple_tree_iter().
        r  Nr  r7   s    r*   get_maple_tree_iterzmm_struct.get_maple_tree_iter(  r  r+   c              #   (  K   |                      d          st          d          |                                 }| j                                        D ]=}| j                            |t          j        z   dz   | j	        j
        |          }|V  >dS )zReturns an iterator for the mm_mt member of an mm_struct. Use this only if
        required, get_vma_iter() will choose the correct _get_maple_tree_iter() or
        get_mmap_iter() automatically as required.mm_mtzF_get_maple_tree_iter called on mm_struct where no mm_mt member exists.vm_area_structr   N)r>   rA   r1   r%  r   r.   rf   r	   r2   rg   r   )r&   r  vma_pointerr   s       r*   _get_maple_tree_iterzmm_struct._get_maple_tree_iter1  s      
 w'' 	 X   !6688:3355 	 	K-&&!IN25EE85" '  C
 IIII	 	r+   c              #      K   |                      d          r|                                 E d{V  dS |                      d          r|                                 E d{V  dS t          d          )zgReturns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required.r  Nr%  z)Unable to find mmap or mm_mt in mm_struct)r>   r!  r(  rA   r7   s    r*   r   zmm_struct.get_vma_iterD  s       ??6"" 	N**,,,,,,,,,,,__W%% 	N0022222222222 !LMMMr+   N)r   r   r   r   r   r   r   r  r!  r#  r(  r   r   r+   r*   r  r    s        'x
(:(JK ' ' ' ' );)K L        ,'Xj.@.P%Q ' ' ' 'hz/A/Q&R    &Nhz'9'IJ N N N N N Nr+   r  c                       e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZede
de	dediZedefd            Zedefd            ZdefdZdee         fdZd ZdS )super_block   re   r            @                    @       syncdirsyncmandlazytimer   c                      | j         | j        z	  S r"   s_dev	MINORBITSr7   s    r*   majorzsuper_block.majorj  s    zT^++r+   c                 ,    | j         d| j        z  dz
  z  S r  r>  r7   s    r*   minorzsuper_block.minorn  s    za4>1Q677r+   c                 (    | j         | j        z  rdndS Nrorw)s_flags	SB_RDONLYr7   s    r*   get_flags_accesszsuper_block.get_flags_accessr  s    |dn4>tt$>r+   c                 .      fd j         D             }|S )Nc                 >    g | ]}|j         z  j        |         S r   )rH  SB_OPTS).0sb_optr&   s     r*   
<listcomp>z.super_block.get_flags_opts.<locals>.<listcomp>v  s<     
 
 
%+v?T
L 
 
 
r+   )rM  )r&   sb_optss   ` r*   get_flags_optszsuper_block.get_flags_optsu  s4    
 
 
 
/3|
 
 
 r+   c                     t          j        | j        j        d          }| j        r#t          j        | j        d          }|d|z   z  }|S )Nr   rd   r   )r   pointer_to_strings_typerZ   	s_subtype)r&   mnt_sb_typemnt_sb_subtypes      r*   ri   zsuper_block.get_type{  sR    /0@LLL> 	0$6t~SQQQN3//Kr+   N)r   r   r   r@  rI  	SB_NOSUIDSB_NODEV	SB_NOEXECSB_SYNCHRONOUSSB_MANDLOCK
SB_DIRSYNC
SB_NOATIMESB_NODIRATIME	SB_SILENTSB_POSIXACLSB_KERNMOUNTSB_I_VERSIONSB_LAZYTIMErM  r   r   rA  rC  r   rJ  r   rR  ri   r   r+   r*   r+  r+  O  s       I IIHINKJJMIKLLK 	IVZ	G ,s , , , X, 8s 8 8 8 X8?# ? ? ? ?        r+   r+  c                       e Zd ZddddZi ddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6Zd7efd8Zd7efd9Zd7efd:Zd7e	fd;Z
d< Zd?d>Zd=S )@r&  rwr   )re   r   r-  re   VM_READr   VM_WRITEr-  VM_EXECr.  	VM_SHAREDr/  
VM_MAYREAD    VM_MAYWRITEr0  
VM_MAYEXECr1  VM_MAYSHARE   VM_GROWSDOWNr   VM_NOHUGEPAGEr2  	VM_PFNMAPr3  VM_DENYWRITE   VM_EXECUTABLE    	VM_LOCKEDi @  VM_IOr4  VM_SEQ_READr5  VM_RAND_READVM_DONTCOPYVM_DONTEXPANDVM_RESERVED
VM_ACCOUNTVM_NORESERVE
VM_HUGETLBVM_NONLINEARVM_MAPPED_COP__VM_HUGEPAGEVM_INSERTPAGEVM_ALWAYSDUMPVM_CAN_NONLINEARVM_MIXEDMAPVM_SAOVM_PFN_AT_MMAPVM_MERGEABLE)i   i   i   i   i    r6  r7  i   r8  i   i   i   i    i   @l        r   c                 f    d}|                                 D ]\  }}||z  |k    r||z   }|dz   }|S )zJReturns an string representation of the flags in a
        vm_area_struct.r   -)items)r&   vm_flagsparse_flagsretvalr   chars         r*   _parse_flagszvm_area_struct._parse_flags  sR     %++-- 	& 	&JD$4D(($#r+   c                 R    |                      | j        dz  t          j                  S )Nr   )r  r  r&  
perm_flagsr7   s    r*   get_protectionzvm_area_struct.get_protection  s"      !79RSSSr+   c                 B    |                      | j        | j                  S r"   )r  r  extended_flagsr7   s    r*   	get_flagszvm_area_struct.get_flags  s      0CDDDr+   c                 r    | j         dk    rdS | j        j        | j        j                 }| j        |j        z  S Nr   )vm_filer.   r   rg   ra   vm_pgoff
page_shift)r&   r   s     r*   get_page_offsetzvm_area_struct.get_page_offset  s8    <11}+DH,?@} 777r+   c                    | j         dk    r't          j                            ||| j                   }n| j        |j        j        k    r| j        |j        j        k    rd}ne| j        |j        j	        cxk    r| j        k    rn nd}n>| j
        j                            d          r| j        | j
        j        j        k    rd}nd}|S )Nr   z[heap]z[stack]vdsoz[vdso]zAnonymous Mapping)r  r   LinuxUtilitiespath_for_filer   r   r   r   r   start_stackvm_mmcontextr>   r  )r&   r  r   fnames       r*   r[   zvm_area_struct.get_name  s    <1(66wdlSSEE]dg///DK47;4N4NEE]dg1@@@@T[@@@@@EEJ))&11	(!3!888EE'Er+   Nc                 0   d}|                                  }|dk    rd}n|dk    r*| j                                        j        j        dk    rd}n|rd|v rt          | j        | j        |j                  D ]}	 |	                    |          r/t                              dt          |           d           d} nYH# t          j        t          j        f$ r:}t                              d	t          |           d
|            d}Y d }~ nd }~ww xY w|S )NFrwxTzr-xr   r   z%Found malicious (dirty+exec) page at z !zUnable to translate address z : )r  r  dereferencerg   rb   ranger   r   	page_sizeis_dirtyr5   r   r   r
   PagedInvalidAddressExceptionr   r6   )r&   	proclayerret	flags_striexcps         r*   is_suspiciouszvm_area_struct.is_suspicious  sW   ''))	CC%DL$<$<$>$>$B$IQ$N$NCC 	3)++4=$+y7JKK   ))!,, NCFFNNN   # ;6    LL!QA!Q!Q4!Q!QRRRCEEEEE 
s   9AB>>D/DDr"   )r   r   r   r  r  r   r  r  r  r   r  r[   r  r   r+   r*   r&  r&    s        J!I!J! 	I! 	K	!
 	L! 	M! 	L! 	M! 	N! 	O! 	K! 	N! 	O! 	K! 	G!  	M!!" 	N#!$ "#! " "0##&!$"A! ! !NFS    T T T T TE3 E E E E8 8 8 8 8  "     r+   r&  c                       e Zd ZdefdZdS )qstrr   c                     |                      d          r| j        dz   }nd}	 t          j                            | j        |          }n# t          j        t          f$ r d}Y nw xY w|S )Nlenre   r   r   )	r>   r  r   r   rU  rZ   r
   r   
ValueError)r&   
str_lengthr  s      r*   name_as_strzqstr.name_as_str  sy    ??5!! 	AJJJ	/33DIzJJCC2J? 	 	 	CCC	
s   %A
 
A%$A%N)r   r   r   r   r  r   r+   r*   r  r    s/        	S 	 	 	 	 	 	r+   r  c                   2    e Zd ZdefdZdefdZd Zd ZdS )r   r   c                    g }t                      }| }|                                s|j        j        |vrv|j        }|                    |j                                                   |                    |j        j                   |}|                                s|j        j        |vvdd	                    t          |                    z   S )z,Based on __dentry_path Linux kernel function/)r   is_rootrg   rb   d_parentappendd_namer  r  joinreversed)r&   reversed_pathdentry_seencurrent_dentryr  s        r*   pathzdentry.path  s    ee&&((	$")<<#,F  !6!B!B!D!DEEEOON.5666#N &&((	$")<< SXXh}556666r+   c                 b    t          | d          r	 | j        j        | j        k    S #  Y dS xY wd S )Nr  F)getattrrg   rb   r  r7   s    r*   r  zdentry.is_root  sD    4$$ 	x$-77uu		 	s   ' ,c                 P    | j         j        |k    rdS |                     |          S )zIs this dentry a subdirectory of old_dentry?

        Returns true if this dentry is a subdirectory of the parent (at any depth).
        Otherwise, it returns false.
        T)rg   rb   
d_ancestor)r&   
old_dentrys     r*   	is_subdirzdentry.is_subdir  s*     8?j((4z***r+   c                 (   t                      }| }|                                sm|j        j        |vr_|j        |j        j        k    r|S |                    |j        j                   |j        }|                                s|j        j        |v_dS )zSearch for an ancestor

        Returns the ancestor dentry which is a child of "ancestor_dentry",
        if "ancestor_dentry" is an ancestor of "child_dentry", else None.
        N)r   r  rg   rb   r  r  )r&   ancestor_dentryr  r  s       r*   r  zdentry.d_ancestor&  s     ee&&((	5")<<&/*=*DDD%%OON.5666+4N &&((	5")<< tr+   N)	r   r   r   r   r  r   r  r  r  r   r+   r*   r   r     sh        7c 7 7 7 7    + + +    r+   r   c                   N    e Zd Zdej        j        fdZdej        j        fdZdS )struct_filer   c                     |                      d          r| j        S |                      d          r| j        j        S t	          d          )Nf_dentryf_pathzUnable to find file -> dentry)r>   r  r  r   rA   r7   s    r*   
get_dentryzstruct_file.get_dentry;  sN    ??:&& 	B= __X&& 	B;%% !@AAAr+   c                     |                      d          r| j        S |                      d          r| j        j        S t	          d          )z4Returns the fs (vfsmount) where this file is mountedf_vfsmntr  z Unable to find file -> vfs mount)r>   r  r  r   rA   r7   s    r*   
get_vfsmntzstruct_file.get_vfsmntC  sM    ??:&& 	E= __X&& 	E;?" !CDDDr+   N)r   r   r   r   r   r   r  r  r   r+   r*   r  r  :  sb        BJ.> B B B BEJ.> E E E E E Er+   r  c                       e Zd Z	 	 	 ddededededee         deej        j	                 fd	Z
deej        j	                 fd
ZdS )	list_headTNsymbol_typememberforwardsentinellayerr   c              #     K   |p| j         j        }| j        j                            |                              |          }d}|rd}	 t          | |                                          }n# t          j	        $ r Y dS w xY w|s,| j        
                    ||| j         j        |z
            V  | j         j        h}	|j         j        |	vr| j        
                    |||j         j        |z
            }
|
V  |	                    |j         j                   	 t          ||                                          }n# t          j	        $ r Y dS w xY w|j         j        |	vdS dS )an  Returns an iterator of the entries in the list.

        Args:
                symbol_type: Type of the list elements
                member: Name of the list_head member in the list elements
                forward: Set false to go backwards
                sentinel: Whether self is a "sentinel node", meaning it is not embedded in a member of the list
                Sentinel nodes are NOT yielded. See https://en.wikipedia.org/wiki/Sentinel_node for further reference
                layer: Name of layer to read from
        Yields:
            Objects of the type specified via the "symbol_type" argument.

        prevnextNrb   )rg   ra   r.   r/   ri   relative_child_offsetr  r  r
   r   rf   rb   r  )r&   r  r  r  r  r  relative_offset	directionr   r  objs              r*   r   zlist_head.to_listN  s     * ,,-4==
 



'
' 	 	 	I	4++7799DD1 	 	 	44	 	-&&U48?_+L '       hoT))-&&U48?_+L '  C IIIHHTX_%%%tY//;;==5    hoT))))))s$   
"A- -B ?B "D= =EEc                 j    |                      | j        j        j        j        | j        j                  S r"   )r   rg   r  	type_namemember_namer7   s    r*   __iter__zlist_head.__iter__  s%    ||DHO/948;OPPPr+   )TTN)r   r   r   r   r   r   r   r   r   r   r   r  r   r+   r*   r  r  M  s        
 #1 11 1 	1
 1 }1 
*$4	51 1 1 1fQ(:#5#EF Q Q Q Q Q Qr+   r  c                   N    e Zd Zdej        j        fdZdej        j        fdZdS )files_structr   c                     |                      d          r| j        j                                        S |                      d          r| j                                        S t	          d          )Nfdtfdz(Unable to find files -> file descriptors)r>   r  r  r  rA   r7   s    r*   get_fdszfiles_struct.get_fds  se    ??5!! 	M8;**,,,__T"" 	M7&&((( !KLLLr+   c                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nr  max_fdsz0Unable to find files -> maximum file descriptors)r>   r  r  rA   r7   s    r*   get_max_fdszfiles_struct.get_max_fds  sN    ??5!! 	U8##__Y'' 	U< !STTTr+   N)r   r   r   r   r   r   r  r  r   r+   r*   r  r    sb        M+; M M M MUZ/? U U U U U Ur+   r  c                      e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZedededededediZd Zd Zd Zd Zd Zd ZdefdZd Zd Zd Zd ZdefdZdee         fdZdefd Zdefd!Z defd"Z!defd#Z"de#fd$Z$d% Z%d& Z&d' Z'd(S ))mountre   r   r-  r.  r/  ro  r0  rs  r   rx  rz  nosuidnodevnoexecnoatime
nodiratimerelatimec                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nr   mnt_sbz#Unable to find mount -> super block)r>   r   r  rA   r7   s    r*   
get_mnt_sbzmount.get_mnt_sb  sM    ??5!! 	H8?"__X&& 	H; !FGGGr+   c                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nr   mnt_rootz"Unable to find mount -> mount root)r>   r   r  rA   r7   s    r*   get_mnt_rootzmount.get_mnt_root  sN    ??5!! 	G8$$__Z(( 	G=  !EFFFr+   c                     |                      d          r| j        j        S |                      d          r| j        S t          d          )Nr   	mnt_flagsz#Unable to find mount -> mount flags)r>   r   r  rA   r7   s    r*   get_mnt_flagszmount.get_mnt_flags  sN    ??5!! 	H8%%__[)) 	H>! !FGGGr+   c                     | j         S )zZGets the fs where we are mounted on

        Returns:
            A mount pointer
        )
mnt_parentr7   s    r*   get_mnt_parentzmount.get_mnt_parent  s     r+   c                     | j         S )YGets the dentry of the mountpoint

        Returns:
            A dentry pointer
        )mnt_mountpointr7   s    r*   get_mnt_mountpointzmount.get_mnt_mountpoint  s     ""r+   c                 4    | j                                         S r"   )r   get_parent_mountr7   s    r*   r  zmount.get_parent_mount  s    x((***r+   r   c                 ,    | j         | j        j        k    S )zpChecks if this mount has a parent

        Returns:
            bool: 'True' if this mount has a parent
        )r
  rg   rb   r7   s    r*   
has_parentzmount.has_parent  s     $(/11r+   c                     | j         S )zZReturns the fs where we are mounted on

        Returns:
            A 'vfsmount'
        )r   r7   s    r*   get_vfsmnt_currentzmount.get_vfsmnt_current  s     xr+   c                 N    |                                                                  S )zjGets the parent fs (vfsmount) to where it's mounted on

        Returns:
            A 'vfsmount'
        )r  r  r7   s    r*   get_vfsmnt_parentzmount.get_vfsmnt_parent  "     ""$$77999r+   c                 <    |                                  }|j        }|S z\Returns the root of the mounted tree

        Returns:
            A dentry pointer
        )r  r  )r&   vfsmntr   s      r*   get_dentry_currentzmount.get_dentry_current  s!     ((**r+   c                 N    |                                                                  S zcReturns the parent root of the mounted tree

        Returns:
            A dentry pointer
        )r  r  r7   s    r*   get_dentry_parentzmount.get_dentry_parent  r  r+   c                 B    |                                  | j        z  rdndS rE  )r  MNT_READONLYr7   s    r*   rJ  zmount.get_flags_access  s%    ))++d.??IttTIr+   c                 .      fd j         D             }|S )Nc                 X    g | ]&}|                                 z  j        |         'S r   )r  	MNT_FLAGS)rN  mntflagr&   s     r*   rP  z(mount.get_flags_opts.<locals>.<listcomp>
  sG     
 
 
++---
N7#
 
 
r+   )r$  r&   r   s   ` r*   rR  zmount.get_flags_opts	  s4    
 
 
 
>
 
 

 r+   c                 :    |                                  | j        z  S r"   )r  
MNT_SHAREDr7   s    r*   	is_sharedzmount.is_shared  s    !!##do55r+   c                 :    |                                  | j        z  S r"   )r  MNT_UNBINDABLEr7   s    r*   is_unbindablezmount.is_unbindable  s    !!##d&999r+   c                 :    | j         o| j         j        j        dk    S r  
mnt_masterrg   rb   r7   s    r*   is_slavezmount.is_slave      B4?#6#=#BBr+   c                 8    t          j        | j        d          S Nr   rT  r   rU  mnt_devnamer7   s    r*   get_devnamezmount.get_devname      ()9EEEEr+   c                 d   t                      }| j        }|r|j        j        dk    r|j        j        |vrz|                    | j        |          }|r|j        j        dk    r|j        S |                    |j        j                   |j        }|r|j        j        dk    r|j        j        |vzdS )zUGet ID of closest dominating peer group having a representative under the given root.r   )r   r/  rg   rb   get_peer_under_rootmnt_nsmnt_group_idr  )r&   r   mnt_seencurrent_mntpeers        r*   get_dominating_idzmount.get_dominating_id  s    55o		1&!++&h66224;EED )1,,((LL/000%0K 		1&!++&h66 qr+   c                 T   t                      }| }|j        j        |vr|j        |k    r"|                    |j        j        |          r|S |                    |j        j                   |                                }|j        j        | j        j        k    rn|j        j        |vdS )zReturn true if path is reachable from root.
        It mimics the kernel function is_path_reachable(), ref: fs/namespace.c
        N)	r   rg   rb   r:  is_path_reachabler   r  r  	next_peer)r&   nsr   r<  r=  s        r*   r9  zmount.get_peer_under_root-  s     55o$H44!R''K,I,I($- -' #"LL/000%//11K%88 o$H44 tr+   c                    t                      }| }|j        j        j        |j        k    r|                                rw|j        j        |vri|j        }|                    |j        j                   |j        }|j        j        j        |j        k    r"|                                r|j        j        |vi|j        j        j        |j        k    o|                    |j	                  S )ztReturn true if path is reachable.
        It mimics the kernel function with same name, ref fs/namespace.c:
        )
r   r   rg   rb   r  r  r  r
  r  r   )r&   r  r   r<  r=  s        r*   rA  zmount.is_path_reachable>  s     55O&$(22&&(( 3&h66(7NLL/000%0K O&$(22&&(( 3&h66
 ")TX5 
.:R:RK;
 ;
 	
r+   c                    | j         j                            t          j                  d         }d                    |t          j                  }| j        j                            |          	                    d          }| j        
                    || j         j        | j        j        j         j        |z
            S )Nr   z{0}{1}mount	mnt_sharer  )rg   r  splitr	   r2   formatr.   r/   ri   r  rf   ra   rF  r  rb   )r&   
table_namemount_structrb   s       r*   rB  zmount.next_peerP  s    X'--in==a@
$++J	GG+44
 



,
, 	 }##H>&*1F: $ 
 
 	
r+   N)(r   r   r   
MNT_NOSUID	MNT_NODEV
MNT_NOEXECMNT_NOATIMEMNT_NODIRATIMEMNT_RELATIMEr!  MNT_SHRINKABLEMNT_WRITE_HOLDr(  r+  r$  r  r  r  r  r  r  r   r  r  r  r  r  r   rJ  r   rR  r)  r,  r0  r6  r   r?  r9  rA  rB  r   r+   r*   r  r    s)       JIJKNLLNNJN 	H7HYjIH H HG G GH H H  # # #+ + +2D 2 2 2 2  : : :	 	 	: : :J# J J J J    64 6 6 6 6:t : : : :C$ C C C CFS F F F F       "
 
 
$
 
 
 
 
r+   r  c                       e Zd Zd ZdefdZdefdZd Zd Zd Z	d Z
d	 Zd
 Zd Zd ZdefdZd ZdefdZdee         fdZd ZdefdZdefdZdefdZdefdZdS )vfsmountc                     |                                  dk    o/|                                 dk    o|                                 dk    S r  )r  r  r  r7   s    r*   is_validzvfsmount.is_valid_  sK    OO" +!!##q(+##%%*	
r+   r   c                 ,    |                      d          S )a  Helper to distinguish between kernels prior to version 3.3.8 that
        lacked the 'mount' structure and later versions that have it.

        The 'mnt_parent' member was moved from struct 'vfsmount' to struct
        'mount' when the latter was introduced.

        Alternatively, vmlinux.has_type('mount') can be used here but it is faster.

        Returns:
            bool: 'True' if the kernel
        r
  )r>   r7   s    r*    _is_kernel_prior_to_struct_mountz)vfsmount._is_kernel_prior_to_struct_mountf  s     |,,,r+   c                     t          |          t          j        k    r| j        j        |k    S t          j        d          )a;  Helper to make sure it is comparing two pointers to 'vfsmount'.

        Depending on the kernel version, the calling object (self) could be
        a 'vfsmount \*' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust
        in the framework "auto" dereferencing ability to assure that when we
        reach this point 'self' will be a 'vfsmount' already and self.vol.offset
        a 'vfsmount \*' and not a 'vfsmount \*\*'. The argument must be a 'vfsmount \*'.
        Typically, it's called from do_get_path().

        Args:
            vfsmount_ptr (vfsmount *): A pointer to a 'vfsmount'

        Raises:
            exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount \*'

        Returns:
            bool: 'True' if the given argument points to the the same 'vfsmount'
            as 'self'.
        z5Unexpected argument type. It has to be a 'vfsmount *')typer   Pointerrg   rb   r
   VolatilityException)r&   vfsmount_ptrs     r*   is_equalzvfsmount.is_equalu  s@    ( 008?l220G  r+   c                     t           j                            | j        |           }t           j                            | j        j        dd|          S )zGets the struct 'mount' containing this 'vfsmount'.

        It should be only called from kernels >= 3.3.8 when 'struct mount' was introduced.

        Returns:
            mount: the struct 'mount' containing this 'vfsmount'.
        r  r   )r   r  get_module_from_volobj_typer.   container_ofrg   rb   )r&   vmlinuxs     r*   _get_real_mntzvfsmount._get_real_mnt  sG     &BB4=RVWW#00HOWeW
 
 	
r+   c                 *    |                                  S )zhReturns the current fs where we are mounted on

        Returns:
            A vfsmount pointer
        )r  r7   s    r*   r  zvfsmount.get_vfsmnt_current  s     ""$$$r+   c                     |                                  r|                                 S |                                                                 S )zGets the parent fs (vfsmount) to where it's mounted on

        Returns:
            For kernels <  3.3.8: A vfsmount pointer
            For kernels >= 3.3.8: A vfsmount object
        )rX  r  rc  r  r7   s    r*   r  zvfsmount.get_vfsmnt_parent  sH     0022 	<&&(((%%''99;;;r+   c                     |                                  r|                                 S |                                                                 S r  )rX  r  rc  r  r7   s    r*   r  zvfsmount.get_dentry_current  H     0022 	=**,,,%%''::<<<r+   c                     |                                  r|                                 S |                                                                 S r  )rX  r  rc  r7   s    r*   r  zvfsmount.get_dentry_parent  rg  r+   c                     |                                  r| j        S |                                                                 S )zGets the mnt_parent member.

        Returns:
            For kernels <  3.3.8: A vfsmount pointer
            For kernels >= 3.3.8: A mount pointer
        )rX  r
  rc  r  r7   s    r*   r  zvfsmount.get_mnt_parent  s>     0022 	9?"%%''66888r+   c                 l    |                      d          r| j        S |                                 j        S )r  r  )r>   r  rc  r7   s    r*   r  zvfsmount.get_mnt_mountpoint  s7     ??+,, 	7&&%%''66r+   c                     | j         S r"   )r  r7   s    r*   r  zvfsmount.get_mnt_root  s
    }r+   c                     |                                  r| j        | j        j        k    S |                                                                 S r"   )rX  r
  rg   rb   rc  r  r7   s    r*   r  zvfsmount.has_parent  sE    0022 	5?dho55%%''22444r+   c                     | j         S r"   )r  r7   s    r*   r  zvfsmount.get_mnt_sb  s
    {r+   c                 2    | j         t          j        z  rdndS rE  )r  r  r!  r7   s    r*   rJ  zvfsmount.get_flags_access  s    ~(::DttDr+   c                 \      fdt           j                                        D             }|S )Nc                 6    g | ]\  }}|j         z  d k    |S )r   r  )rN  r%  
mntflagtxtr&   s      r*   rP  z+vfsmount.get_flags_opts.<locals>.<listcomp>  s9     
 
 
#'1,, ,,,r+   )r  r$  r  r&  s   ` r*   rR  zvfsmount.get_flags_opts  s@    
 
 
 
','<'<'>'>
 
 

 r+   c                     | j         S r"   rq  r7   s    r*   r  zvfsmount.get_mnt_flags  s
    ~r+   c                 D    |                                  t          j        z  S r"   )r  r  r(  r7   s    r*   r)  zvfsmount.is_shared  s    !!##e&666r+   c                 D    |                                  t          j        z  S r"   )r  r  r+  r7   s    r*   r,  zvfsmount.is_unbindable  s    !!##e&:::r+   c                 :    | j         o| j         j        j        dk    S r  r.  r7   s    r*   r0  zvfsmount.is_slave  r1  r+   c                 8    t          j        | j        d          S r3  r4  r7   s    r*   r6  zvfsmount.get_devname  r7  r+   N)r   r   r   rV  r   rX  r^  rc  r  r  r  r  r  r  r  r  r  r   rJ  r   rR  r  r)  r,  r0  r6  r   r+   r*   rT  rT  ^  s       
 
 
-$ - - - -    6
 
 
% % %
< 
< 
<	= 	= 	=	= 	= 	=
9 
9 
9	7 	7 	7  5D 5 5 5 5  E# E E E E      74 7 7 7 7;t ; ; ; ;C$ C C C CFS F F F F F Fr+   rT  c                       e Zd Zd ZdS )kobjectc                 p    | j         j        }|                    d          r|j        }n|j        j        }|S )Ncounter)krefrefcountr>   r{  refs)r&   refcntr  s      r*   reference_countzkobject.reference_count  s:    #Y'' 	&.CC+%C
r+   N)r   r   r   r  r   r+   r*   ry  ry    s#            r+   ry  c                       e Zd Zd Zd ZdS )mnt_namespacec                     |                      d          r| j        S |                      d          r&| j                             d          r| j        j        S t	          d          )N	proc_inumrC  inumz"Unable to find mnt_namespace inoder>   r  rC  r  rA   r7   s    r*   	get_inodezmnt_namespace.get_inode  se    ??;'' 	G>!__T"" 	Gtw'9'9&'A'A 	G7< !EFFFr+   c              #   2  K   | j         j                            t          j                  d         }|t          j        z   dz   }| j        j                            |          s|t          j        z   dz   }| j        	                    |d          D ]}|V  d S )Nr   r  rT  mnt_list)
rg   r  rG  r	   r2   r.   r/   has_typelistr   )r&   rI  mnt_typer  s       r*   get_mount_pointszmnt_namespace.get_mount_points  s      X'--in==a@
	.8})228<< 	@!IN2Z?HY&&x<< 	 	EKKKK	 	r+   N)r   r   r   r  r  r   r+   r*   r  r    s5        G G G    r+   r  c                       e Zd Zd ZdS )netc                     |                      d          r| j        S |                      d          r&| j                             d          r| j        j        S t	          d          )Nr  rC  r  z"Unable to find net_namespace inoder  r7   s    r*   r  znet.get_inode#  sg    ??;'' 	G>!__T"" 	Gtw'9'9&'A'A 	G7< !!EFFFr+   N)r   r   r   r  r   r+   r*   r  r  "  s(        	G 	G 	G 	G 	Gr+   r  c                        e Zd Zd Zd Zd ZdS )socketc                 4   | j         j                            dd          }t          |          dk    r|d         nd }t	          | j        j                            |                    }|st          d|           |d         }| j        j        |         }|S )N!re   r   r   z!No module using the symbol table )	rg   r  rG  r  r  r.   modulesget_modules_by_symbol_tablesr  )r&   symbol_table_arrsymbol_tablemodule_nameskernel_module_namekernels         r*   _get_vol_kernelzsocket._get_vol_kernel0  s    8-33C;;.12B.C.Cq.H.H'**dM!>>|LL
 
  	QOOOPPP)!_&'9:r+   c                     	 |                                  }n# t          $ r Y dS w xY wt          j                            | j        j        dd|          }|j        }|j        S )Nr   socket_allocr  )	r  r  r   r  ra  rg   rb   	vfs_inodei_ino)r&   r  r  r  s       r*   r  zsocket.get_inode=  ss    	))++FF 	 	 	11	+88HO^Xv
 
 !*	s    
%%c                 t    | j         }d|cxk    rt          t                    k     rn d S t          |         S d S r  )stater  r   )r&   socket_state_idxs     r*   	get_statezsocket.get_stateI  sL    : 55553}#5#5555555 !122 65r+   N)r   r   r   r  r  r  r   r+   r*   r  r  /  sA          
 
 
3 3 3 3 3r+   r  c                   ,    e Zd Zd Zd Zd Zd Zd ZdS )sockc                 ~    | j         j        }d|cxk    rt          t                    k     rn d S t          |         S d S r  )_sock__sk_common
skc_familyr  r   r&   
family_idxs     r*   
get_familyzsock.get_familyP  sM    %0

----S--------z** .-r+   c                 6    t          j        | j        d          S )Nr   )r   getsk_typer7   s    r*   ri   zsock.get_typeU  s    ~dlB///r+   c                 F    | j         sdS | j                                         S r  )	sk_socketr  r7   s    r*   r  zsock.get_inodeX  s%    ~ 	1~'')))r+   c                     d S r"   r   r7   s    r*   get_protocolzsock.get_protocol]      tr+   c                     |                      d          r| j        j                                        S | j                                        S )Nsk)r>   r  r  r  r7   s    r*   r  zsock.get_state`  sA    ??4   	17$..000~'')))r+   N)r   r   r   r  ri   r  r  r  r   r+   r*   r  r  O  s_        + + +
0 0 0* * *
  * * * * *r+   r  c                   &    e Zd Zd Zd Zd Zd ZdS )	unix_sockc                     | j         sd S | j         j                            d          }t          t	          j        |j                            }|S )Nsockaddr_un)addrrZ   castr   r   rY   sun_path)r&   r  saddrs      r*   r[   zunix_sock.get_nameh  sH    y 	4in))-88G+K,@AABBr+   c                     d S r"   r   r7   s    r*   r  zunix_sock.get_protocolo  r  r+   c                     | j                                         dk    rC| j         j        j        }d|cxk    rt	          t
                    k     rn dS t
          |         S dS | j         j                                        S z,Return a string representing the sock state.STREAMr   N)r  ri   _unix_sock__sk_common	skc_stater  r   r  r  r&   	state_idxs     r*   r  zunix_sock.get_stater  s     7))+5II////J//////!),, 0/ 7$..000r+   c                 4    | j                                         S r"   )r  r  r7   s    r*   r  zunix_sock.get_inode~  s    w  """r+   N)r   r   r   r[   r  r  r  r   r+   r*   r  r  g  sP            
1 
1 
1# # # # #r+   r  c                   8    e Zd Zd Zd Zd Zd Zd Zd Zd Z	dS )		inet_sockc                     | j         j        j        }d|cxk    rt          t                    k     rn d S t          |         S d S r  )r  _inet_sock__sk_commonr  r  r   r  s     r*   r  zinet_sock.get_family  sO    W(3

----S--------z** .-r+   c                     t          j        | j        j                  }|                                 dk    rt          j        | j        j        |          }|S )NAF_INET6)r   r  r  sk_protocolr  r   )r&   protocols     r*   r  zinet_sock.get_protocol  sJ      #DG$788??
**%)$'*=xHHHr+   c                     | j                                         dk    rC| j         j        j        }d|cxk    rt	          t
                    k     rn dS t
          |         S dS | j         j                                        S r  )r  ri   r  r  r  r   r  r  r  s     r*   r  zinet_sock.get_state  s     7))+5II////J//////!),, 0/ 7$..000r+   c           	      r    t          | dt          | dd                     }|t          j        |          S d S )Nsport
inet_sport)r  socket_modulehtons)r&   sport_les     r*   get_src_portzinet_sock.get_src_port  s>    4'$d*K*KLL &x000  r+   c                    | j         j        }t          |d          r|j        dz  }nJt          | d          r| j        }n2t          | d          r| j        }nt          |d          r|j        }nd S t          j        |          S )Nskc_portpairi  dport
inet_dport	skc_dport)	r  r  r   r  r  r  r  r  r  )r&   	sk_commondport_les      r*   get_dst_portzinet_sock.get_dst_port  s    G'	9n-- 		 -6HHT7## 	zHHT<(( 	HHY,, 	 *HH4"8,,,r+   c                     | j         j        }|j        }|t          j        k    r:d}t          | d          r| j        }nAt          | d          r| j        }n)|j        }n!|t          j	        k    rd}| j
        j        }nd S | j        j        | j        j                 }	 |                    |j        j        |          }n># t$          j        $ r, t(                              d|j        j        d           Y d S w xY wt          j        ||          S )Nr-  	rcv_saddrinet_rcv_saddrr/  z'Unable to read socket src address from #x)r  r  r  r  AF_INETr   r  r  skc_rcv_saddrr  pinet6r  r.   r   rg   ra   readrb   r
   r   r5   r6   	inet_ntop)r&   r  family	addr_sizer  r   
addr_bytess          r*   get_src_addrzinet_sock.get_src_addr  s'   G'	%]***It[)) 0/00 0+!/}---IK%EE4}+DH,?@	%**59+;YGGJJ1 	 	 	LLO%):JOOO   44		
 &vz:::s    B= =7C87C8c                 v   | j         j        }|j        }|t          j        k    rHt          | d          r| j        r| j        }n&t          | d          r| j        r| j        }n|j        }d}n>|t          j	        k    r,t          | j
        d          r| j
        j        }n|j        }d}nd S | j        j        | j        j                 }	 |                    |j        j        |          }n># t$          j        $ r, t(                              d|j        j        d           Y d S w xY wt          j        ||          S )Ndaddr
inet_daddrr-  r/  z'Unable to read socket dst address from r  )r  r  r  r  r  r   r  r  	skc_daddrr  r  skc_v6_daddrr.   r   rg   ra   r  rb   r
   r   r5   r6   r  )r&   r  r  r  r  r   r  s          r*   get_dst_addrzinet_sock.get_dst_addr  sU   G'	%]***tW%% ,$* ,
|,, , ,!+II}---t{G,, /)!.II4}+DH,?@	%**59+;YGGJJ1 	 	 	LLO%):JOOO   44		
 &vz:::s    C( (7D#"D#N)
r   r   r   r  r  r  r  r  r  r  r   r+   r*   r  r    s}        + + +
  	1 	1 	11 1 1
- - -; ; ;4; ; ; ; ;r+   r  c                   &    e Zd Zd Zd Zd Zd ZdS )netlink_sockc                 ~    | j         j        }d|cxk    rt          t                    k     rn d S t          |         S d S r  )r  r  r  r   )r&   protocol_idxs     r*   r  znetlink_sock.get_protocol  sM    w*5555s#455555555$\22 65r+   c                 >    | j         j                                        S r"   r  r  r  r7   s    r*   r  znetlink_sock.get_state      w **,,,r+   c                     |                      d          r| j        S |                      d          r| j        S t          d          )Nr   portidzUnable to find a source port id)r>   r   r  rA   r7   s    r*   
get_portidznetlink_sock.get_portid  sI    ??5!! 	8O??8$$ 	D; !BCCCr+   c                     |                      d          r| j        S |                      d          r| j        S t          d          )Ndst_pid
dst_portidz$Unable to find a destination port id)r>   r  r  rA   r7   s    r*   get_dst_portidznetlink_sock.get_dst_portid  sJ    ??9%% 	 <??<(( 	I?" !GHHHr+   N)r   r   r   r  r  r  r   r   r+   r*   r  r    sX        3 3 3
- - -D D DI I I I Ir+   r  c                       e Zd Zd Zd ZdS )
vsock_sockc                     d S r"   r   r7   s    r*   r  zvsock_sock.get_protocol      tr+   c                 >    | j         j                                        S r"   r  r7   s    r*   r  zvsock_sock.get_state
  r  r+   Nr   r   r   r  r  r   r+   r*   r  r    s2          - - - - -r+   r  c                       e Zd Zd Zd ZdS )packet_sockc                 |    t          j        | j                  }|dk    rd S |t          v rt          |         S d|dS )Nr   0xr   )r  r  numr   )r&   	eth_protos     r*   r  zpacket_sock.get_protocol  sI    !'11	>>4-'' ++%	%%%%r+   c                 >    | j         j                                        S r"   r  r7   s    r*   r  zpacket_sock.get_state  r  r+   Nr  r   r+   r*   r  r    s2        & & &- - - - -r+   r  c                       e Zd Zd Zd ZdS )bt_sockc                 ~    | j         j        }d|cxk    rt          t                    k     rn d S t          |         S d S r  )r  r  r  r   )r&   type_idxs     r*   r  zbt_sock.get_protocol  sM    7&33333233333333&x00 43r+   c                     | j         j        j        }d|cxk    rt          t                    k     rn d S t          |         S d S r  )r  _bt_sock__sk_commonr  r  r   r  s     r*   r  zbt_sock.get_state$  sP    G'1		1111C 011111111#I.. 21r+   Nr  r   r+   r*   r  r    s2        1 1 1
/ / / / /r+   r  c                       e Zd Zd Zd ZdS )xdp_sockc                     d S r"   r   r7   s    r*   r  zxdp_sock.get_protocol+  r  r+   c                 4    | j                                         S r"   )r  lookupr7   s    r*   r  zxdp_sock.get_state/  s    z  """r+   Nr  r   r+   r*   r  r  *  s2          # # # # #r+   r  c                       e Zd Zd ZdS )bpf_progc                     |                      d          r| j        S |                      d          r-| j        r&| j                             d          r| j        j        S t	          d          )NrZ  aux	prog_typezUnable to find the BPF type)r>   rZ  r  r  rA   r7   s    r*   ri   zbpf_prog.get_type5  sq     ??6"" 	9??5!! 	*dh 	*x"";// *x)) :;;;r+   N)r   r   r   ri   r   r+   r*   r  r  4  s#        < < < < <r+   r  c                   4    e Zd ZdedefdZed             ZdS )credr  r   c                 "   |                      |          st          d| d          |                     |          }t          |d          r|j        }n,t          |t          j                  r|}nt          d          t          |          S )a  Helper to obtain the right cred member value for the current kernel.

        Args:
            member (str): The requested cred member name to obtain its value

        Raises:
            AttributeError: When the requested cred member doesn't exist
            AttributeError: When the cred implementation is not supported.

        Returns:
            int: The cred member value
        zstruct cred doesn't have a 'z' membervalz#Kernel struct cred is not supported)	r>   rA   r  r   r!  r   r   Integerr   )r&   r  cred_valvalues       r*   _get_cred_int_valuezcred._get_cred_int_valueG  s     v&& 	R !P!P!P!PQQQ;;v&&8U## 	HLEE'/22 	HEE !FGGG5zzr+   c                 ,    |                      d          S )zeReturns the effective user ID

        Returns:
            int: the effective user ID value
        euid)r%  r7   s    r*   r'  z	cred.euidc  s     ''///r+   N)r   r   r   r   r   r%  r   r'  r   r+   r*   r  r  E  sQ        # #    8 0 0 X0 0 0r+   r  c                       e Zd Zedefd            ZdefdZededee         fd            Z	defdZ
dee         fdZdedefd	Zd
S )kernel_cap_structr   c                 0    t          t                    dz
  S )zReturns the latest capability ID supported by the framework.

        Returns:
            int: The latest capability ID supported by the framework.
        re   )r  r   )clss    r*   get_last_cap_valuez$kernel_cap_struct.get_last_cap_valueo  s     <  1$$r+   c                     t           j                            | j        |           }	 |                    d          }n)# t
          j        $ r |                                 }Y nw xY wd|dz   z  dz
  S )zReturn the maximum value allowed for this kernel for a capability

        Returns:
            int: The capability full bitfield mask
        cap_last_cap)symbol_namere   )r   r  r`  r.   object_from_symbolr
   r4   r,  )r&   rb  r.  s      r*   get_kernel_cap_fullz%kernel_cap_struct.get_kernel_cap_fullx  s     &BB4=RVWW	5"55.5QQLL% 	5 	5 	52244LLL	5 \A%%**s   > #A$#A$capabilities_bitfieldc                     g }t          t                    D ]&\  }}|d|z  z  dk    r|                    |           '|S )zTranslates a capability bitfield to a list of capability strings.

        Args:
            capabilities_bitfield (int): The capability bitfield value.

        Returns:
            List[str]: A list of capability strings.
        re   r   )	enumerater   r  )r+  r2  capabilitiesbitrZ   s        r*   capabilities_to_stringz(kernel_cap_struct.capabilities_to_string  sS     "<00 	* 	*IC$S1Q66##D)))r+   c                    |                      d          st          j        d          t          | j        t
          j                  rqt          | j                  dk    r| j        d         }nRt          | j                  dk    r| j        d         dz  | j        d         z  }nt          j        d          | j        }||                                 z  S )pReturns the capability bitfield value

        Returns:
            int: The capability bitfield value.
        cap.Unsupported kernel capabilities implementationre   r   r   ro  )	r>   r
   r\  r   r:  r   Arrayr  r1  r&   	cap_values     r*   get_capabilitiesz"kernel_cap_struct.get_capabilities  s     u%% 	0@   dh.. 	!48}}!! !HQK		TX!## "Xa[B.$(1+=		 4D  
 I4335555r+   c                 T    |                                  }|                     |          S )zyReturns the list of capability strings.

        Returns:
            List[str]: The list of capability strings.
        )r?  r7  )r&   capabilities_values     r*   enumerate_capabilitiesz(kernel_cap_struct.enumerate_capabilities  s+     "2244**+=>>>r+   
capabilityc                     |t           vrt          d| d          dt          j        |          z  }||                                 z  dk    S )aR  Checks if the given capability string is enabled.

        Args:
            capability (str): A string representing the capability i.e. dac_read_search

        Raises:
            AttributeError: If the given capability is unknown to the framework.

        Returns:
            bool: "True" if the given capability is enabled.
        zUnknown capability with name ''re   r   )r   rA   indexr?  )r&   rC  r>  s      r*   has_capabilityz kernel_cap_struct.has_capability  sZ     \)) !O*!O!O!OPPP+J777	400222a77r+   N)r   r   r   classmethodr   r,  r1  r   r   r7  r?  rB  r   rG  r   r+   r*   r)  r)  m  s        %3 % % % [%+S + + + + 3 49    [" 6#  6  6  6  6D?S	 ? ? ? ?8 8 8 8 8 8 8 8r+   r)  c                       e Zd ZdefdZdS )kernel_cap_tr   c                     |                      d          r| j        }nt          j        d          ||                                 z  S )r9  r!  r;  )r>   r!  r
   r\  r1  r=  s     r*   r?  zkernel_cap_t.get_capabilities  sR     ??5!! 	II0@   4335555r+   N)r   r   r   r   r?  r   r+   r*   rJ  rJ    s/        6# 6 6 6 6 6 6r+   rJ  )Kcollections.abccollectionsloggingr  r  typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   r   r   %volatility3.framework.constants.linuxr   r   r   r   r   r   r   r   r   r   r   volatility3.framework.layersr   volatility3.framework.objectsr   volatility3.framework.symbolsr   r   r   .volatility3.framework.symbols.linux.extensionsr   	getLoggerr   r5   GenericIntelProcessr    r   
StructTyper   r   r  r+  r&  r  r   r  abcr  r  r  rT  ry  r  r  r  r  r  r  r  r  r  r  r  r  r)  rJ  r   r+   r*   <module>rZ     s]  
          G G G G G G G G G G G G G G G G U U U U U U U U U U U U U U I I I I I I I I N N N N N N N N O O O O O O O O Q Q Q Q Q Q Q Q T T T T T T T T > > > > > > / / / / / / 1 1 1 1 1 1 B B B B B B B B B B > > > > > >		8	$	$
}G }G }G }G }GW( }G }G }G@V V V V V'- V V Vr> > > > >" > > >$} } } } }# } } }@FN FN FN FN FN" FN FN FNR1 1 1 1 1'$ 1 1 1hq q q q qW' q q qh
 
 
 
 
7 
 
 
3 3 3 3 3W 3 3 3lE E E E E'$ E E E&5Q 5Q 5Q 5Q 5Q"KO$< 5Q 5Q 5QpU U U U U7% U U U$D
 D
 D
 D
 D
G D
 D
 D
NdF dF dF dF dFw! dF dF dFN    g        G&   &
G 
G 
G 
G 
G'
 
G 
G 
G3 3 3 3 3W 3 3 3@* * * * *7 * * *0# # # # #" # # #6a; a; a; a; a;" a; a; a;HI I I I I7% I I I>- - - - -# - - -- - - - -'$ - - -	/ 	/ 	/ 	/ 	/g  	/ 	/ 	/# # # # #w! # # #< < < < <w! < < <"%0 %0 %0 %0 %07 %0 %0 %0Pg8 g8 g8 g8 g8* g8 g8 g8T6 6 6 6 6$ 6 6 6 6 6r+   