[ #g.RddlZddlZddlZddlZddlZddlmZddlZddl m Z m Z m Z m Z mZmZmZmZddlmZmZmZmZmZddlmZddlmZddlmZmZddlmZm Z dd lm!Z!m"Z"dd lm#Z#m$Z$dd lm%Z%m&Z&dd lm'Z'dd l(m)Z)ddl*m+Z+ddl,m-Z-m.Z.m/Z/ddl0m1Z1ejde3Z4Gdde-jjZ6Gdde-jjZ7GddejpZ9GddejpZ:GddejpZ;GddejpZ<GddejpZ=Gdd ejpZ>Gd!d"ejpZ?Gd#d$ejpZ@Gd%d&ejpejjZBGd'd(ejpZCGd)d*ejpZDGd+d,ejpZEGd-d.ejpZFGd/d0ejpZGGd1d2ejpZHGd3d4ejpZGd5d6ejpZIGd7d8ejpZJGd9d:ejpZKGd;dejpZMGd?d@ejpZNGdAdBejpZOGdCdDejpZPGdEdFejpZQGdGdHejpZRGdIdJejpZSGdKdLejpZTGdMdNeTZUGdOdPejpZVGdQdRejpZWGdSdTejpZXGdUdVejpZYGdWdXejpZZy)YN)datetime) GeneratorIterableIteratorOptionalTupleListUnionDict) constants exceptionsobjects interfacessymbols) conversion) requirements) SOCK_TYPES SOCK_FAMILY) IP_PROTOCOLSIPV6_PROTOCOLS) TCP_STATESNETLINK_PROTOCOLS) ETH_PROTOCOLSBLUETOOTH_STATES)BLUETOOTH_PROTOCOLS SOCKET_STATES) CAPABILITIES)linear)utility)genericlinuxintermed)elfceZdZfdZedZdZdZdZdZ dZ dZ d Z d Z d Zd Zd eeeffdZdZdZedZedZedZxZS)modulec2t||i|d|_yN)super__init__ _mod_mem_type)selfargskwargs __class__s i/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/extensions/__init__.pyr)zmodule.__init__#s $)&)!cx|jc |jjj|j t j zdzj|_|jS|jS#tj$r*tjdi|_Y|jSwxYw)zIReturn the mod_mem_type enum choices if available or an empty dict if not mod_mem_typezOUnable to find mod_mem_type enum. This message can be ignored for kernels < 6.4) r*_context symbol_spaceget_enumerationget_symbol_table_namer BANGchoicesr SymbolErrorvollogdebugr+s r/r2zmodule.mod_mem_type's    % (%)]]%?%?%O%O..09>>ANR&'"!!!t!!! )) ( e&("!!!  (sAA< get_module_base: Unable to get module base. Cannot read base from MOD_TEXT. core_layout module_corez4module -> get_module_base: Unable to get module base has_memberr>r2baseKeyErrorAttributeErrorr@rAr<s r/get_module_basezmodule.get_module_base; ??5 ! xx 1 1* =>CCC __] +##(( ( __] +## #STT $k  %BBc|jdru |j|jdj|j|jdjz|j|jdjzS|jdr|j jS|jdr |jSt d#t$r t dwxYw) Nr> MOD_INIT_TEXT MOD_INIT_DATAMOD_INIT_RODATAzmodule -> get_init_size: Unable to determine .init section size of module. Cannot read size of MOD_INIT_TEXT, MOD_INIT_DATA, and MOD_INIT_RODATA init_layout init_sizezImodule -> get_init_size: Unable to determine .init section size of module)rCr>r2sizerErFrNrOr<s r/ get_init_sizezmodule.get_init_sizeIs ??5 ! HHT..?@EEhht00ABGGHhht001BCDIIJ__] +##(( ( __[ )>> ! W   $g s A3CC+c*|jdr |j|jdj|j|jdjz|j|jdjz|j|jdjzS|jdr|j jS|jdr |jSt d #t$r t dwxYw) Nr>r?MOD_DATA MOD_RODATAMOD_RO_AFTER_INITzmodule -> get_core_size: Unable to determine core size of module. Cannot read size of MOD_TEXT, MOD_DATA, MOD_RODATA, and MOD_RO_AFTER_INIT.r@ core_sizez@module -> get_core_size: Unable to determine core size of module)rCr>r2rPrErFr@rVr<s r/ get_core_sizezmodule.get_core_size]s  ??5 ! HHT..z:;@@hht00<=BBChht00>?DDEhht001DEFKKL__] +##(( ( __[ )>> ! N   $c s BC==Dc@|jdr' |j|jdjS|jdr|j jS|jdr |jSt d#t$r t dwxYw)Nr>r?zUmodule -> get_module_core: Unable to get module core. Cannot read base from MOD_TEXT.r@rAz4module -> get_module_core: Unable to get module corerBr<s r/get_module_corezmodule.get_module_corerrHrIc@|jdr' |j|jdjS|jdr|j jS|jdr |jSt d#t$r t dwxYw)Nr>rKzZmodule -> get_module_core: Unable to get module init. Cannot read base from MOD_INIT_TEXT.rN module_initz4module -> get_module_init: Unable to get module init)rCr>r2rDrErFrNr[r<s r/get_module_initzmodule.get_module_inits ??5 ! xx 1 1/ BCHHH __] +##(( ( __] +## #STT $p rIc@tj|jS)z&Get the name of the module as a string)rarray_to_stringnamer<s r/get_namezmodule.get_names&&tyy11r0c t|jj|jtjzdz|j j |j|jjj|jtjzdzd}d}||r |dz}||r |S)z-Try to determine the number of valid sectionsarraypointer layer_nameoffsetsubtypecountr) r3objectr6r r7volrfattrsr4get_type)r+grparridxs r/_get_sect_countzmodule._get_sect_countsmm""  & & (9>> 9G Cxx**99MM..77**,y~~= I# #h'C#h r0c #VK|jjdr|jj}n%|j|jj}|j j |jtjzdz|jj|jjjj|j jj|jtjzdz|}|D]}|yw)zGet sections of the module nsectionsrbmodule_sect_attrreN) sect_attrsrCrtrrror3rkr6r r7rlrfrmrgr4rn)r+ num_sectsrpattrs r/ get_sectionszmodule.get_sectionss ?? % %k 211I,,T__-@-@AImm""  & & (9>> 9G Cxx**??((,,33MM..77**,y~~=@RR# DJsD'D)ctjj|jddddtj }|S)Nelf_symbol_tabler!r#) native_types class_types)r"IntermediateSymbolTablecreater3r#r})r+elf_table_names r/get_elf_table_namezmodule.get_elf_table_names@!99@@ MM    A r0c #FKt|ds|j|_tj|j |j rd}nd}|j j|j tjzdz|jj|j|j jj|jtjz|zdz|jdz}|j r |D]}|yyw) zSGet symbols of the module Yields: A symbol object _elf_table_nameElf64_Elf32_rbSymrjreN)hasattrrrrsymbol_table_is_64bitr3r6rkr r7rlrfsection_symtabr4rn num_symtabsection_strtab)r+prefixsymssyms r/ get_symbolszmodule.get_symbolsst./#'#:#:#> 9G Cxx**&&MM..77$$y~~5>F//A%$      sDD!returnc#K|jD]}|jj|jtj zdz|j j|j|jz} tj|d}|dk7s|jj|j jj }|j"|z}||fy#tj$rYwxYww)zGet names and addresses for each symbol of the module Yields: A tuple for each symbol containing the symbol name and its corresponding value rbrfrgN)rr3rkr6r r7rlnative_layer_namerst_namerr^r InvalidAddressExceptionlayersrf address_maskst_value)r+rsym_arrsym_namemask sym_addresss r/get_symbols_names_and_addressesz&module.get_symbols_names_and_addressess##%Cmm****,y~~=G8855**S[[8+G  "22S 2~}}++DHH,?,?@MM!llT1 --!&55  s1A?DC-DAD-DDDDcF|jD]\}}||k(s |cSy)z(Get symbol value for a given symbol nameNr)r+wanted_sym_namerrs r/ get_symbolzmodule.get_symbols.%)%I%I%K !Hk(*""&Lr0cF|jD]\}}||k(s |cSy)z*Get symbol name for a given symbol addressNr)r+wanted_sym_addressrrs r/get_symbol_by_addresszmodule.get_symbol_by_addresss-%)%I%I%K !Hk![0&Lr0c|jdr|jjS|jdr |jStd)Nkallsymssymtabz&module -> symtab: Unable to get symtab)rCrrrFr<s r/rzmodule.section_symtabs@ ??: &=='' ' __X &;; EFFr0c|jdrt|jjS|jdrt|jSt d)Nrrz;module -> num_symtab: Unable to determine number of symbols)rCintrrrFr<s r/rzmodule.num_symtab sN ??: &t}}//0 0 __\ *t' ' I  r0c|jdr|jjS|jdr |jStd)Nrstrtabz&module -> strtab: Unable to get strtab)rCrrrFr<s r/rzmodule.section_strtabsB ??: &=='' ' __X &;; EFFr0)__name__ __module__ __qualname__r)propertyr2rGrQrWrYr\r`rrryrrrstrrrrrrrr __classcell__)r.s@r/r%r%!s"""& U ( * U U2"& 4.sCx.2GG  GGr0r%ceZdZ d dededeefdZ d dedeee e fddffdZ e defdZ e defd Z e defd Zdeej"j$fd Zy) task_structN config_prefixpreferred_namerc|jj|jj} |jj }t|tjs td|j|\}}|sy|&|jjd|jz}|j|j|||S#t j$rYywxYw)zkConstructs a new layer based on the process's DTB. Returns the name of the Layer or None. NzJParent layer is not a translation layer, unable to construct process layer_Process)r3rrlrfmmpgdr r isinstancerLinearlyMappedLayer TypeError translatepid_add_process_layer)r+rr parent_layerrdtbrfs r/add_process_layerztask_struct.add_process_layer"s}}++DHH,?,?@  ''++C,(B(BC\ '005Z  !!XX00XdhhZ3HHN&& MM3 ~  11  sCCC heap_onlyc #K|jjD]}t|j}t|j}|r3||jj kr||jj k\sbtjd|dd|jj dd|dd|jj d|||z fyw)zdReturns a list of sections based on the memory manager's view of this task's virtual memory.z adding vma: x z | N) r get_vma_iterrvm_startvm_endbrk start_brkr:info)r+rvmastartends r/get_process_memory_sectionsz'task_struct.get_process_memory_sections=s 77'')C %Ecjj/C%477;;"63$''BSBS;S "5)1TWW[[O3s1gQtwwGXGXYZF[\#+& &*sCCcV|jtjjzdk7S)zChecks if this task is a kernel thread. Returns: bool: True, if this task is a kernel thread. Otherwise, False. r)flagsr r! PF_KTHREADr<s r/is_kernel_threadztask_struct.is_kernel_threadOs" Y__777A==r0c4|j|jk(S)zChecks if this task is a thread group leader. Returns: bool: True, if this task is a thread group leader. Otherwise, False. )tgidrr<s r/is_thread_group_leaderz"task_struct.is_thread_group_leaderXsyyDHH$$r0cR|j xr|j|jk7S)zChecks if this task is a user thread. Returns: bool: True, if this task is a user thread. Otherwise, False. )rrrr<s r/is_user_threadztask_struct.is_user_threadas%(((BTYY$((-BBr0c#K|j}|jj|tjddD]}|yw)zWReturns a list of the task_struct based on the list_head thread_node structure.r thread_groupN)r6rto_listr r7)r+task_symbol_table_nametasks r/ get_threadsztask_struct.get_threadsjsQ"&!;!;!= %%--%&y~~&6k BN DJ sA A )NN)F)rrrrrrboolrrrrrrrrrrrObjectInterfacerr0r/rr!s?C   9< # 8!&'' 5c?D$. /'$>$>>%%%CCC Xj&8&8&H&HI r0rceZdZdZdZy) fs_structc|jdr |jS|jjdr|jjStd)NrootmntdentryzUnable to find the root dentry)rCrootrrFr<s r/get_root_dentryzfs_struct.get_root_dentry{sF ??9 %99  YY ! !( +99## #=>>r0c|jdr |jS|jjdr|jjSt d)NrmntzUnable to find the root mount)rCrrrrFr<s r/ get_root_mntzfs_struct.get_root_mntsD ??9 %<<  YY ! !% (99== <==r0N)rrrrrrr0r/rrzs ?>r0rcBeZdZdZdZdZdZdZdZdZ dZ dZ dZ d d Z y ) maple_tree|rrjc#K|jj|jz}|j|jz|j z }|j |j||Ed{y7w)z4Parse the Maple Tree and return every non zero slot.N)rlrgMAPLE_NODE_POINTER_MASKma_flagsMT_FLAGS_HEIGHT_MASKMT_FLAGS_HEIGHT_OFFSET_parse_maple_tree_nodema_root)r+maple_tree_offsetexpected_maple_tree_depths r/ get_slot_iterzmaple_tree.get_slot_itersl HHOO0L0L.MM MMD55 5  ( (%)!.. LL+-F   sA+A5-A3.A5Nc #K| t}||vr#tjdt|dy|j |||kr>1Q677r0c<|j|jzrdSdSNrorw)s_flags SB_RDONLYr<s r/get_flags_accesszsuper_block.get_flags_accessxs||dnn4t>$>r0c||jDcgc]!}||jzs|j|#}}|Scc}wr')SB_OPTSrN)r+sb_optsb_optss r/get_flags_optszsuper_block.get_flags_opts{s@/3|| %+v ?TDLL    s99ctj|jjd}|jr)tj|jd}|d|zz }|S)Nrrir)rpointer_to_strings_typer_ s_subtype)r+ mnt_sb_typemnt_sb_subtypes r/rnzsuper_block.get_typesP// 0@0@L >>$66t~~SQN 3/ /Kr0N)rrrrFrO SB_NOSUIDSB_NODEV SB_NOEXECSB_SYNCHRONOUS SB_MANDLOCK SB_DIRSYNC SB_NOATIME SB_NODIRATIME SB_SILENT SB_POSIXACL SB_KERNMOUNT SB_I_VERSION SB_LAZYTIMErRrrrGrIrrPrrUrnrr0r/r1r1UsIIIHINKJJMIKLLK IVZ G,s,,8s88?#?  r0r1ceZdZddddZiddddd d d d d ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6Zd7efd8Zd7efd9Zd7efd:Zd7e fd;Z d<Z d?d>Z y=)@r,rwr)rjrr3rjVM_READrVM_WRITEr3VM_EXECr4 VM_SHAREDr5 VM_MAYREAD VM_MAYWRITEr6 VM_MAYEXECr7 VM_MAYSHARE VM_GROWSDOWNr VM_NOHUGEPAGEr8 VM_PFNMAPr9 VM_DENYWRITE VM_EXECUTABLE VM_LOCKEDi@VM_IOr: VM_SEQ_READr; VM_RAND_READ VM_DONTCOPY VM_DONTEXPAND VM_RESERVED VM_ACCOUNT VM_NORESERVE VM_HUGETLB VM_NONLINEARVM_MAPPED_COP__VM_HUGEPAGE VM_INSERTPAGE VM_ALWAYSDUMPVM_CAN_NONLINEAR VM_MIXEDMAPVM_SAOVM_PFN_AT_MMAP VM_MERGEABLE)iiiii r<r=ir>iiii i@lrc`d}|jD]\}}||z|k(r||z}|dz}|S)zJReturns an string representation of the flags in a vm_area_struct.r-)items)r+vm_flags parse_flagsretvalrchars r/ _parse_flagszvm_area_struct._parse_flagssE%++-JD$4D($# .  r0c\|j|jdztjS)Nr)rrr, perm_flagsr<s r/get_protectionzvm_area_struct.get_protections$  !79R9RSSr0cN|j|j|jSr')rrextended_flagsr<s r/ get_flagszvm_area_struct.get_flagss  0C0CDDr0c|jdk(ry|jj|jj}|j |j zSNr)vm_filer3rrlrfvm_pgoff page_shift)r+rs r/get_page_offsetzvm_area_struct.get_page_offsetsD <<1 }}++DHH,?,?@ }} 7 777r0c2|jdk7r-tjj|||j}|S|j|j j kr'|j|j jk\rd}|S|j|j jcxkr|jkrd}|S|jjjdr1|j|jjjk(rd}|Sd}|S)Nrz[heap]z[stack]vdsoz[vdso]zAnonymous Mapping)rr!LinuxUtilities path_for_filerrrrr start_stackvm_mmcontextrCr)r+rrfnames r/r`zvm_area_struct.get_names <<1 ((66wdllSE ]]dgg// /DKK477;;4NE ]]dgg11 @T[[ @E A JJ   ) )& 1 !3!3!8!88E (E r0Nc>d}|j}|dk(rd}|S|dk(r5|jjjjdk(rd}|S|rmd|vrit |j |j|jD];} |j|r'tjdt|dd}|S=|S#tjtjf$r2}tj!d t|d |d}Yd}~|Sd}~wwxYw) NFrwxTzr-xrrz%Found malicious (dirty+exec) page at z !zUnable to translate address z : )rr dereferencerlrgrangerr page_sizeis_dirtyr:rrr PagedInvalidAddressExceptionrr;)r+ proclayerret flags_striexcps r/ is_suspiciouszvm_area_struct.is_suspiciouss,'')  C* )% DLL$<$<$>$B$B$I$IQ$NC& %3)+4==$++y7J7JK ))!,CCF82N# -L" ;;66LL#?Axs4&!QRC s 5C#D*&DDr') rrrrrrrrrrrr`rrr0r/r,r,sUJ !I!J! I! K ! L ! M ! L! M! N! O! K! N! O! K! G! M!!" N#!$"#! " "0##&!$"A!NF S TTE3E88 "r0r,ceZdZdefdZy)qstrrc|jdr|jdz}nd} tjj |j |}|S#t jtf$rd}Y|SwxYw)Nlenrjrr) rCrrrrXr_r r ValueError)r+ str_lengthrs r/ name_as_strzqstr.name_as_strsl ??5 !AJJ //33DIIzJC 22J? C  s*AA0/A0N)rrrrrrr0r/rrs S r0rcdeZdZdefdZdefdZdZdZde jjfdZ y)rrcg}t}|}|js|jj|vr|j}|j |j j|j|jj|}|js|jj|vrddjt|zS)z,Based on __dentry_path Linux kernel function/) ris_rootrlrgd_parentappendd_namerrjoinreversed)r+ reversed_path dentry_seencurrent_dentryrs r/pathz dentry.path s e &&(""))<#,,F  !6!6!B!B!D E OON..55 6#N &&(""))< SXXh}5666r0crt|dr$ |jj|jk(Sy#YyxYw)NrF)getattrrlrgrr<s r/rzdentry.is_roots7 4 $ xx$--77 % s"26cX|jj|k(ry|j|S)zIs this dentry a subdirectory of old_dentry? Returns true if this dentry is a subdirectory of the parent (at any depth). Otherwise, it returns false. T)rlrg d_ancestor)r+ old_dentrys r/ is_subdirzdentry.is_subdir"s& 88??j (z**r0cjt}|}|js|jj|vr|j|jjk(r|S|j |jj|j}|js|jj|vry)zSearch for an ancestor Returns the ancestor dentry which is a child of "ancestor_dentry", if "ancestor_dentry" is an ancestor of "child_dentry", else None. N)rrrlrgrr)r+ancestor_dentryrrs r/rzdentry.d_ancestor,se &&(""))<&&/*=*=*D*DD%% OON..55 6+44N &&(""))< r0c#K|jdr*|jdrd}|jj}nF|jdr |jdrd}|j}nt j d|j tjzdz}|j||Ed{y7w)zJWalks dentry subdirs Yields: A dentry object d_sib d_childrend_child d_subdirszUnsupported dentry typerN) rCrfirstrr VolatilityExceptionr6r r7r)r+ walk_memberlist_head_memberdentry_type_names r/ get_subdirszdentry.get_subdirs?s ??7 # (E!K#44  __Y 'DOOK,H#K#~~ 001JK K557)..H8S#++,CN) rrrrrrrrrrrrrrr0r/rr s> 7c 7+&KZ//??Kr0rcteZdZdejj fdZdejj fdZy) struct_filerc|jdr |jS|jdr|jjSt d)Nf_dentryf_pathzUnable to find file -> dentry)rCrrrrFr<s r/ get_dentryzstruct_file.get_dentryUs@ ??: &== __X &;;%% % !@A Ar0c|jdr |jS|jdr|jjSt d)z4Returns the fs (vfsmount) where this file is mountedf_vfsmntrz Unable to find file -> vfs mount)rCrrrrFr<s r/ get_vfsmntzstruct_file.get_vfsmnt]s> ??: &== __X &;;?? " !CD Dr0N)rrrrrrrrrr0r/rrTs6BJ..>>BEJ..>>Er0rceZdZ d dededededeedeejjf dZ deejjfd Z y) list_headN symbol_typememberforwardsentinellayerrc#DK|xs|jj}|jjj |j |}d}|rd} t ||j}|s7|jj|||jj|z |jjh} |jj| vr|jj|||jj|z } | | j|jj t ||j}|jj| vryy#tj$rYywxYw#tj$rYywxYww)anReturns an iterator of the entries in the list. Args: symbol_type: Type of the list elements member: Name of the list_head member in the list elements forward: Set false to go backwards sentinel: Whether self is a "sentinel node", meaning it is not embedded in a member of the list Sentinel nodes are NOT yielded. See https://en.wikipedia.org/wiki/Sentinel_node for further reference layer: Name of layer to read from Yields: Objects of the type specified via the "symbol_type" argument. prevnextNrg) rlrfr3r4rnrelative_child_offsetrrr rrkrgr) r+rrrrrrelative_offset directionr&robjs r/rzlist_head.to_listhsm*,,,--44==    '  I 4+779D--&&U488??_+L'  hhooT)--&&U488??_+L'CI HHTXX__ % tY/;;=hhooT)11   55  sUAF E.2CF 9FF ,F .FF FF FF FF c|j|jjjj|jjSr')rrlr type_name member_namer<s r/__iter__zlist_head.__iter__s1||DHHOO//99488;O;OPPr0)TTN) rrrrrrrrrrrrrr0r/rrgs # 111 1  1 } 1 *$$44 51fQ(:#5#5#E#EFQr0rcteZdZdejj fdZdejj fdZy) files_structrc|jdr$|jjjS|jdr|jjSt d)Nfdtfdz(Unable to find files -> file descriptors)rCrrrrFr<s r/get_fdszfiles_struct.get_fdssP ??5 !88;;**, , __T "77&&( ( !KL Lr0c|jdr|jjS|jdr |jStd)Nrmax_fdsz0Unable to find files -> maximum file descriptors)rCrrrFr<s r/ get_max_fdszfiles_struct.get_max_fdss@ ??5 !88## # __Y '<<  !ST Tr0N)rrrrrrrrrr0r/rrs6M++;;MUZ//??Ur0rc eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z ed ed edededediZdefdZdZdZdZdZdZdefdZdZdZdZdZdefdZdeefdZdefd Z defd!Z!defd"Z"defd#Z#defd$Z$d%Z%d&Z&d'Z'y())mountrjrr3r4r5rrr6rvrr{r}nosuidnodevnoexecnoatime nodiratimerelatimerc|jdr|jjS|jdr |jStd)$Returns a pointer to the super_blockrmnt_sbz#Unable to find mount -> super block)rCrrrFr<s r/ get_mnt_sbzmount.get_mnt_sbs> ??5 !88?? " __X &;;  !FG Gr0c|jdr|jjS|jdr |jStd)Nrmnt_rootz"Unable to find mount -> mount root)rCrrrFr<s r/ get_mnt_rootzmount.get_mnt_roots@ ??5 !88$$ $ __Z (==  !EF Fr0c|jdr|jjS|jdr |jStd)Nr mnt_flagsz#Unable to find mount -> mount flags)rCrrrFr<s r/ get_mnt_flagszmount.get_mnt_flagss@ ??5 !88%% % __[ )>> ! !FG Gr0c|jS)zZGets the fs where we are mounted on Returns: A mount pointer ) mnt_parentr<s r/get_mnt_parentzmount.get_mnt_parents r0c|jS)YGets the dentry of the mountpoint Returns: A dentry pointer )mnt_mountpointr<s r/get_mnt_mountpointzmount.get_mnt_mountpoints"""r0c6|jjSr')rget_parent_mountr<s r/r zmount.get_parent_mountsxx((**r0cH|j|jjk7S)zpChecks if this mount has a parent Returns: bool: 'True' if this mount has a parent )rrlrgr<s r/ has_parentzmount.has_parents $((//11r0c|jS)zZReturns the fs where we are mounted on Returns: A 'vfsmount' )rr<s r/get_vfsmnt_currentzmount.get_vfsmnt_currents xxr0c>|jjS)zjGets the parent fs (vfsmount) to where it's mounted on Returns: A 'vfsmount' )rr$r<s r/get_vfsmnt_parentzmount.get_vfsmnt_parent""$7799r0c>|j}|j}|Sz\Returns the root of the mounted tree Returns: A dentry pointer )r$r)r+vfsmntrs r/get_dentry_currentzmount.get_dentry_current s ((* r0c>|jjSzcReturns the parent root of the mounted tree Returns: A dentry pointer )rr+r<s r/get_dentry_parentzmount.get_dentry_parentr'r0cD|j|jzrdSdSrK)r MNT_READONLYr<s r/rPzmount.get_flags_access!s#))+d.?.??tITIr0c|jDcgc]$}||jzr|j|&}}|Scc}wr') MNT_FLAGSr)r+mntflagrs r/rUzmount.get_flags_opts$sK >> ++-- NN7 #    s)<c<|j|jzSr')r MNT_SHAREDr<s r/ is_sharedzmount.is_shared,s!!#doo55r0c<|j|jzSr')rMNT_UNBINDABLEr<s r/ is_unbindablezmount.is_unbindable/s!!#d&9&999r0cd|jxr#|jjjdk7Sr mnt_masterrlrgr<s r/is_slavezmount.is_slave2&B4??#6#6#=#=#BBr0cDtj|jdSNrrWrrX mnt_devnamer<s r/ get_devnamezmount.get_devname5(()9)9EEr0ct}|j}|r|jjdk7r|jj|vr|j |j |}|r%|jjdk7r |j S|j|jj|j}|r2|jjdk7r|jj|vry)zUGet ID of closest dominating peer group having a representative under the given root.r)rr<rlrgget_peer_under_rootmnt_ns mnt_group_idr)r+rmnt_seen current_mntpeers r/get_dominating_idzmount.get_dominating_id8s5oo &&!+&&h6224;;ED1,((( LL// 0%00K &&!+&&h6r0ct}|}|jj|vr|j|k(r(|j |j j |r|S|j|jj|j}|jj|jjk(r y|jj|vry)zReturn true if path is reachable from root. It mimics the kernel function is_path_reachable(), ref: fs/namespace.c N) rrlrgrGis_path_reachablerrr next_peer)r+nsrrIrJs r/rFzmount.get_peer_under_rootHs5 oo$$H4!!R'K,I,I(($-#" LL// 0%//1K%%8oo$$H4r0c~t}|}|jjj|jk7r|j r|jj|vr|j }|j |jj|j}|jjj|jk7r)|j r|jj|vr|jjj|jk(xr|j|jS)ztReturn true if path is reachable. It mimics the kernel function with same name, ref fs/namespace.c: ) rrrlrgr"rrrrr)r+rrrIrJs r/rNzmount.is_path_reachableYs5 OO   & &$(( 2&&(&&h6(77N LL// 0%00K OO   & &$(( 2&&(&&h6 ""))TXX5 .:R:R KK;  r0c|jjjtjd}dj |tj}|j jj|jd}|j j||jj|jjjj|z S)Nrz {0}{1}mount mnt_sharer)rlrsplitr r7formatr3r4rnrrkrfrSrrg)r+ table_name mount_structrgs r/rOzmount.next_peerksXX''--inn=a@ $++J G ++44    , }}##  HH  >>&&**11F:$  r0N)(rrr MNT_NOSUID MNT_NODEV MNT_NOEXEC MNT_NOATIMEMNT_NODIRATIME MNT_RELATIMEr0MNT_SHRINKABLEMNT_WRITE_HOLDr5r8r2rrrrrrr rr"r$r&r+r.rrPrrUr6r9r=rCrLrFrNrOrr0r/rrsJIJKNLLNNJN H7HY j IHCHGH#+2D2: :J#J 646:t:C$CFSF " $  r0rceZdZdZdefdZdefdZdZdZdZ dZ d Z d Z d Z d Zdefd ZdZdefdZdeefdZdZdefdZdefdZdefdZdefdZy)vfsmountc||jdk7xr(|jdk7xr|jdk7Sr)rrrr<s r/is_validzvfsmount.is_validzsB OO  " +!!#q( +##%* r0rc$|jdS)aHelper to distinguish between kernels prior to version 3.3.8 that lacked the 'mount' structure and later versions that have it. The 'mnt_parent' member was moved from struct 'vfsmount' to struct 'mount' when the latter was introduced. Alternatively, vmlinux.has_type('mount') can be used here but it is faster. Returns: bool: 'True' if the kernel r)rCr<s r/ _is_kernel_prior_to_struct_mountz)vfsmount._is_kernel_prior_to_struct_mounts|,,r0ct|tjk(r|jj|k(St j d)a;Helper to make sure it is comparing two pointers to 'vfsmount'. Depending on the kernel version, the calling object (self) could be a 'vfsmount \*' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust in the framework "auto" dereferencing ability to assure that when we reach this point 'self' will be a 'vfsmount' already and self.vol.offset a 'vfsmount \*' and not a 'vfsmount \*\*'. The argument must be a 'vfsmount \*'. Typically, it's called from do_get_path(). Args: vfsmount_ptr (vfsmount *): A pointer to a 'vfsmount' Raises: exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount \*' Returns: bool: 'True' if the given argument points to the the same 'vfsmount' as 'self'. z5Unexpected argument type. It has to be a 'vfsmount *')typerPointerrlrgr r)r+ vfsmount_ptrs r/is_equalzvfsmount.is_equals>(   088??l2 200G r0ctjj|j|}tjj |j j dd|S)zGets the struct 'mount' containing this 'vfsmount'. It should be only called from kernels >= 3.3.8 when 'struct mount' was introduced. Returns: mount: the struct 'mount' containing this 'vfsmount'. rr)r!rget_module_from_volobj_typer3 container_ofrlrg)r+vmlinuxs r/ _get_real_mntzvfsmount._get_real_mntsK&&BB4==RVW##00 HHOOWeW  r0c"|jS)zhReturns the current fs where we are mounted on Returns: A vfsmount pointer )rr<s r/r$zvfsmount.get_vfsmnt_currents ""$$r0c~|jr|jS|jjS)zGets the parent fs (vfsmount) to where it's mounted on Returns: For kernels < 3.3.8: A vfsmount pointer For kernels >= 3.3.8: A vfsmount object )rerror&r<s r/r&zvfsmount.get_vfsmnt_parents7  0 0 2&&( (%%'99; ;r0c~|jr|jS|jjSr))rerror+r<s r/r+zvfsmount.get_dentry_current7  0 0 2**, ,%%'::< = 3.3.8: A mount pointer )rerrorr<s r/rzvfsmount.get_mnt_parents2  0 0 2?? "%%'668 8r0cp|jdr |jS|jjS)rr)rCrror<s r/rzvfsmount.get_mnt_mountpoints2 ??+ ,&& &%%'66 6r0c|jSr')rr<s r/rzvfsmount.get_mnt_roots }}r0c|jr#|j|jjk7S|j j Sr')rerrlrgror"r<s r/r"zvfsmount.has_parents=  0 0 2??dhhoo5 5%%'224 4r0c|jS)r)rr<s r/rzvfsmount.get_mnt_sbs {{r0cD|jtjzrdSdSrK)rrr0r<s r/rPzvfsmount.get_flags_accesss~~(:(::tDDr0ctjjDcgc]\}}||jzdk7r|}}}|Scc}}wr)rr2rr)r+r3 mntflagtxtrs r/rUzvfsmount.get_flags_opts sO(-'<'<'> #'1,     sAc|jSr')rr<s r/rzvfsmount.get_mnt_flagss ~~r0cD|jtjzSr')rrr5r<s r/r6zvfsmount.is_shareds!!#e&6&666r0cD|jtjzSr')rrr8r<s r/r9zvfsmount.is_unbindables!!#e&:&:::r0cd|jxr#|jjjdk7Srr;r<s r/r=zvfsmount.is_slaver>r0cDtj|jdSr@rAr<s r/rCzvfsmount.get_devnamerDr0N)rrrrcrrerjror$r&r+r.rrrr"rrrPrrUrr6r9r=rCrr0r/rarays  -$ -6  % < = = 9 75D5 E#E 747;t;C$CFSFr0raceZdZdZy)kobjectc|jj}|jdr|j}|S|jj}|S)Ncounter)krefrefcountrCrrefs)r+refcntrs r/reference_countzkobject.reference_count"sE##   Y '..C ++%%C r0N)rrrrrr0r/rr!sr0rceZdZdZdZy) mnt_namespacec|jdr |jS|jdr1|jjdr|jjSt d)N proc_inumrPinumz"Unable to find mnt_namespace inoderCrrPrrFr<s r/ get_inodezmnt_namespace.get_inode,sO ??; '>> ! __T "tww'9'9&'A77<<  !EF Fr0c#dK|jjjtjd}|tjzdz}|j j j|s|tjzdz}|jj|dD]}|yw)Nrrramnt_list) rlrrTr r7r3r4has_typelistr)r+rVmnt_typers r/get_mount_pointszmnt_namespace.get_mount_points4sXX''--inn=a@  .8}}))228<!INN2Z?HYY&&x> ! __T "tww'9'9&'A77<< !!EF Fr0N)rrrrrr0r/rr>s Gr0rceZdZdZdZdZy)socketc4|jjjdd}t|dk(r|dnd}t |j j j|}|std||d}|j j |}|S)N!rjrrz!No module using the symbol table ) rlrrTrrr3modulesget_modules_by_symbol_tablesr)r+symbol_table_arr symbol_table module_nameskernel_module_namekernels r/_get_vol_kernelzsocket._get_vol_kernelLs88--33C;.12B.Cq.H'*d  MM ! ! > >| L @OP P)!_&&'9: r0c |j}tjj |j j dd|}|j}|jS#t$rYywxYw)Nr socket_allocr) rrr!rrmrlrg vfs_inodei_ino)r+rrrs r/rzsocket.get_inodeYsi ))+F++88 HHOO^Xv !**   sA A,+A,cb|j}d|cxkrttkr t|Syyr)staterr)r+socket_state_idxs r/ get_statezsocket.get_statees0::  53}#5 5 !12 2 6r0N)rrrrrrrr0r/rrKs  3r0rc*eZdZdZdZdZdZdZy)sockcv|jj}d|cxkrttkr t|Syyr)_sock__sk_common skc_familyrrr+ family_idxs r/ get_familyzsock.get_familyls5%%00 -S- -z* * .r0cBtj|jdS)Nr)rgetsk_typer<s r/rnz sock.get_typeqs~~dllB//r0cP|jsy|jjSr) sk_socketrr<s r/rzsock.get_inodets~~~~''))r0cyr'rr<s r/ get_protocolzsock.get_protocolyr0c|jdr$|jjjS|jjS)Nsk)rCrrrr<s r/rzsock.get_state|s: ??4 77$$..0 0~~''))r0N)rrrrrnrrrrr0r/rrks+ 0* *r0rc$eZdZdZdZdZdZy) unix_sockc|jsy|jjjd}tt j |j }|S)N sockaddr_un)addrr_castrrr^sun_path)r+rsaddrs r/r`zunix_sock.get_namesDyyiinn))-8 G++K,@,@AB r0cyr'rr<s r/rzunix_sock.get_protocolrr0c |jjdk(rD|jjj}d|cxkrt t kr t |Syy|jj jSz,Return a string representing the sock state.STREAMrN)rrn_unix_sock__sk_common skc_staterrrrr+ state_idxs r/rzunix_sock.get_statesj 77    )++55II/J/!),,077$$..0 0r0c6|jjSr')rrr<s r/rzunix_sock.get_inodesww  ""r0N)rrrr`rrrrr0r/rrs 1#r0rc6eZdZdZdZdZdZdZdZdZ y) inet_sockc|jjj}d|cxkrttkr t|Syyr)r_inet_sock__sk_commonrrrrs r/rzinet_sock.get_familys9WW((33 -S- -z* * .r0ctj|jj}|j dk(r*t j|jj|}|S)NAF_INET6)rrr sk_protocolrr)r+protocols r/rzinet_sock.get_protocolsN ##DGG$7$78 ??  *%))$''*=*=xHHr0c |jjdk(rD|jjj}d|cxkrt t kr t |Syy|jj jSr)rrnrrrrrrrs r/rzinet_sock.get_statesj 77    )++55II/J/!),,077$$..0 0r0c bt|dt|dd}|tj|Sy)Nsport inet_sport)r socket_modulehtons)r+sport_les r/ get_src_portzinet_sock.get_src_ports54'$ d*KL   &&x0 0 r0c(|jj}t|dr|jdz}nLt|dr |j}n3t|dr |j }nt|dr |j }nytj|S)N skc_portpairidport inet_dport skc_dport) rrrrrrrrr)r+ sk_commondport_les r/ get_dst_portzinet_sock.get_dst_portszGG'' 9n - --6H T7 #zzH T< (H Y , **H""8,,r0c|jj}|j}|tjk(rAd}t |dr |j }nSt |dr |j}n:|j}n-|tjk(rd}|jj}ny|jj|jj} |j!|jj"|}tj,||S#t$j&$r0t(j+d|jj"dYywxYw)Nr3 rcv_saddrinet_rcv_saddrr5z'Unable to read socket src address from #x)rrrrAF_INETrrr skc_rcv_saddrrpinet6rr3rrlrfreadrgr rr:r; inet_ntop)r+rfamily addr_sizerr addr_bytess r/ get_src_addrzinet_sock.get_src_addrsGG'' %% ]** *It[)/0++!// }-- -IKK%%E}}++DHH,?,?@  %**599+;+;YGJ &&vz:: 11  LL9%)):J:J29NO   s&DAEEc|jj}|j}|tjk(rYt |dr|j r |j }n1t |dr|jr |j}n |j}d}nP|tjk(r - ' + + !}% %r0cJ|jjjSr'rr<s r/rzpacket_sock.get_state5rr0Nrrr0r/rr+s &-r0rceZdZdZdZy)bt_sockcv|jj}d|cxkrttkr t|Syyr)rrrr)r+type_idxs r/rzbt_sock.get_protocol;s477&&  3323 3&x0 0 4r0c|jjj}d|cxkrttkr t|Syyr)r_bt_sock__sk_commonrrrrs r/rzbt_sock.get_state@s:GG''11 1C 01 1#I. . 2r0Nrrr0r/rr:s 1 /r0rceZdZdZdZy)xdp_sockcyr'rr<s r/rzxdp_sock.get_protocolGrr0c6|jjSr')rlookupr<s r/rzxdp_sock.get_stateKszz  ""r0Nrrr0r/rrFs #r0rcNeZdZdeedffdZdeedffdZdeedffdZy)bpf_progrNc|jdr|jjS|jdrG|jr;|jjdr |jjjSy)z+Returns a string with the eBPF program typergaux prog_typeN)rCrg descriptionr&r'r<s r/rnzbpf_prog.get_typeQs_ ??6 "99(( ( ??5 !dhhxx"";/xx))555r0c|jdsytjj|j|}|j j |j}|jjj}|jj}|j||}tj|j}|S)z*Returns a string with the eBPF program tagtagN)rCr!rrlr3rrrfr*rlrgrirbinasciihexlifydecode)r+rn vmlinux_layer prog_tag_addr prog_tag_sizeprog_tag_bytesprog_tags r/get_tagzbpf_prog.get_tagbsu%&&BB4==RVW..w/A/AB  ++  &++M=I##N3::<r0cZ|jdsy|jjS)+Returns a string with the eBPF program namer&N)rCr&r`r<s r/r`zbpf_prog.get_namers$u%xx  ""r0)rrrr rrnr3r`rr0r/r$r$PsA%T *"sDy) #%T *#r0r$c"eZdZdeedffdZy) bpf_prog_auxrNc~|jdsy|jsytj|jS)r5r_N)rCr_rr^r<s r/r`zbpf_prog_aux.get_name|s0v&yy&&tyy11r0)rrrr rr`rr0r/r7r7{s 2%T * 2r0r7c,eZdZdedefdZedZy)credrrc|j|std|d|j|}t|dr|j}t|St |t jr |}t|Std)aHelper to obtain the right cred member value for the current kernel. Args: member (str): The requested cred member name to obtain its value Raises: AttributeError: When the requested cred member doesn't exist AttributeError: When the cred implementation is not supported. Returns: int: The cred member value zstruct cred doesn't have a 'z' membervalz#Kernel struct cred is not supported) rCrFrrr<rrIntegerr)r+rcred_valvalues r/_get_cred_int_valuezcred._get_cred_int_valuesv& #?xx!PQ Q;;v& 8U #LLE5z '// 2E5z!!FG Gr0c$|jdS)zeReturns the effective user ID Returns: int: the effective user ID value euid)r@r<s r/rBz cred.euids''//r0N)rrrrrr@rrBrr0r/r:r:s)##800r0r:c|eZdZedefdZdefdZededeefdZ defdZ deefdZ dede fd Z y ) kernel_cap_structrc&ttdz S)zReturns the latest capability ID supported by the framework. Returns: int: The latest capability ID supported by the framework. rj)rr)clss r/get_last_cap_valuez$kernel_cap_struct.get_last_cap_values< 1$$r0ctjj|j|} |j d}d|dzzdz S#t j $r|j}Y0wxYw)zReturn the maximum value allowed for this kernel for a capability Returns: int: The capability full bitfield mask cap_last_cap) symbol_namerj)r!rrlr3object_from_symbolr r9rG)r+rnrIs r/get_kernel_cap_fullz%kernel_cap_struct.get_kernel_cap_fullsu &&BB4==RVW 5"55.5QL \A%%** %% 5224L 5sA #A/.A/capabilities_bitfieldcrg}ttD]"\}}|d|zzdk7s|j|$|S)zTranslates a capability bitfield to a list of capability strings. Args: capabilities_bitfield (int): The capability bitfield value. Returns: List[str]: A list of capability strings. rjr) enumeraterr)rFrM capabilitiesbitr_s r/capabilities_to_stringz(kernel_cap_struct.capabilities_to_stringsC "<0IC$S1Q6##D)1r0c|jdstjdt|jt j rxt|jdk(r|jd}n\t|jdk(r#|jddz|jdz}n!tjd|j}||jzS)pReturns the capability bitfield value Returns: int: The capability bitfield value. cap.Unsupported kernel capabilities implementationrjrrrr) rCr rrrUrArrayrrLr+ cap_values r/get_capabilitiesz"kernel_cap_struct.get_capabilitiessu%00@  dhh .488}! !HHQK TXX!#"XXa[B.$((1+=  44D I433555r0cD|j}|j|S)zyReturns the list of capability strings. Returns: List[str]: The list of capability strings. )rZrR)r+capabilities_values r/enumerate_capabilitiesz(kernel_cap_struct.enumerate_capabilitiess% "224**+=>>r0 capabilityc|tvrtd|ddtj|z}||jzdk7S)aRChecks if the given capability string is enabled. Args: capability (str): A string representing the capability i.e. dac_read_search Raises: AttributeError: If the given capability is unknown to the framework. Returns: bool: "True" if the given capability is enabled. zUnknown capability with name ''rjr)rrFindexrZ)r+r^rYs r/has_capabilityz kernel_cap_struct.has_capabilitysO \ ) #A*Q!OP P++J77 40022a77r0N)rrr classmethodrrGrLr rrRrZr]rrbrr0r/rDrDs}%3%% +S +349" 6# 6D?S ?888r0rDceZdZdefdZy) kernel_cap_trc|jdr |j}ntjd||j zS)rTr<rV)rCr<r rrLrXs r/rZzkernel_cap_t.get_capabilitiessE ??5 !I00@ 433555r0N)rrrrrZrr0r/reres6#6r0receZdZdefdZy) timespec64rcdtj|j|jdz z}|S)z%Returns the respective aware datetimeeA)runixtime_to_datetimetv_sectv_nsec)r+dts r/ to_datetimeztimespec64.to_datetime/s+ , ,T[[4<<#;M-M N r0N)rrrrrorr0r/rhrh.sXr0rhcTeZdZdefdZedefdZedefdZedefdZedefdZ edefdZ edefdZ edefd Z edefd Z deed ffd Zdefd ZdefdZdefdZdefdZdefdZdej0j2fdZdZy )inodercV|jdkDxr|jjdk\Sr)ri_countrr<s r/rczinode.is_valid7s&zzA~;$,,"6"6!";;r0cFtj|jdk7S)z(Returns True if the inode is a directoryr)statS_ISDIRi_moder<s r/is_dirz inode.is_dir<||DKK(A--r0cFtj|jdk7S)z+Returns True if the inode is a regular filer)ruS_ISREGrwr<s r/is_regz inode.is_regAryr0cFtj|jdk7S)z&Returns True if the inode is a symlinkr)ruS_ISLNKrwr<s r/is_linkz inode.is_linkFryr0cFtj|jdk7S)z#Returns True if the inode is a FIFOr)ruS_ISFIFOrwr<s r/is_fifoz inode.is_fifoK}}T[[)Q..r0cFtj|jdk7S)z%Returns True if the inode is a socketr)ruS_ISSOCKrwr<s r/is_sockz inode.is_sockPrr0cFtj|jdk7S)z+Returns True if the inode is a block devicer)ruS_ISBLKrwr<s r/is_blockzinode.is_blockUryr0cFtj|jdk7S)z*Returns True if the inode is a char devicer)ruS_ISCHRrwr<s r/is_charz inode.is_charZryr0cB|jtjzdk7S)z%Returns True if the sticky bit is setr)rwruS_ISVTXr<s r/ is_stickyzinode.is_sticky_s dll*q00r0Nc|jry|jry|jry|jry|jry|j ry|j ryy) zRReturns inode type name Returns: The inode type name DIRREGLNKFIFOSOCKCHRBLKN)rxr|rrrrrr<s r/get_inode_typezinode.get_inode_typedsM ;; [[ \\ \\ \\ \\ ]]r0c|j|drS|j|dr?tj|j|d|j|ddz zS|jd|r"|jd|j S|j|r|j|j St j d)N_sec_nsecrj__z,Unsupported kernel inode type implementation)rCrrkrror r)r+rs r/_time_member_to_datetimezinode._time_member_to_datetime{s ??fXT? +6(%@P0Q22 vhdO,t&?O/PSV/VV __r&] +;;F8}-99; ; __V $;;v&224 400> r0c$|jdS)zReturns the inode's last access time This is updated when inode contents are read Returns: A datetime with the inode's last access time i_atimerr<s r/get_access_timezinode.get_access_time,,Y77r0c$|jdS)zReturns the inode's last modification time This is updated when the inode contents change Returns: A datetime with the inode's last data modification time i_mtimerr<s r/get_modification_timezinode.get_modification_times,,Y77r0c$|jdS)zReturns the inode's last change time This is updated when the inode metadata changes Returns: A datetime with the inode's last change time i_ctimerr<s r/get_change_timezinode.get_change_timerr0c@tj|jS)zReturns the inode's file mode as string of the form '-rwxrwxrwx'. Returns: The inode's file mode string )rufilemoderwr<s r/ get_file_modezinode.get_file_modes }}T[[))r0c#K|jsy|jr|jjdkDsytj|j d|jj }|jEd{y7w)z\Gets the inode's cached pages Yields: The inode's cached pages Nrr)rr page_cache)i_size i_mappingnrpagesr! PageCacher3rget_cached_pages)r+rs r/ get_pageszinode.get_pagessi {{ ..T^^%;%;a%? __MM'~~113 ..000sBB B B c#K|jD]-}t|j}|j}||f/yw)zGet the inode cached pages from the page cache Yields: page_index (int): The page index in the Tree. File offset is page_index * PAGE_SIZE. page_content (str): The page content N)rrra get_content)r+page_obj page_index page_contents r/ get_contentszinode.get_contentss@(HX^^,J#//1Ll* *)sAA)rrrrrcrrxr|rrrrrrr rrrrrrrrrrrrrrr0r/rqrq6sT<$< .........//////.$.....1411c4i 0.(&888x888*s*1:--==1$ +r0rqceZdZedZy) address_spacec|jdr|jdS|jdr|jdStjd)z=Returns the appropriate member containing the page cache treei_pages page_treezUnsupported page cache tree)rCrr rr<s r/rzaddress_space.i_pagessL ??9 %;;y) ) __[ );;{+ +,,-JKKr0N)rrrrrrr0r/rrs  L Lr0rc~eZdZeej defdZdee fdZ de fdZ de e dffdZy)pagerc  |jjj|jtj zdzj }|S#tj$rtjdi}Y|SwxYw)zReturns 'pageflags' enumeration key/values Returns: A dictionary with the pageflags enumeration key/values pageflagszOUnable to find pageflags enum. This can happen in kernels < 2.6.26 or wrong ISF) r3r4r5r6r r7r8r r9r:r;)r+pageflags_enums r/rzpage.pageflags_enums~ !]]77GG**,y~~= Kg %% LLa  N sAA*BBcg}|jjD],\}}|jd|zzdk7s|j|.|S)zVReturns a list of page flags Returns: List of page flags rjr)rrrr)r+rr_r?s r/get_flags_listzpage.get_flags_listsN ..446KD%zzQ%Z(A- T"7 r0ctjj|j|}|jj |j }d}|jdrL|jdr|jd}n|jdkrd}|}nstjd|jdr|jd}n;|jdrtjd tjd |stjd |jd j}|j|jj }||z |z}||j"z}|S) zConverts a page's virtual address to its physical address using the current physical memory model. Returns: int: page physical address N mem_section vmemmap_base9l(z#5-level paging is not yet supportedmem_map node_dataz"NUMA systems are not yet supportedzUnsupported Linux memory modelz*Something went wrong, we shouldn't be herer)r!rrlr3rrrf has_symbolrK _maxvirtaddrr rrnrP canonicalizerlrgr) r+rnr. vmemmap_startvmemmap_base_l4page_type_sizepagecpfn page_paddrs r/to_paddrz page.to_paddrs^ &&BB4==RVW..w/A/AB    m ,!!.1 ' : :> J !--2&8O$3M %88=   *#66yAM    ,001UV V001QR R00< !))&166**488??;}$7=222 r0Nc0tjj|j|}|jj |j }|jj d}|j}|sy|j||j}|S)zPReturns the page content Returns: The page content memory_layerN) r!rrlr3rrrfrrr)r+rnr.physical_layerr page_datas r/rzpage.get_content7s~ &&BB4==RVW..w/A/AB  //?]]_ "'' M4K4KL r0)rrrr functools lru_cacher rr rrrrr rrr0r/rrs` Y* S 1#1fU39-r0rceZdZdZdezdz ZdZedzdz ZdezZdedefdZ dedefdZ defd Z defd Z defd Z y ) IDRr4rjr3 num_layersrcpt|j||jz|jg}d|zdz S)zReturns the maximum ID which can be allocated given idr::layers Args: num_layers: Number of layers Returns: Maximum ID for a given number of layers rj)minINT_SIZEIDR_BITS MAX_IDR_SHIFT)r+rbitss r/idr_maxz IDR.idr_maxOs6DMM: #=t?Q?QRST Qr0idr_idc0tjj|j|}|j dj dst jdy|dkry|j}|sy|jdz|jz}||j|jdzkDry|dk7sJ|dkDrV|rT||jz}||j|jzk(sJ|j||z |jz}|dkDr|rT|S)zFinds an ID within the IDR data structure. Based on idr_find_slowpath(), 3.9 <= Kernel < 4.11 Args: idr_id: The IDR lookup ID Returns: A pointer to the given ID element idr_layerrzUUnsupported IDR implementation, it should be a very very old kernel, probabably < 2.6Nrrj)r!rrlr3rnrCr:rtoprrraryIDR_MASK)r+rrnrns r/idr_findz IDR.idr_find]s&&BB4==RVW ,77@ KKg  A:HH  __q DMM 1 DLL1!45 5Av v!e  A $--77 77! v{dmm&CDI!e r0c#K|j}dx}}||kr(|j|}|r ||dz }|dz }||kr'yyw)Nrrj)curr)r+rtotalnext_identrys r/_old_kernel_get_entrieszIDR._old_kernel_get_entriessQhhmMM'*E   qLG ms N)rrrrrrr MAX_IDR_BITrrrrrrrr0r/rrHs}HX "HHqL1$M}$K # # #s#s#J  Sr0r)[collections.abc collectionsloggingrr+rurrrtypingrrrrrr r r volatility3.frameworkr r rrrvolatility3.framework.renderersr#volatility3.framework.configurationr%volatility3.framework.constants.linuxrrrrrrrrrrrvolatility3.framework.layersrvolatility3.framework.objectsrvolatility3.framework.symbolsr r!r".volatility3.framework.symbols.linux.extensionsr# getLoggerrr:GenericIntelProcessr%r StructTyperrrr1r,rrrabcrrrrarrrrrrrr rrrr$r7r:rDrerhrqrrrrr0r/rs2  TTTUU6<INOQT>/1BB>   8 $ }GW ( (}G@V'--Vr>"">$}##}@FN""FNR1'$$1hqW''qh 7   GKW  GKTE'$$E&5Q""KOO$<$<5QpU7%%U$E G  E PeFw!!eFPg  G&&& G'   G3W  3@*7  *0#""#6a;""a;HI7%%I>-##- -'$$ - /g  /#w!!#(#w!!(#V 27%% 2%07  %0Pg8**g8T6$6(##X+G  X+v LG&& Lf7  fR_'  _r0