*1f!ddlmZmZmZmZmZmZddlmZm Z m Z m Z ddl m Z ddlmZGdde jZGddejjZd S) )IteratorAnyIterableListTupleSet) interfacesobjects exceptions constants)intermed) extensionsc(eZdZddiZdfd ZxZS)MacKernelIntermedSymbolstype interfacereturnNctj|i||dtj|dtj|dtj|dtj|dtj|dtj |dtj |dtj |d tj |d tj |d tj|d tj|d tj|dtjdS)Nprocfileglobvnode vm_map_entry vm_map_objectsocketinpcbifnet sockaddr_dlsockaddr sysctl_oid kauth_scope queue_entry queue_head_t)super__init__set_type_classrrrrrrrrrrrrr r!optional_set_type_class)selfargskwargs __class__s \/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/mac/__init__.pyr$z!MacKernelIntermedSymbols.__init__s$)&))) FJO444 J (;<<< GZ%5666 NJ,CDDD OZ-EFFF Hj&7888 GZ%5666 GZ%5666 M:+ABBB J (;<<< L**?@@@ M:+ABBB M:+ABBB $$^Z5KLLLLL)rN)__name__ __module__ __qualname__providesr$ __classcell__)r*s@r+rr sQ $HMMMMMMMMMMr,rceZdZdZ dZdZedejj de de e de eejje e ffdZedejj de d e e fd Ze ddejj d e e d e fdZedejj de dejjfdZe ddejjde de de dedeejjf dZe ddejjde dedeejjfdZe ddejjde dedeejjfdZe ddejjde dedeejjfdZd S) MacUtilitiesz)Class with multiple useful mac functions.)r)rrcontext layer_namemodsrcD|j|jfd|DS)zZ A helper function to mask the starting and end address of kernel modules cg|]A}tj|j|jz|jz|jzfBS)r utilityarray_to_stringnameaddresssize).0modmasks r+ z/MacUtilities.mask_mods_list..:s]    //99 d"t#sx/    r,)layers address_mask)clsr7r8r9rDs @r+mask_mods_listzMacUtilities.mask_mods_list.sA~j)6         r, mods_listc |d}n*#tj$r|d}YnwxYw |d}n*#tj$r|d}YnwxYw|j|j}||z}||z}d||fgt |||zS)Nvm_kernel_stextstextvm_kernel_etextetext __kernel__)object_from_symbolr SymbolErrorrFrGr3rI)rHr7r8kernelrJ start_addrend_addrrDs r+generate_kernel_handler_infoz)MacUtilities.generate_kernel_handler_infoCs <223DEEJJ% < < <227;;JJJ < :001BCCHH% : : :0099HHH :~j)6$& d?z845 8S8S Z9 9   s$??A$B?BNhandlerskernel_module_namecd}d}d}|r|j|}|j}|D]\} } } | |cxkr| krn| }| dkrt|j||z } t | dkrat j| dvr8t| d t jdnt| d}n||fS)NUNKNOWNzN/ArrPr4) modulesoffsetlist symbol_spaceget_symbols_by_locationlenr BANGstrsplit) rHr7rWtarget_addressrXmod_name symbol_name module_shiftmoduler?startendsymbolss r+lookup_module_addressz"MacUtilities.lookup_module_address^s   )_%78F!=L (   D%----#-----<''",DD*\9G 7||a'' )~;;  0 0 @ @ CDDD!$WQZ$ !.$$$r,symbol_table_nametaskc#K |jj}n#tj$rd}YnwxYw |jj}n#tj$rd}YnwxYw||kr|}|dkrd}|t jzdz} |jj}n#tj$rYdSwxYwtj ||||}t|D]\} } | dkr | j } n#tj$rY7wxYw| dkrF| j jd} | } n| rd | d } | | | fVdS) aeCreates a generator for the file descriptors of a process Args: symbol_table_name: The name of the symbol table associated with the process context: task: The process structure to enumerate file descriptors from Return: A 3 element tuple is yielded for each file descriptor: 1) The file's object 2) The path referenced by the descriptor. The path is either empty, the full path of the file in the file system, or the formatted name for sockets, pipes, etc. 3) The file descriptor number ifileprocN)countsubtyper7rVNODEr<>)p_fd fd_lastfiler InvalidAddressException fd_nfilesr ra fd_ofiles dereferencer r=array_of_pointers enumeratef_fglob get_fg_typefg_datacast full_pathlower)rHr7rmrnnum_fdsnfiles file_type table_addrfdsfd_numfftyperpaths r+files_descriptors_for_processz*MacUtilities.files_descriptors_for_processs, i+GG1   GGG  Y(FF1   FFF  G  G T>>G% 6C  ,88::JJ1   44 o// gy'0  #3 & &IFAAvvI1133EE!9HG##I-99;;@@IIE ??,,DD0/u{{}}///Dvo%%% & &s? %% 6A  A 0BB"!B"#C==DDrpqueuelist_head_memberlist_next_member next_member max_elementsc#Kt} ||}n#tj$rYdSwxYw|r|jj|vrdS||jjt||krdS|r|V |||}n#tj$rYdSwxYw|dSdS)N)attr) setmemberr ryvolr\addr` is_readable)rHrrrrrseencurrents r+_walk_iterablezMacUtilities._walk_iterables) ll(8l99GG1   44  {!T)) HHW[' ( ( (4yyL((""$$   !..k.::AAGWAXX5         s)<<*C CCc#JK||dd||D]}|VdS)N tqh_firsttqe_nextrrHrrrelements r+ walk_tailqzMacUtilities.walk_tailqI)) ; K    GMMMM  r,c#JK||dd||D]}|VdS)Nlh_firstle_nextrrs r+walk_list_headzMacUtilities.walk_list_headsI)) :y+|    GMMMM  r,c#JK||dd||D]}|VdS)N slh_firstsle_nextrrs r+ walk_slistzMacUtilities.walk_slistrr,)N)rp)r-r.r/__doc___version_required_framework_version classmethodr r7ContextInterfacerbrrrrr ObjectInterfacerIrVrlrintrrrrrr<r,r+r3r3"s 33 H"+ #4  sm  eJ&6S@A B    [ ( #4  C=    [ 4 #' "%"%#4"%3-"%  "%"%"%["%H=&#4=&=& 0 =&=&=&[=&~! !1      *$4 5[@ !  !1    *$4 5   [  !  !1    *$4 5   [  !  !1    *$4 5   [   r,r3N)typingrrrrrrvolatility3.frameworkr r r r volatility3.framework.symbolsr !volatility3.framework.symbols.macrIntermediateSymbolTabler configurationVersionableInterfacer3r<r,r+rs=<<<<<<<<<<<<<<<LLLLLLLLLLLL222222888888MMMMMx?MMM.ddddd:+@dddddr,