
    *1fG                     |   d dl Z d dlZd dlmZmZmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZ d dlmZ  ej        e          Z G d dej                  Z G d	 d
ej                  Z G d dej                  Z G d dej                  Z G d dej                  Z G d dej                  Z G d dej                  Z G d dej                  Z G d dej                  Z  G d dej                  Z! G d dej                  Z" G d dej                  Z# G d d ej                  Z$dS )!    N)	GeneratorIterableOptionalSetTuple)	constants
exceptions
interfacesobjects)utility)
conversion)genericc                       e Zd Zd Z	 ddededee         fdZdeej	        j
                 fdZ	 dd	ej        j        ded
edeeeef         ddf         fdZdS )procc                 Z    | j                                                             d          S )Ntask)r   dereferencecastselfs    g/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/mac/extensions/__init__.pyget_taskzproc.get_task   s$    y$$&&++F333    Nconfig_prefixpreferred_namereturnc                 x   | j         j        | j        j                 }t	          |t
          j        j                  st          d          	 |                                 j	        j
        j        }n# t          j        $ r Y dS w xY w|| j        j        d| j         z   }|                     | j         |||          S )zkConstructs a new layer based on the process's DTB.

        Returns the name of the Layer or None.
        zJParent layer is not a translation layer, unable to construct process layerN_Process)_contextlayersvol
layer_name
isinstancer
   TranslationLayerInterface	TypeErrorr   mappmappm_cr3r	   InvalidAddressExceptionp_pid_add_process_layer)r   r   r   parent_layerdtbs        r   add_process_layerzproc.add_process_layer   s     }+DH,?@,
(9(STT 	\  	--//%*1CC1 	 	 	44	 !!X03Jdj3J3JJN &&M3~
 
 	
s   #A0 0BBc              #     K   	 |                                  }|j        j        j        j        }n# t
          j        $ r Y d S w xY wt                      }t          |j        j        j	                  D ]}|rv|j
        j        |v sh| j        j        |j
        j                                     |                                j
        j        |                                j
        j                  s(t$                              t(          j        d            d S |j        j        dk    s|j        j        dk    r d S |V  |                    |j
        j                   |j        j        }d S )Nz5Breaking process maps iteration due to invalid state.l   >[={mu )r   r&   hdrlinksnextr	   r)   setrangenentriesr!   offsetr   r    native_layer_nameis_validr   sizevolloglogr   LOGLEVEL_VVVstartendadd)r   r   current_mapseenis        r   get_map_iterzproc.get_map_iter0   sq     	==??D(,,1KK1 	 	 	44	 tx|,-- 	1 	1A?)T11}+DH,FGPP++--18++--16  2 

*K    !'+===$(,>>>HH[_+,,,%+0KK1	1 	1s   */ AAFcontext
rw_no_filec              #   H  K   |                                  D ]}t          |j        j                  }t          |j        j                  }|rK|                                dk    s|                    ||          dk    r|                                dk    r|||z
  fV  dS )zdReturns a list of sections based on the memory manager's view of
        this task's virtual memory.rw [heap]N)rC   intr1   r=   r>   	get_permsget_pathget_special_path)r   rD   r   rE   vmar=   r>   s          r   get_process_memory_sectionsz proc.get_process_memory_sectionsY   s       $$&& 	' 	'C	((Ecim$$C !MMOOt++||G];;rAA++--99 #+&&&&&	' 	'r   )NN)F)__name__
__module____qualname__r   strr   r.   r   r
   r   ObjectInterfacerC   rD   ContextInterfaceboolr   r   rJ   rO    r   r   r   r      s        4 4 4 @D
 
 
9<
	#
 
 
 
8!1hz'9'IJ !1 !1 !1 !1Z !	' '#4' ' 	'
 
5c?D$.	/' ' ' ' ' 'r   r   c                       e Zd Zd ZdS )fileglobc                 2   d }|                      d          r| j        }nM| j        dk    rBt          j        t
          j                  5  | j        j        }d d d            n# 1 swxY w Y   |r(t          |j	                  
                    dd          }|S )Nfg_typer   DTYPE_rH   )
has_memberr[   fg_ops
contextlibsuppressr	   r)   fo_typerS   descriptionreplacer   rets     r   get_fg_typezfileglob.get_fg_typeq   s    ??9%% 	*,CC[A$Z%GHH * *k)* * * * * * * * * * * * * * *  	=co&&..x<<C
s   	A""A&)A&N)rP   rQ   rR   rf   rW   r   r   rY   rY   p   s#            r   rY   c                       e Zd Zd ZdS )vm_map_objectc                     |                      d          r| j        S |                      d          r| j        S t          d          )N	vm_object
vmo_objectzvm_map_object -> get_object)r]   rj   rk   AttributeErrorr   s    r   get_map_objectzvm_map_object.get_map_object   sI    ??;'' 	#>!__\** 	#?":;;;r   N)rP   rQ   rR   rm   rW   r   r   rh   rh      s#        < < < < <r   rh   c                       e Zd Zd Zd ZdS )vnodec                    |d S |r@	 |                     t          j        |d                     n# t          j        $ r Y d S w xY wt          |j                  dz  dk    rit          |j                  dk    rQt          |j        j                  dk    r2| 	                    ||j        j        |j        j        j
                   d S d S 	 |j        }|j
        }n# t          j        $ r Y d S w xY w| 	                    |||           d S )N      r   )appendr   pointer_to_stringr	   r)   rJ   v_flagv_mountmnt_vnodecovered_do_calc_pathv_namev_parent)r   re   vnodeobjvnameparentparent_names         r   rx   zvnode._do_calc_path   sH   4 	

74UC@@AAAA5   tt x(*a//C8H4I4IQ4N4N8#455::""$5$5<     ;:!*$m5   tt sFK88888s!   (1 AAC C.-C.c                    | j         dz  dk    r!| j        dk    r| j        j        dz  dk    rd}n}g }g }|                     || | j                   |                                 |D ]*}|                    |                    d                     +d                    |          }|rd|z   }|	                    d          S )Nrr   r   i @     /zutf-8)
ru   rv   mnt_flagrx   ry   reversers   encodejoindecode)r   re   elementsfileses        r   	full_pathzvnode.full_path   s    K("a''!!%
2a77CCHExt{;;; 0 0QXXg..////))E""C !Sjzz'"""r   N)rP   rQ   rR   rx   r   rW   r   r   ro   ro      s2        9 9 94# # # # #r   ro   c                   >    e Zd Zd Zd Zd Zd Zd Zd Zd Z	d Z
d	S )
vm_map_entryc                     d}|                                  }|dk    rd}n"|dk    r|                     ||          dk    rd}|S )zhFlags memory regions that are mapped rwx or that map an executable
        not back from a file on disk.FrwxTzr-xrH   )rK   rL   )r   rD   r   re   permss        r   is_suspiciouszvm_map_entry.is_suspicious   sS       E>>CCe^^g} E E K KC
r   c                 z    d}d}t          g d          D ]$\  }}| j        |z  |k    r|||         z   }|dz   }%|S )Nr   rH   )rr         -)	enumerate
protection)r   permaskr   ctrrB   s        r   rK   zvm_map_entry.get_perms   s]    			** 	$ 	$FC!#)),r   c                     |                      d          rt          | j                  }nt          | j                  dz  }|S )Naliasi  )r]   rJ   r   
vme_offsetrd   s     r   get_range_aliaszvm_map_entry.get_range_alias   s>    ??7## 	/dj//CCdo&&.C
r   c                 j    |                                  }d|cxk     rdk     rn nd}n|dk    rd}nd}|S )Nr   
   rI      z[stack]rH   )r   )r   checkre   s      r   rM   zvm_map_entry.get_special_path   sM    $$&&u>>>>r>>>>>CCb[[CCC
r   c                 6   |                      ||          }t          |          t          k    r	|dk    r|}n|rg }t                      }|r|j        j        |vr	 t          j        |j        d          }n# t          j
        $ r Y ncw xY w|                    |           t          |          dk    rn6|                    |j        j                   |j        }|r|j        j        |v|                                 dd                    |          z   }nd}|S )Nsub_maprq   i   /rH   )	get_vnodetyperS   r3   r!   r6   r   rt   ry   r	   r)   rs   lenr?   rz   r   r   )r   rD   r   nodere   pathrA   ry   s           r   rL   zvm_map_entry.get_path   s-   ~~g}55::!2!2CC 	D UUD %48?$66$6t{CHHFF!9   E F###t99t##)))}  %48?$66 LLNNN&CCC
s   A6 6BBc                     |                      d          r| j        S |                      d          r| j        S t          d          )N
vme_objectobjectz6vm_map_entry -> get_object: Unable to determine object)r]   r   r   rl   r   s    r   
get_objectzvm_map_entry.get_object
  I    ??<(( 	?"__X&& 	;UVVVr   c                     |                      d          r| j        S |                      d          r| j        S t          d          )Nr   r6   z6vm_map_entry -> get_offset: Unable to determine offset)r]   r   r6   rl   r   s    r   
get_offsetzvm_map_entry.get_offset  r   r   c                    | j         dk    rdS |                                                                 }|dk    rd S d}|sG	 |j                                        }n# t
          j        $ r Y nw xY w|j        j        dk    rd}n|}|G|j        j        dk    rd S 	 |j	        }|dk    rd S |j
                                        }n# t
          j        $ r Y d S w xY wd}|j                            |j        j                  D ]-}	|	                    t          j                  d         dv rd} n.|r?|                    |t          j        z   dz   |j        j        |j	                  }
|
j        }nd }|S )	Nrr   r   r   FT)vnode_pager_ops_vnode_pager_opsvnode_pager)r"   r6   )
is_sub_mapr   rm   shadowr   r	   r)   r!   r6   pagermo_pager_opssymbol_spaceget_symbols_by_locationsplitr   BANGr   r7   vnode_handle)r   rD   r   vnode_object	found_endtmp_vnode_objectr   opsfoundsymvpagerre   s               r   r   zvm_map_entry.get_vnode  s   ?a9 ((779914	 		0#/#6#B#B#D#D  5     #*a// 		/  		0 "a''4	 &Ezzt$0022CC1 	 	 	44	 '??OO 	 	Cyy((+/VVV W  	^^	.>'+=#) $  F
 %CCC
s*   A A-,A-C )C CCN)rP   rQ   rR   r   rK   r   rM   rL   r   r   r   rW   r   r   r   r      s          
 
 
  
 
 
  :W W WW W W1 1 1 1 1r   r   c                   2    e Zd Zd Zd Zd Zd Zd Zd ZdS )socketc                     	 | j                                                             d          }n# t          j        $ r d }Y nw xY w|S )Ninpcb)so_pcbr   r   r	   r)   rd   s     r   	get_inpcbzsocket.get_inpcbO  sX    	+))++0099CC1 	 	 	CCC	 
s   ,/ AAc                 $    | j         j        j        S N)so_proto	pr_domain
dom_familyr   s    r   
get_familyzsocket.get_familyW  s    }&11r   c                 F    | j         j        }|dk    rd}n|dk    rd}nd}|S )N   TCP   UDPrH   )r   pr_protocol)r   protore   s      r   get_protocol_as_stringzsocket.get_protocol_as_stringZ  s6    )A::CCb[[CCC
r   c                 ~    d}| j         j        dk    r*|                                 }||                                }|S )NrH   r   )r   r   r   get_tcp_state)r   re   r   s      r   	get_statezsocket.get_statef  sB    =$))NN$$E ))++
r   c                     |                                  }|d }nA|                                 dk    r|                                }n|                                }|S )N   )r   r   get_ipv4_infoget_ipv6_info)r   r   re   s      r   get_connection_infozsocket.get_connection_infop  s[      =CC__!##%%''CC%%''C
r   c                     |                                  }|r(t          j        |                                 |          }nd }|S r   )r   r   convert_network_four_tupler   )r   valsre   s      r   get_converted_connection_infoz$socket.get_converted_connection_info|  sC    '')) 	78I8I4PPCCC
r   N)	rP   rQ   rR   r   r   r   r   r   r   rW   r   r   r   r   N  sn          2 2 2
 
 
  
 
 
    r   r   c                        e Zd Zd Zd Zd ZdS )r   c                     d}	 | j                                                             d          }n# t          j        $ r Y dS w xY w|j        }|r|t          |          k     r	||         }nd}|S )N)CLOSEDLISTENSYN_SENTSYN_RECVESTABLISHED
CLOSE_WAIT	FIN_WAIT1CLOSINGLAST_ACK	FIN_WAIT2	TIME_WAITtcpcbrH   )inp_ppcbr   r   r	   r)   t_stater   )r   
tcp_statesr   
state_typestates        r   r   zinpcb.get_tcp_state  s    

	M--//44W==EE1 	 	 	22	 ]
 	*s:66z*EEEs   ,1 AAc                     	 | j         j        j        j        }n# t          j        $ r Y d S w xY w| j        }	 | j        j        j        j        }n# t          j        $ r Y d S w xY w| j	        }||||gS r   )
inp_dependladdrinp46_local
ia46_addr4s_addrr	   r)   	inp_lportinp_dependfaddrinp46_foreign	inp_fportr   liplportriprports        r   r   zinpcb.get_ipv4_info  s    	&2=DCC1 	 	 	44	 	&4?FCC1 	 	 	44	 UC''s    ,,A A! A!c                 Z   	 | j         j                            d                              d          }n# t          j        $ r Y d S w xY w| j        }	 | j        j                            d                              d          }n# t          j        $ r Y d S w xY w| j        }||||gS )N	__u6_addrattr__u6_addr32)	r   
inp6_localmemberr	   r)   r   r   inp6_foreignr   r   s        r   r   zinpcb.get_ipv6_info  s    	&188k8JJQQ" R  CC 1 	 	 	44	 	&3:::LLSS" T  CC 1 	 	 	44	 UC''s!   47 A
	A
4B
 
BBN)rP   rQ   rR   r   r   r   rW   r   r   r   r     sA          8( ( ("( ( ( ( (r   r   c                   b    e Zd Z	 d	dej        j        dedededeej        j                 f
dZ	dS )
queue_entry   	list_headmember_name	type_namemax_sizer   c              #     K   d}t                      }dD ];}t          j        t          j                  5  t          | |                                                              |          }||j        j	        |j        j	        k    r|j        j	        |v rn|V  |
                    |j        j	                   |dz   }||k    r	 ddd            dS t          |                    |          |                                                              |          }||j        j	        |j        j	        k    ddd           n# 1 swxY w Y   =dS )a  
        Walks a queue in a smear-aware and smear-resistant manner

        smear is detected by:
            - the max_size parameter sets an upper bound
            - each seen entry is only allowed once

        attempts to work around smear:
            - the list is walked in both directions to help find as many elements as possible

        Args:
            list_head   - the head of the list
            member_name - the name of the embedded list member
            type_name   - the type of each element in the list
            max_size    - the maximum amount of elements that will be returned

        Returns:
            Each instance of the queue cast as "type_name" type
        r   )r2   prevNrr   r  )r3   r_   r`   r	   r)   getattrr   r   r!   r6   r?   r
  )	r   r  r  r  r  yieldedrA   r  queue_elements	            r   	walk_listzqueue_entry.walk_list  s     6 uu$ 	 	D$Z%GHH   'd 3 3 ? ? A A F Fy Q Q!-%)0IM4HHH$(/477''''HH].5666%kG(**#        $   4 4+ 4 F FMM$i " "-%)0IM4HHH	              	 	s   BEA%EE		E		N)r  )
rP   rQ   rR   r
   r   rT   rS   rJ   r   r  rW   r   r   r  r    ss         5 5%55 5 	5
 5 
*$4	55 5 5 5 5 5r   r  c                       e Zd Zd ZdS )ifnetc                 b   |                      d          rJ	 | j        j                                                            d          }nf# t
          j        $ r d }Y nSw xY w	 | j        j        j                                                            d          }n# t
          j        $ r d }Y nw xY w|S )N	if_lladdrsockaddr_dl)	r]   r  ifa_addrr   r   r	   r)   if_addrhead	tqh_first)r   vals     r   r  zifnet.sockaddr_dl  s    ??;'' 	n-99;;@@OO5   &09EEGGLL!  5    
s#   1A	 	AA!6B B,+B,N)rP   rQ   rR   r  rW   r   r   r  r    s#            r   r  c                       e Zd Zd ZdS )r  c                    d}| j         dk    r|S t          | j                   D ]H}	 | j        | j        |z            }n# t          $ r Y  n#w xY w|                    d          }||ddz   }I|r|d         dk    r
|d d         }|S )NrH      zunsigned char02X:)sdl_alenr4   sdl_datasdl_nlen
IndexErrorr   )r   re   rB   r   s       r   __str__zsockaddr_dl.__str__  s    =2Jt}%% 	$ 	$AM$-!"34    ''A1#CC 	3r7c>>crc(C
s   =
A
AN)rP   rQ   rR   r,  rW   r   r   r  r    s#            r   r  c                       e Zd Zd ZdS )sockaddrc                    d}| j         }|dk    r4|                     d          }t          j        |j        j                  }n|dk    rW|                     d          }t          j        |j                            d                              d                    }n*|d	k    r$|                     d
          }t          |          }|S )NrH   r   sockaddr_inr   sockaddr_in6r  r  r     r  )
	sa_familyr   r   convert_ipv4sin_addrr   convert_ipv6	sin6_addrr
  rS   )r   ipfamilyaddr_inaddr_in6addr_dls         r   get_addresszsockaddr.get_address/  s    Q;;ii..G()9)@AABBr\\yy00H(")){);;BBBVV BB r\\ii..GWB	r   N)rP   rQ   rR   r=  rW   r   r   r.  r.  .  s#            r   r.  c                   &    e Zd ZdefdZdefdZdS )
sysctl_oidr   c                 z    d}g d}g d}t          |          D ] \  }}|| j        z  r|||         z   }|dz   }!|S )z
        Returns the actions allowed on the node

        Args: None

        Returns:
            A combination of:
                R - readable
                W - writeable
                L - self handles locking
        rH   )l        i   @i   )RWLr   )r   oid_kind)r   re   checksr   rB   cs         r   rK   zsysctl_oid.get_permsE  sf     555f%% 	  	 DAq4=   E!HnCi
r   c                 `    dddddd}| j         dz  }d|cxk     rd	k     rn n	||         }nd
}|S )at  
        Returns the type of the sysctl node

        Args: None

        Returns:
            One of:
                CTLTYPE_NODE
                CTLTYPE_INT
                CTLTYPE_STRING
                CTLTYPE_QUAD
                CTLTYPE_OPAQUE
                an empty string for nodes not in the above types

        Based on sysctl_sysctl_debug_dump_node
        CTLTYPE_NODECTLTYPE_INTCTLTYPE_STRINGCTLTYPE_QUADCTLTYPE_OPAQUE)rr   r   r      r      r   r   rH   )rD  )r   typesctltypere   s       r   get_ctltypezsysctl_oid.get_ctltype^  s[    $ 
 
 -#%w?????????.CCC
r   N)rP   rQ   rR   rS   rK   rQ  rW   r   r   r?  r?  D  sJ        3    2 S            r   r?  c                       e Zd Zd ZdS )kauth_scopec              #   H   K   | j         D ]}|dk    r|j        dk    r|V  d S )Nr   )ks_listenerskll_callback)r   listeners     r   get_listenerszkauth_scope.get_listeners  sB      ) 	 	H1}}!6!!;!;	 	r   N)rP   rQ   rR   rX  rW   r   r   rS  rS    s#            r   rS  )%r_   loggingtypingr   r   r   r   r   volatility3.frameworkr   r	   r
   r   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   	getLoggerrP   r:   GenericIntelProcessr   
StructTyperY   rh   ro   r   r   r   r  r  r  r.  r?  rS  rW   r   r   <module>rb     s$        < < < < < < < < < < < < < < L L L L L L L L L L L L 1 1 1 1 1 1 6 6 6 6 6 6 1 1 1 1 1 1		8	$	$]' ]' ]' ]' ]'7& ]' ]' ]'@    w!    < < < < <G& < < <0# 0# 0# 0# 0#G 0# 0# 0#fN N N N N7% N N Nb6 6 6 6 6W 6 6 6rA( A( A( A( A(G A( A( A(H6 6 6 6 6'$ 6 6 6r    G   &    '$   .    w!   ,: : : : :# : : :z    '$     r   