*1fGddlZddlZddlmZmZmZmZmZddlm Z m Z m Z m Z ddl mZddlmZddlmZej&eZGddej,ZGd d e j0ZGd d e j0ZGd de j0ZGdde j0ZGdde j0ZGdde j0ZGdde j0ZGdde j0Z Gdde j0Z!Gdde j0Z"Gdde j0Z#Gdd e j0Z$y)!N) GeneratorIterableOptionalSetTuple) constants exceptions interfacesobjects)utility) conversion)genericc eZdZdZ d dededeefdZdeejjfdZ d dejjded edeeeefddffd Zy) proccT|jjjdS)Ntask)r dereferencecastselfs g/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/mac/extensions/__init__.pyget_taskz proc.get_tasks yy$$&++F33N config_prefixpreferred_namereturnc|jj|jj}t |t jj s td |jjjj}|&|jjd|jz}|j|j|||S#tj$rYywxYw)zkConstructs a new layer based on the process's DTB. Returns the name of the Layer or None. zJParent layer is not a translation layer, unable to construct process layerN_Process)_contextlayersvol layer_name isinstancer TranslationLayerInterface TypeErrorrmappmappm_cr3r InvalidAddressExceptionp_pid_add_process_layer)rrr parent_layerdtbs radd_process_layerzproc.add_process_layers}}++DHH,?,?@ , (9(9(S(ST\  --/%%**11C  !!XX00Xdjj\3JJN&& MM3 ~  11  s.CC('C(c#K |j}|jjjj}t}t|jjjD]7}|r|jj|vs|jj|jjj|j!jj|j!jj"s&t$j't(j*dy|jj,dk(s|jj.dk(ry||j1|jj|jj}:y#t j $rYywxYww)Nz5Breaking process maps iteration due to invalid state.l>[={mu )rr&hdrlinksnextr r)setrangenentriesr!offsetrr native_layer_nameis_validrsizevolloglogr LOGLEVEL_VVVstartendadd)rr current_mapseenis r get_map_iterzproc.get_map_iter0sZ ==?D((,,,,11Ktxx||,,- 1A??))T1}}++DHH,F,FGPP++-1188++-1166  **K!!''+==$$((,>>  HH[__++ ,%++00K1 1 11  s(G:F-E/G-GGGGcontext rw_no_filec#@K|jD]}t|jj}t|jj}|r<|j dk7s|j ||dk7r|jdk7r|||z fyw)zdReturns a list of sections based on the memory manager's view of this task's virtual memory.rw[heap]N)rCintr1r=r> get_permsget_pathget_special_path)rrDrrEvmar=r>s rget_process_memory_sectionsz proc.get_process_memory_sectionsYs$$& 'C (Eciimm$CMMOt+||G];rA++-9 #+& & 'sBB)NN)F)__name__ __module__ __qualname__rstrrr.rr r ObjectInterfacerCrDContextInterfaceboolrrrJrOrrrrs4@D   9< # 8!1hz'9'9'I'IJ!1Z! '##44'' ' 5c?D$. / 'rrceZdZdZy)fileglobcNd}|jdr |j}nQ|jdk7rBtjt j 5|jj}ddd|r%t|jjdd}|S#1swY2xYw)Nfg_typerDTYPE_rH) has_memberr[fg_ops contextlibsuppressr r)fo_typerS descriptionreplacerrets r get_fg_typezfileglob.get_fg_typeqs ??9 %,,C [[A $$Z%G%GH *kk)) * coo&..x get_object)r]rjrkAttributeErrorrs rget_map_objectzvm_map_object.get_map_objects: ??; '>> ! __\ *?? ":;;rN)rPrQrRrmrWrrrhrhsC  e^ g} E KC rcxd}d}tgdD]%\}}|j|z|k(r |||z}!|dz}'|S)NrrH)rr-) enumerate protection)rpermaskrctrrBs rrKzvm_map_entry.get_permssS * $FC!#) ,   $  rc|jdrt|j}|St|jdz}|S)Naliasi)r]rJr vme_offsetrds rget_range_aliaszvm_map_entry.get_range_aliass< ??7 #djj/C doo&.C rc\|j}d|cxkrdkrd}|S|dk(rd}|Sd}|S)Nr rIz[stack]rH)r)rcheckres rrMzvm_map_entry.get_special_pathsK$$& u>r>C    b[C C rcL|j||}t|tk(r |dk(r|}|S|rg}t}|r|jj |vr t j|jd}|j|t|dkDrnL|j|jj |j}|r|jj |vr|jddj!|z}|Sd}|S#tj$rY?wxYw)Nsub_maprqi/rH) get_vnodetyperSr3r!r6r rtryr r)rslenr?rzrr)rrDrnoderepathrArys rrLzvm_map_entry.get_paths~~g}5 : !2C. -D UD488??$6$66t{{CHF F#t9t#)}}488??$6 LLN&C C !"99s D D#"D#c|jdr |jS|jdr |jStd)N vme_objectobjectz6vm_map_entry -> get_object: Unable to determine object)r]rrrlrs r get_objectzvm_map_entry.get_object : ??< (?? " __X &;; UVVrc|jdr |jS|jdr |jStd)Nrr6z6vm_map_entry -> get_offset: Unable to determine offset)r]rr6rlrs r get_offsetzvm_map_entry.get_offsetrrcN|jdk(ry|jj}|dk(ryd}|s< |jj }|jjdk(rd}n|}|s<|jjdk(ry |j}|dk(ry|jj }d}|jj|jjD]*} | jtjddvs(d}n|rT|j!|tjzdz|jj"|j} | j$} | Sd} | S#t j $rYwxYw#t j $rYywxYw) NrrrrFT)vnode_pager_ops_vnode_pager_ops vnode_pager)r"r6) is_sub_maprrmshadowrr r)r!r6pager mo_pager_ops symbol_spaceget_symbols_by_locationsplitrBANGrr7 vnode_handle) rrDr vnode_object found_endtmp_vnode_objectropsfoundsymvpagerres rrzvm_map_entry.get_vnodes ??a (779 1   #/#6#6#B#B#D  ##**a/ /     " "a '  &&Ez$$002C''??O Cyy(+/VV  ^^ .>'++==#))$F %%C C I55  "11  s)E4F"F4F  F F$#F$N) rPrQrRrrKrrMrLrrrrWrrrrs,   :WW1rrc0eZdZdZdZdZdZdZdZy)socketc |jjjd}|S#tj$rd}Y|SwxYw)Ninpcb)so_pcbrrr r)rds r get_inpcbzsocket.get_inpcbOsL ++))+009C 11 C  s)-AAcB|jjjSN)so_proto pr_domain dom_familyrs r get_familyzsocket.get_familyWs}}&&111rcZ|jj}|dk(rd}|S|dk(rd}|Sd}|S)NTCPUDPrH)r pr_protocol)rprotores rget_protocol_as_stringzsocket.get_protocol_as_stringZsE )) A:C  b[C C rcd}|jjdk(r"|j}||j}|S)NrHr)rrr get_tcp_state)rrers r get_statezsocket.get_statefs> == $ $ )NN$E ))+ rc|j}|d}|S|jdk(r|j}|S|j}|S)N)rr get_ipv4_info get_ipv6_info)rrres rget_connection_infozsocket.get_connection_infopsZ  =C  __ ! #%%'C %%'C rcz|j}|r&tj|j|}|Sd}|Sr)rr convert_network_four_tupler)rvalsres rget_converted_connection_infoz$socket.get_converted_connection_info|s?'') 778I4PC C rN) rPrQrRrrrrrrrWrrrrNs 2  rrceZdZdZdZdZy)rcd} |jjjd}|j }|r|t |kr||}|Sd}|S#tj$rYywxYw)N) CLOSEDLISTENSYN_SENTSYN_RECV ESTABLISHED CLOSE_WAIT FIN_WAIT1CLOSINGLAST_ACK FIN_WAIT2 TIME_WAITtcpcbrH)inp_ppcbrrr r)t_stater)r tcp_statesr state_typestates rrzinpcb.get_tcp_states{   MM--/44W=E]] *s:6z*E E 11  s)AA*)A*cN |jjjj}|j } |jjjj}|j}||||gS#tj $rYywxYw#tj $rYywxYwr) inp_dependladdr inp46_local ia46_addr4s_addrr r) inp_lportinp_dependfaddr inp46_foreign inp_fportrliplportriprports rrzinpcb.get_ipv4_infos &&22==DDC &&44??FFCUC''11  11  s"*A5*B5B  B B$#B$c~ |jjjdjd}|j } |j jjdjd}|j}||||gS#tj$rYywxYw#tj$rYywxYw)N __u6_addrattr __u6_addr32) r inp6_localmemberr r)rr inp6_foreignrrs rrzinpcb.get_ipv6_infos &&1188k8JQQ"RC  &&33:: :LSS"TC UC''11  11  s#6B 6B& B#"B#&B<;B<N)rPrQrRrrrrWrrrrs8("(rrc eZdZ ddejj dedededeejj f dZ y) queue_entry list_head member_name type_namemax_sizerc#Kd}t}dD]G}tjtj5t ||j j|}||jj|jjk7r|jj|vrn||j|jj|dz}||k(r dddyt |j||j j|}|.|jj|jjk7rdddJy#1swYVxYww)a Walks a queue in a smear-aware and smear-resistant manner smear is detected by: - the max_size parameter sets an upper bound - each seen entry is only allowed once attempts to work around smear: - the list is walked in both directions to help find as many elements as possible Args: list_head - the head of the list member_name - the name of the embedded list member type_name - the type of each element in the list max_size - the maximum amount of elements that will be returned Returns: Each instance of the queue cast as "type_name" type r)r2prevNrrr) r3r_r`r r)getattrrrr!r6r?r ) rrrrryieldedrAr queue_elements r walk_listzqueue_entry.walk_lists<6u$ D$$Z%G%GH  'd 3 ? ? A F Fy Q !-%))00IMM4H4HH$((//47''HH]..556%kG(*#  $ 4 4+ 4 FM$i""-%))00IMM4H4HH      s*6E*B&E E*(A(E E*E' "E*N)i) rPrQrRr r rTrSrJrrrWrrr r sY  5%%5555 5  5 *$$44 5 5rr ceZdZdZy)ifnetc|jdr6 |jjjj d}|S |jjjjj d}|S#t j $rd}Y|SwxYw#t j $rd}Y|SwxYw)N if_lladdr sockaddr_dl) r]rifa_addrrrr r) if_addrhead tqh_first)rvals rrzifnet.sockaddr_dls ??; ' nn--99;@@O  &&0099EEGLL!  55   55   s#3B =B$B! B!$B=<B=N)rPrQrRrrWrrrrsrrceZdZdZy)rc d}|jdkDr|St|jD]9} |j|j|z}|j d}||ddz};|r |ddk(r|dd}|S#t$rYwxYw)NrHz unsigned char02X:)sdl_alenr4sdl_datasdl_nlen IndexErrorr)rrerBrs r__str__zsockaddr_dl.__str__s ==2 Jt}}% $A MM$--!"34'A1S' #C $ 3r7c>cr(C   sA66 BBN)rPrQrRr+rWrrrrsrrceZdZdZy)sockaddrcd}|j}|dk(r<|jd}tj|jj }|S|dk(rR|jd}tj |jjdjd}|S|d k(r|jd }t|}|S) NrHr sockaddr_inr sockaddr_in6rrrr) sa_familyrr convert_ipv4sin_addrr convert_ipv6 sin6_addrr rS)ripfamilyaddr_inaddr_in6addr_dls r get_addresszsockaddr.get_address/s  Q;ii .G(()9)9)@)@AB r\yy0H(("")){);BB BVB r\ii .GWB rN)rPrQrRr<rWrrr-r-.srr-c$eZdZdefdZdefdZy) sysctl_oidrczd}gd}gd}t|D]"\}}||jzr |||z}|dz}$|S)z Returns the actions allowed on the node Args: None Returns: A combination of: R - readable W - writeable L - self handles locking rH)li@i)RWLr)roid_kind)rrechecksrrBcs rrKzsysctl_oid.get_permsEsT5f% DAq4== E!HnCi   rcbdddddd}|jdz}d|cxkrd kr nn||}|Sd }|S) at Returns the type of the sysctl node Args: None Returns: One of: CTLTYPE_NODE CTLTYPE_INT CTLTYPE_STRING CTLTYPE_QUAD CTLTYPE_OPAQUE an empty string for nodes not in the above types Based on sysctl_sysctl_debug_dump_node CTLTYPE_NODE CTLTYPE_INTCTLTYPE_STRING CTLTYPE_QUADCTLTYPE_OPAQUE)rrrrrrrrH)rC)rtypesctltyperes r get_ctltypezsysctl_oid.get_ctltype^sQ$  --#% w??.C C rN)rPrQrRrSrKrPrWrrr>r>Ds32 S rr>ceZdZdZy) kauth_scopec#bK|jD]}|dk7s |jdk7s|yw)Nr) ks_listeners kll_callback)rlisteners r get_listenerszkauth_scope.get_listenerss4)) H1}!6!6!!; s ///N)rPrQrRrWrWrrrRrRsrrR)%r_loggingtypingrrrrrvolatility3.frameworkrr r r volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr getLoggerrPr:GenericIntelProcessr StructTyperYrhrorrrr rrr-r>rRrWrrras+<<LL161   8 $]'7 & &]'@ w!!