Function hook__sflt_register

qiling/os/macos/kernel_api/kernel_api.py:1108–1191

(ql, address, params)

    "protocol": INT
})
def hook__sflt_register(ql, address, params):
    sf = sflt_filter_t(ql, params["filter"])
    sf = sf.loadFromMem()
    true_name = str(sf.sf_handle).encode()
    true_name += b"_" + ql.mem.string(sf.sf_name.value).encode()
    true_name += b"_" + str(params["domain"]).encode()
    true_name += b"_" + str(params["type"]).encode()
    true_name += b"_" + str(params["protocol"]).encode()
    flag = 0

    if sf.sf_unregistered != 0:
        flag |= 1 << 0
        ql.os.ev_manager.register(sf.sf_unregistered.value, true_name, MacOSEventType.EV_SFLT_UNREGISTERED, protocol=params["protocol"])
    if sf.sf_attach != 0:
        flag |= 1 << 1
        ql.os.ev_manager.register(sf.sf_attach.value, true_name, MacOSEventType.EV_SFLT_ATTACH, protocol=params["protocol"])
    if sf.sf_detach != 0:
        flag |= 1 << 2
        ql.os.ev_manager.register(sf.sf_detach.value, true_name, MacOSEventType.EV_SFLT_DETACH, protocol=params["protocol"])
    if sf.sf_notify != 0:
        flag |= 1 << 3
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_CONNECTING, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_CONNECTED, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_DISCONNECTING, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_DISCONNECTED, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_FLUSH_READ, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_SHUTDOWN, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_CANTRECVMORE, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_CANTSENDMORE, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_CLOSING, protocol=params["protocol"])
        ql.os.ev_manager.register(sf.sf_notify.value, true_name, MacOSEventType.EV_SFLT_NOTIFY_BOUND, protocol=params["protocol"])
    if sf.sf_getpeername != 0:
        flag |= 1 << 4
        ql.os.ev_manager.register(sf.sf_getpeername.value, true_name, MacOSEventType.EV_SFLT_GETPEERNAME, protocol=params["protocol"])
    if sf.sf_getsockname != 0:
        flag |= 1 << 5
        ql.os.ev_manager.register(sf.sf_getsockname.value, true_name, MacOSEventType.EV_SFLT_GETSOCKNAME, protocol=params["protocol"])
    if sf.sf_data_in != 0:
        flag |= 1 << 6
        ql.os.ev_manager.register(sf.sf_data_in.value, true_name, MacOSEventType.EV_SFLT_DATA_IN, protocol=params["protocol"])
    if sf.sf_data_out != 0:
        flag |= 1 << 7
        ql.os.ev_manager.register(sf.sf_data_out.value, true_name, MacOSEventType.EV_SFLT_DATA_OUT, protocol=params["protocol"])
    if sf.sf_connect_in != 0:
        flag |= 1 << 8
        ql.os.ev_manager.register(sf.sf_connect_in.value, true_name, MacOSEventType.EV_SFLT_CONNECT_IN, protocol=params["protocol"])
    if sf.sf_connect_out != 0:
        flag |= 1 << 9
        ql.os.ev_manager.register(sf.sf_connect_out.value, true_name, MacOSEventType.EV_SFLT_CONNECT_OUT, protocol=params["protocol"])
    if sf.sf_bind != 0:
        flag |= 1 << 10
        ql.os.ev_manager.register(sf.sf_bind.value, true_name, MacOSEventType.EV_SFLT_BIND, protocol=params["protocol"])
    if sf.sf_setoption != 0:
        flag |= 1 << 11
        ql.os.ev_manager.register(sf.sf_setoption.value, true_name, MacOSEventType.EV_SFLT_SETOPTION, protocol=params["protocol"])
    if sf.sf_getoption != 0:
        flag |= 1 << 12
        ql.os.ev_manager.register(sf.sf_getoption.value, true_name, MacOSEventType.EV_SFLT_GETOPTION, protocol=params["protocol"])