def render_text(self, outfd, data):
        linux_common.set_plugin_members(self)
        self.edir = self._config.DUMP_DIR

        if not self.edir:
            debug.error("No output directory given.")

        if not os.path.isdir(self.edir):
            debug.error(self.edir + " is not a directory")

        for task in linux_netstat.linux_netstat(self._config).calculate():
            sfop = task.obj_vm.profile.get_symbol("socket_file_ops")
            dfop = task.obj_vm.profile.get_symbol("sockfs_dentry_operations")

            for (filp, fdnum) in task.lsof():
                if filp.f_op == sfop or filp.dentry.d_op == dfop:
                    iaddr = filp.dentry.d_inode
                    skt = task.SOCKET_I(iaddr)
                    sk = skt.sk

                    for msg in self.process_queue(
                            "receive", task.pid, fdnum, sk.sk_receive_queue):
                        outfd.write(msg + "\n")

                    for msg in self.process_queue(
                            "write", task.pid, fdnum, sk.sk_write_queue):
                        outfd.write(msg + "\n")

    def calculate(self):
        linux_common.set_plugin_members(self)

        find_file  = self._config.FIND
        inode_addr = self._config.inode        
        outfile    = self._config.outfile
        listfiles  = self._config.LISTFILES

        if listfiles:
             for (_, _, file_path, file_dentry) in self.walk_sbs():
                yield (file_path, file_dentry.d_inode)

        elif find_file and len(find_file):
            for (_, _, file_path, file_dentry) in self.walk_sbs():
                if file_path == find_file:
                    yield (file_path, file_dentry.d_inode)
                    break

        elif inode_addr and inode_addr > 0 and outfile and len(outfile) > 0:
            inode = obj.Object("inode", offset = inode_addr, vm = self.addr_space)
            
            f = open(outfile, "wb")
            
            for page in self.get_file_contents(inode):        
                f.write(page)

            f.close()

        else:
            debug.error("Incorrect command line parameters given.")

    def calculate(self):
        linux_common.set_plugin_members(self)

        # a list of root directory entries
        if self._config.DUMP_DIR and self._config.SB:

            if not os.path.isdir(self._config.DUMP_DIR):
                debug.error(self._config.DUMP_DIR + " is not a directory")

            # this path never 'yield's, just writes the filesystem to disk
            tmpfs_sbs = self.get_tmpfs_sbs()
            sb_idx = self._config.SB - 1

            if sb_idx >= len(tmpfs_sbs):
                debug.error("Invalid superblock number given. Please use the -L option to determine valid numbers.")
        
            root_dentry = tmpfs_sbs[sb_idx][0].s_root
            self.walk_sb(root_dentry)

        elif self._config.LIST_SBS:

            # vfsmnt.mnt_sb.s_root
            tmpfs_sbs = self.get_tmpfs_sbs()

            for (i, (_sb, path)) in enumerate(tmpfs_sbs):
                yield (i + 1, path)
        else:
            debug.error("No sb number/output directory combination given and list superblocks not given")

    def calculate(self):
        linux_common.set_plugin_members(self)

        ntables_ptr = obj.Object("Pointer", offset = self.get_profile_symbol("neigh_tables"), vm = self.addr_space)

        for ntable in linux_common.walk_internal_list("neigh_table", "next", ntables_ptr):
            yield self.handle_table(ntable)

    def calculate(self):
        linux_common.set_plugin_members(self)

        find_file  = self._config.FIND
        inode_addr = self._config.inode        
        outfile    = self._config.outfile
        listfiles  = self._config.LISTFILES

        if listfiles:
             for (_, _, file_path, file_dentry) in self.walk_sbs():
                yield (file_path, file_dentry.d_inode)

        elif find_file and len(find_file):
            for (_, _, file_path, file_dentry) in self.walk_sbs():
                if file_path == find_file:
                    yield (file_path, file_dentry.d_inode)
                    break

        elif inode_addr and inode_addr > 0 and outfile and len(outfile) > 0:
            inode = obj.Object("inode", offset = inode_addr, vm = self.addr_space)
           
            try: 
                f = open(outfile, "wb")
            except IOError, e:
                debug.error("Unable to open output file (%s): %s" % (outfile, str(e)))

            for page in self.get_file_contents(inode):        
                f.write(page)

            f.close()

    def calculate(self):
        linux_common.set_plugin_members(self)

        modules = linux_lsmod.linux_lsmod(self._config).get_modules()

        f_op_members = self.profile.types["file_operations"].keywords["members"].keys()
        f_op_members.remove("owner")

        if self._config.INODE:
            inode = obj.Object("inode", offset=self._config.INODE, vm=self.addr_space)
            if not inode.is_valid():
                debug.error(
                    "Invalid inode address given. Please use linux_find_file to determine valid inode addresses."
                )

            for (hooked_member, hook_address) in self.verify_ops(inode.i_fop, f_op_members, modules):
                yield ("inode at {0:x}".format(inode.obj_offset), hooked_member, hook_address)

        else:
            funcs = [self.check_open_files_fop, self.check_proc_fop, self.check_proc_root_fops, self.check_file_cache]

            for func in funcs:

                for (name, member, address) in func(f_op_members, modules):
                    yield (name, member, address)

    def calculate(self):
        linux_common.set_plugin_members(self)

        ps_sources = {}

        # The keys are names of process sources
        # The values are the virtual offset of the task_struct

        ps_sources['pslist']     = self._get_pslist()
        ps_sources['pid_hash']   = self._get_pid_hash()
        ps_sources['kmem_cache'] = self._get_kmem_cache()
        ps_sources['parents']    = self._get_task_parents()
        ps_sources['thread_leaders'] = self._get_thread_leaders()

        # Build a list of offsets from all sources
        seen_offsets = []
        for source in ps_sources:

            tasks = ps_sources[source]

            for offset in tasks:

                if offset not in seen_offsets:
                    seen_offsets.append(offset)
                    yield offset, obj.Object("task_struct", offset = offset, vm = self.addr_space), ps_sources

 def calculate(self):
 
     ## we need this module imported
     if not has_yara:
         debug.error("Please install Yara from https://plusvic.github.io/yara/")
         
     ## leveraged from the windows yarascan plugin
     rules = self._compile_rules()
         
     ## set the linux plugin address spaces 
     linux_common.set_plugin_members(self)
 
     if self._config.KERNEL:
         ## the start of kernel memory taken from VolatilityLinuxIntelValidAS
         if self.addr_space.profile.metadata.get('memory_model', '32bit') == "32bit":
             kernel_start = 0xc0000000
         else:
             kernel_start = 0xffffffff80000000
         
         scanner = malfind.DiscontigYaraScanner(rules = rules,
                                                address_space = self.addr_space)
                                                
         for hit, address in scanner.scan(start_offset = kernel_start):
             yield (None, address - self._config.REVERSE, hit,
                     scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))
     else:
         tasks = self.filter_tasks()
         for task in tasks: 
             scanner = VmaYaraScanner(task = task, rules = rules)
             for hit, address in scanner.scan():
                 yield (task, address - self._config.REVERSE, hit,
                             scanner.address_space.zread(address - self._config.REVERSE, self._config.SIZE))

    def calculate(self):
        linux_common.set_plugin_members(self)
        init_task_addr = self.get_profile_symbol("init_task")

        init_task = obj.Object("task_struct", vm = self.addr_space, offset = init_task_addr)

        pidlist = self._config.PID
	pnamelist = self._config.PROCNAMES
        #pdb.set_trace	

        if pidlist:
            pidlist = [int(p) for p in self._config.PID.split(',')]
	if pnamelist:
	    pnamelist = [str(q) for q in self._config.PROCNAMES.split(',')]

	print pidlist
	print pnamelist
        # walk the ->tasks list, note that this will *not* display "swapper"
        for task in init_task.tasks:
	  type(task.comm)
	  #print task.comm 
	  if not pidlist and not pnamelist:
		yield task
	  else: 
		if pidlist and task.pid in pidlist:
			yield task
	        if pnamelist and str(task.comm) in pnamelist:
			yield task

    def calculate(self):
        linux_common.set_plugin_members(self)

        for dentry_offset in self._compare_filps():
            dentry = obj.Object("dentry", offset = dentry_offset, vm = self.addr_space)
            if dentry.d_count > 0 and dentry.d_inode.is_reg() and dentry.d_flags == 128:
                yield dentry

 def calculate(self):
 
     ## we need this module imported
     if not has_yara:
         debug.error("Please install Yara from code.google.com/p/yara-project")
         
     ## leveraged from the windows yarascan plugin
     rules = self._compile_rules()
         
     ## set the linux plugin address spaces 
     linux_common.set_plugin_members(self)
 
     if self._config.KERNEL:
         ## the start of kernel memory taken from VolatilityLinuxIntelValidAS
         if self.addr_space.profile.metadata.get('memory_model', '32bit') == "32bit":
             kernel_start = 0xc0000000
         else:
             kernel_start = 0xffffffff80000000
         
         scanner = malfind.DiscontigYaraScanner(rules = rules,
                                                address_space = self.addr_space)
                                                
         for hit, address in scanner.scan(start_offset = kernel_start):
             yield (None, address, hit, 
                     scanner.address_space.zread(address, 64))
     else:
         for task in pslist.linux_pslist(self._config).calculate():
             scanner = VmaYaraScanner(task = task, rules = rules)
             for hit, address in scanner.scan():
                 yield (task, address, hit, 
                             scanner.address_space.zread(address, 64))

    def calculate(self):
        linux_common.set_plugin_members(self)

        for (_, _, file_path, file_dentry)in linux_find_file.linux_find_file(self._config).walk_sbs():
            inode = file_dentry.d_inode

            yield inode, inode.i_ino, file_path

    def calculate(self):
        """
        Get all the python strings for a task, and assume those strings
        might be keys of a dictionary entry.  Return the valid dictionary
        entries from that pool of maybes.

        This repeats a lot of linux_python_strings's code, but we want to get
        python strings per task, so we can optimize the bytstring search.
        """
        linux_common.set_plugin_members(self)

        tasks = [task for task in linux_pslist.linux_pslist.calculate(self)
                 if _is_python_task(task)]

        for task in tasks:
            addr_space = task.get_process_address_space()
            memory_model = addr_space.profile.metadata.get('memory_model',
                                                           '32bit')
            pack_format = "I" if memory_model == '32bit' else "Q"

            bytestrings = [
                # the hash as bytes
                struct.pack(pack_format.lower(), py_string.ob_shash) +
                # the pointer the PyStringObject as bytes
                struct.pack(pack_format, py_string.obj_offset)
                for py_string in find_python_strings(task)
            ]

            for address in task.search_process_memory(bytestrings,
                                                      heap_only=True):
                py_dict_entry = obj.Object("_PyDictEntry",
                                           offset=address,
                                           vm=addr_space)
                if py_dict_entry.is_valid():
                    yield task, py_dict_entry

    def calculate(self):
        linux_common.set_plugin_members(self)
        tasks = linux_pslist.linux_pslist.calculate(self)

        for task in tasks:
            for elf, elf_start, elf_end, soname, needed in task.elfs():
                yield task, elf, elf_start, elf_end, soname, needed

    def calculate(self):
        linux_common.set_plugin_members(self)
        modules_addr = self.get_profile_symbol("modules")

        modules = obj.Object("list_head", vm = self.addr_space, offset = modules_addr)

        # walk the modules list
        for module in modules.list_of_type("module", "list"):

            #if str(module.name) == "rootkit":
            #    continue

            if self._config.PARAMS:

                if not hasattr(module, "kp"):
                    debug.error("Gathering module parameters is not supported in this profile.")

                params = self.get_params(module)
            else:
                params = ""

            if self._config.SECTIONS:
                sections = self.get_sections(module)
            else:
                sections = []

            yield (module, sections, params)

    def calculate(self):
        linux_common.set_plugin_members(self)

        find_file  = self._config.FIND
        inode_addr = self._config.inode        
        outfile    = self._config.outfile

        if find_file and len(find_file):

            wanted_dentry = self.walk_sbs(find_file)

            if wanted_dentry:
                yield wanted_dentry

        elif inode_addr and inode_addr > 0 and outfile and len(outfile) > 0:
        
            inode = obj.Object("inode", offset=inode_addr, vm=self.addr_space)
            
            contents = self.get_file_contents(inode)

            f = open(outfile, "wb")
            f.write(contents)
            f.close()

        else:
            debug.error("Incorrect command line parameters given.")

    def _walk_xarray_pids(self):
        ff = find_file.linux_find_file(self._config)
        linux_common.set_plugin_members(ff)

        self.XARRAY_TAG_MASK     = 3
        self.XARRAY_TAG_INTERNAL = 2

        self.XA_CHUNK_SHIFT = 6
        self.XA_CHUNK_SIZE  = 1 << self.XA_CHUNK_SHIFT
        self.XA_CHUNK_MASK  = self.XA_CHUNK_SIZE - 1

        ns_addr = self.addr_space.profile.get_symbol("init_pid_ns")
        ns = obj.Object("pid_namespace", offset = ns_addr, vm = self.addr_space)
 
        xarray = ns.idr.idr_rt

        if not xarray.is_valid():
            return

        root = xarray.xa_head.v()

        is_internal = ff.xa_is_internal(root)

        if root & self.XARRAY_TAG_MASK != 0:
            root = root & ~self.XARRAY_TAG_MASK

        height = 0
        node   = obj.Object("xa_node", offset = root, vm = self.addr_space)
        
        if is_internal and hasattr(node, "shift"):
            height = (node.shift / self.XA_CHUNK_SHIFT) + 1

        for node in self._do_walk_xarray(ff, node, height, 0):
            if node and node.is_valid():
                yield node

    def get_file_contents(self, inode):
        linux_common.set_plugin_members(self)
        data = ""
        file_size = inode.i_size

        extra = file_size % 4096

        idxs = file_size / 4096

        if extra != 0:
            extra = 4096 - extra
            idxs = idxs + 1

        for idx in range(0, idxs):

            data = data + self.get_page_contents(inode, idx)

        # this is chop off any extra data on the last page

        if extra != 0:
            extra = extra * -1

            data = data[:extra]

        return data

    def calculate(self):
        linux_common.set_plugin_members(self)

        phys_addr_space = utils.load_as(self._config, astype="physical")

        if phys_addr_space.profile.metadata.get("memory_model", "32bit") == "32bit":
            fmt = "<I"
        else:
            fmt = "<Q"

        needles = []

        for sym in phys_addr_space.profile.get_all_symbol_names("kernel"):
            if sym.find("_sched_class") != -1:
                addr = phys_addr_space.profile.get_symbol(sym)
                needles.append(struct.pack(fmt, addr))

        if len(needles) == 0:
            debug.error("Unable to scan for processes. Please file a bug report.")

        back_offset = phys_addr_space.profile.get_obj_offset("task_struct", "sched_class")

        scanner = poolscan.MultiPoolScanner(needles)

        for _, offset in scanner.scan(phys_addr_space):
            ptask = obj.Object("task_struct", offset=offset - back_offset, vm=phys_addr_space)

            if not ptask.exit_state.v() in [0, 16, 32, 16 | 32]:
                continue

            if not (0 < ptask.pid < 66000):
                continue

            yield ptask

    def render_text(self, outfd, data):
        linux_common.set_plugin_members(self)
        
        self.table_header(outfd, [("Task", "10"), 
                                  ("ELF Start", "[addrpad]"), 
                                  ("ELF Name", "24"),
                                  ("Symbol", "24"),
                                  ("Resolved Address", "[addrpad]"),
                                  ("H", "1"),
                                  ("Target Info", "")])
            
        ignore = frozenset(self._config.IGNORE)

        for task in data:
            for soname, elf, elf_start, elf_end, addr, symbol_name, hookdesc, hooked in task.plt_hook_info():
                if not hooked and not self._config.ALL:
                    continue

                if hookdesc in ignore:
                    continue

                if hookdesc == '[RTLD_LAZY]' and not self._config.ALL:
                    continue

                self.table_row(outfd, task.pid, elf_start, soname if soname else '[main]', \
                    symbol_name, addr, '!' if hooked else ' ', hookdesc)