
    Xf                         d dl Z d dlmZmZmZmZmZ d dlmZ d dl	m
Z
  G d dej                        Z G d dej                        Z G d	 d
ej                        Zy)    N)	GeneratorListTupleDictOptional)layers)multiregexpc            	       P     e Zd ZdZdZdeddf fdZdededeeddf   fd	Z	 xZ
S )
BytesScannerT   r   r   needlereturnNc                 0    t         |           || _        y N)super__init__r   )selfr   	__class__s     `/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/scanners/__init__.pyr   zBytesScanner.__init__   s        datadata_offsetc              #      K   |j                  | j                        }|dk\  r<|| j                  k  r||z    |j                  | j                  |dz         }|dk\  r;yyw)gRuns through the data looking for the needle, and yields all offsets
        where the needle is found.r      N)findr   
chunk_size)r   r   r   find_poss       r   __call__zBytesScanner.__call__   s[      99T[[)!m $//),,yyhl;H !ms   AA A )__name__
__module____qualname__thread_safe_required_framework_versionbytesr   intr   r    __classcell__r   s   @r   r   r      sF    K"+u  	<U 	< 	<3d?9S 	<r   r   c            	       p     e Zd ZdZdZdZej                  fdede	ddf fdZ
d	ed
e	dee	ddf   fdZ xZS )RegExScannera_  A scanner that can be provided with a bytes-object regular expression pattern
    The scanner will scan all blocks for the regular expression and report the absolute offset of any finds

    The default flags include DOTALL, since the searches are through binary data and the newline character should
    have no specific significance in such searchesTr   patternflagsr   Nc                 X    t         |           t        j                  ||      | _        y r   )r   r   recompileregex)r   r,   r-   r   s      r   r   zRegExScanner.__init__+   s     ZZ/
r   r   r   c              #      K   | j                   j                  |      }|D ])  }|j                         }|| j                  k  s#||z    + yw)r   N)r1   finditerstartr   )r   r   r   r   matchoffsets         r   r    zRegExScanner.__call__/   sM      ::&&t, 	+E[[]F'{**	+s   A A
A)r!   r"   r#   __doc__r$   r%   r/   DOTALLr&   r'   r   r   r    r(   r)   s   @r   r+   r+       s[    6 K"+46II 0 0c 0$ 0+U + +3d?9S +r   r+   c            	            e Zd ZdZdZdee   ddf fdZdeddfdZd	e	e
ee	e
   f      defd
Zdededeeeef   ddf   fdZdedeeeef   ddf   fdZ xZS )MultiStringScannerTr   patternsr   Nc                     t         |           i | _        |D ]  }| j                  |        | j	                  | j                        | _        y r   )r   r   _pattern_trie_process_pattern_process_trie_regex)r   r;   r,   r   s      r   r   zMultiStringScanner.__init__>   sK    BD 	+G!!'*	+((););<r   valuec                 n    | j                   }|y |D ]  }|j                  |i       ||<   ||   } d |d<   y )N)r=   get)r   rA   triechars       r   r>   z#MultiStringScanner._process_patternE   sL    !!< 	D$+DJ:D	
 Rr   rE   c                    |t        |      dk(  rd|v ryg }g }d}t        |      D ]  }|dk\  rw| j                  ||         }|r2|j                  t	        j
                  t        |g            |z          P|j                  t	        j
                  t        |g                   d} t        |      dk(  r|j                  |d          n4t        |      dkD  r&|j                  ddj                  |      z   dz          t        |      dk(  rd}n+t        |      dk(  r|d   }nd	d
j                  |      z   dz   }|rd	|z   dz   }|S )Nr   rC   r   Fr   T   [   ]s   (?:   |   )s   )?)lensortedr?   appendr/   escaper&   join)r   rE   choicessuffixesfinishedentry	remainderresponses           r   r?   z MultiStringScanner._process_trieQ   s:   <3t9>bDjD\ 
	 Ez ..tE{;	NN299UE7^#<y#HIOOBIIeUGn$=>  
	  x=ANN8A;']QNN4#((8"44t;<w<1H\QqzH		' 22T9H(50Hr   r   r   c              #   p   K   | j                  |      D ]  \  }}|| j                  k  s||z   |f   yw)z.Runs through the data looking for the needles.N)searchr   )r   r   r   r6   r,   s        r   r    zMultiStringScanner.__call__z   s@       ${{40 	4OFG'{*G33	4s   '66haystackc              #      K   t        |t              st        d      | j                  st	        d      t        j                  | j                  |      D ]%  }|j                  d      |j                         f ' y w)Nz%Search haystack must be a byte stringz>MultiRegexp cannot be used with an empty set of search stringsr   )	
isinstancer&   	TypeErrorr@   
ValueErrorr/   r3   r4   group)r   rY   r5   s      r   rX   zMultiStringScanner.search   sl     (E*CDD{{P  [[h7 	0E++a.%++-//	0s   A<A>)r!   r"   r#   r$   r%   r   r&   r   r>   r   r   r'   r?   r   r   r    rX   r(   r)   s   @r   r:   r:   9   s    K"+=e = =
e 
 
'(4Xd^0C+D"E '% 'R44(+4	5e$dD0	140u 05e3DdD3P)Q 0r   r:   )r/   typingr   r   r   r   r    volatility3.framework.interfacesr   %volatility3.framework.layers.scannersr	   ScannerInterfacer   r+   r:    r   r   <module>rd      sN    
 9 9 3 =<6** <*+6** +2Q000 Q0r   