
    Xf                         d dl Z d dlZd dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ  e j        e          Z G d dej        j                  ZdS )	    N)
interfaces	renderers)requirements)format_hints
conversion)utility)crashc                   H    e Zd ZdZdZed             Zdej        fdZ	d Z
dS )	Crashinfoz0Lists the information from a Windows crash dump.)   r   r   c                 6    t          j        ddddg          gS )NprimaryzMemory layer for the kernelIntel32Intel64)namedescriptionarchitectures)r   TranslationLayerRequirement)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/crashinfo.pyget_requirementszCrashinfo.get_requirements   s1     49()4  
 	
    layerc              #     K   |                                 }t          j        t          |j                  dz            }|j        dk    rd}n|j        dk    rd}nd|j        dd	}|j        dk    r`|                                }t          j        |j	                  }t          j        |j
                  }t          j        |j                  }nt          j                    x}x}}d
t          j        |j                  |j        |j        t          j        |j                  t          j        |j                  t          j        |j                  t          j        |j                  |j        |j        t          j        |j                  |t5          |          t          j        |j                  t9          j        |j                  |||ffV  d S )N
   )microseconds   zFull Dump (0x1)   zBitmap Dump (0x5)zUnknown/Unsupported (z#x)r   )
get_headerdatetime	timedeltaintSystemUpTimeDumpTypeget_summary_headerr   Hex
HeaderSize
BitmapSizePagesr   NotApplicableValuer   array_to_string	SignatureMajorVersionMinorVersionDirectoryTableBasePfnDataBasePsLoadedModuleListPsActiveProcessHeadMachineImageTypeNumberProcessorsKdDebuggerDataBlockstrCommentr   wintime_to_datetime
SystemTime)	selfr   headeruptime	dump_typesummary_headerbitmap_header_sizebitmap_sizebitmap_pagess	            r   
_generatorzCrashinfo._generator   s     !!###V5H1I1IB1NOOO?c!!)II_##+II FEEEEI?c!!"5577N!-!1.2K!L!L&*>+DEEK'+N,@AALL ,.. |
 '(899## !:;; !344 !:;; !;<<'' !;<<F'77.v/@AA"#
 	
 	
 	
 	
 	
r   c                 x   d }| j         j        D ]2}| j         j        |         }t          |t          j                  r|} n3|t
                              d            t          j        dt          fdt          fdt          fdt          j        fdt          j        fdt          j        fdt          j        fd	t          fd
t          fdt          j        fdt          fdt          fdt          fdt          j        fdt          j        fdt          j        fdt          j        fg|                     |                    S )Nz)This plugin requires a Windows crash dumpr-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r%   r$   r8   r:   BitmapHeaderSizer)   BitmapPages)_contextlayers
isinstancer	   WindowsCrashDump32Layervollogerrorr   TreeGridr7   r#   r   r'   r!   rC   )r;   crash_layer
layer_namer   s       r   runzCrashinfo.runL   s:   -. 	 	JM(4E%!>?? # LLDEEE!c"%%%|'78 01%|'78&(89#S)#S)&(89S!%C x01#\%56|/0 01#& OOK(()
 
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r	   rJ   rC   rP    r   r   r   r      sg        ::"+
 
 [
+
 = +
 +
 +
 +
Z!
 !
 !
 !
 !
r   r   )loggingr!   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r   volatility3.framework.objectsr   volatility3.framework.layersr	   	getLoggerrQ   rK   pluginsPluginInterfacer   rW   r   r   <module>ra      s   
   7 7 7 7 7 7 7 7 < < < < < < D D D D D D D D 1 1 1 1 1 1 . . . . . .		8	$	$]
 ]
 ]
 ]
 ]

"2 ]
 ]
 ]
 ]
 ]
r   