
    Xf                         d dl Z d dlZd dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ  e j                  e      Z G d dej"                  j$                        Zy)	    N)
interfaces	renderers)requirements)format_hints
conversion)utility)crashc                   J    e Zd ZdZdZed        Zdej                  fdZ	d Z
y)	Crashinfoz0Lists the information from a Windows crash dump.)   r   r   c                 8    t        j                  ddddg      gS )NprimaryzMemory layer for the kernelIntel32Intel64)namedescriptionarchitectures)r   TranslationLayerRequirement)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/crashinfo.pyget_requirementszCrashinfo.get_requirements   s*     449()4
 	
    layerc              #   x  K   |j                         }t        j                  t        |j                        dz        }|j
                  dk(  rd}n#|j
                  dk(  rd}nd|j
                  dd	}|j
                  dk(  rn|j                         }t        j                  |j                        }t        j                  |j                        }t        j                  |j                        }nt        j                         x}x}}d
t        j                  |j                         |j"                  |j$                  t        j                  |j&                        t        j                  |j(                        t        j                  |j*                        t        j                  |j,                        |j.                  |j0                  t        j                  |j2                        |t5        |      t        j                  |j6                        t9        j:                  |j<                        |||ff y w)N
   )microseconds   zFull Dump (0x1)   zBitmap Dump (0x5)zUnknown/Unsupported (z#x)r   )
get_headerdatetime	timedeltaintSystemUpTimeDumpTypeget_summary_headerr   Hex
HeaderSize
BitmapSizePagesr   NotApplicableValuer   array_to_string	SignatureMajorVersionMinorVersionDirectoryTableBasePfnDataBasePsLoadedModuleListPsActiveProcessHeadMachineImageTypeNumberProcessorsKdDebuggerDataBlockstrCommentr   wintime_to_datetime
SystemTime)	selfr   headeruptime	dump_typesummary_headerbitmap_header_sizebitmap_sizebitmap_pagess	            r   
_generatorzCrashinfo._generator   s    !!###V5H5H1IB1NO??c!)I__#+I 0/C1EI??c!"557N!-!1!1.2K2K!L&**>+D+DEK'++N,@,@AL ,,. |
 ''(8(89####  !:!:;  !3!34  !:!:;  !;!;<''''  !;!;<F''7..v/@/@A"#
 	
s   H8H:c                    d }| j                   j                  D ]9  }| j                   j                  |   }t        |t        j                        s7|} n |t
        j                  d        t        j                  dt        fdt        fdt        fdt        j                  fdt        j                  fdt        j                  fdt        j                  fd	t        fd
t        fdt        j                  fdt        fdt        fdt        fdt        j                  fdt        j                  fdt        j                  fdt        j                  fg| j                  |            S )Nz)This plugin requires a Windows crash dumpr-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r%   r$   r8   r:   BitmapHeaderSizer)   BitmapPages)_contextlayers
isinstancer	   WindowsCrashDump32Layervollogerrorr   TreeGridr7   r#   r   r'   r!   rC   )r;   crash_layer
layer_namer   s       r   runzCrashinfo.runL   sH   --.. 	JMM((4E%!>!>?#		 LLDE!!c"%%%|'7'78 0 01%|'7'78&(8(89#S)#S)&(8(89S!%C x001#\%5%56|//0 0 01#& OOK()
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r	   rJ   rC   rP    r   r   r   r      s5    :"+
 
+
 = = +
Z!
r   r   )loggingr!   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r   volatility3.framework.objectsr   volatility3.framework.layersr	   	getLoggerrQ   rK   pluginsPluginInterfacer   rW   r   r   <module>ra      sH   
   7 < D 1 .			8	$]

""22 ]
r   