
    *1f'                        d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZmZ  ej        e          Z G d
 dej        j         ej!                  Z"dS )    N)ListOptionalType)	constants
exceptions
interfaces	renderers)requirements)
conversionformat_hints)intermed)pe)	timeliner)infopslistpsscanc                   
   e Zd ZdZdZdZedeej	        j
                 fd            Ze	 	 ddej        j        ded	ej        j        d
eej        j                 dededeej        j                 fd            Zd Zd Zd ZdS )DllListz>Lists the loaded modules in a particular windows memory image.   r   r   returnc                    t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d
          t          j        dt          j        d          t          j	        dt          dd          t          j        ddd          t          j        dddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   	componentversionr   )   r!   r   r   )r!   r   r   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optionaloffsetz,Process offset in the physical address space)r   r   r$   dumpzExtract listed DLLsF)r   r   defaultr$   )r
   ModuleRequirementVersionRequirementr   PsListr   PsScanr   InfoListRequirementintIntRequirementBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/dlllist.pyget_requirementszDllList.get_requirements   s     *,()4  
 +	   +	   +ty)   ( W	   'J  
 +1	  5 
  	
    N contextpe_table_name	dll_entryopen_method
layer_nameprefixc                    	 	 |j                                         }n# t          j        $ r d}Y nw xY w||j        j        } |d                    |t          j        |          |j        j	        |j
                            }|                    |t          j        z   dz   |j
        |          }	|	                                D ]/\  }
}|                    |
           |                    |           0nU# t"          t          j        t&          t(          f$ r0}t*                              d|j
         d|            Y d}~dS d}~ww xY w|S )a  Extracts the complete data for a process as a FileInterface

        Args:
            context: the context to operate upon
            pe_table_name: the name for the symbol table containing the PE format symbols
            dll_entry: the object representing the module
            layer_name: the layer that the DLL lives within
            open_method: class for constructing output files

        Returns:
            An open FileHandlerInterface object containing the complete data for the DLL or None in the case of failure
        UnreadableDLLNameNz{}{}.{:#x}.{:#x}.dmp_IMAGE_DOS_HEADER)r%   r:   zUnable to dump dll at offset z: )FullDllName
get_stringr   InvalidAddressExceptionvolr:   formatntpathbasenamer%   DllBaseobjectr   BANGreconstructseekwriteIOErrorVolatilityExceptionOverflowError
ValueErrorvollogdebug)r1   r6   r7   r8   r9   r:   r;   r   file_handle
dos_headerr%   dataexcps                r2   dump_pezDllList.dump_pe@   s   ,"	+ ,77995 + + +*+ !&]5
%+&--OD))M(%	  K !	.1DD (% (  J !+ 6 6 8 8 ( (  (((!!$''''( *	
 	 	 	 LLT9JTTdTTUUU44444	 s.    C6 1C6 1CC6 6"E%EEc              #     K   t           j                            | j        | j        ddt
          j                  }| j        j        | j        d                  }t          j
                            | j        |j        |j                  }t          |j                  }t          |j                  }|dk    p|dk    o|dk    }|D ]+}|j        }	|                                }
|                                D ]}t)          j                    x}}t-          j        t0          j                  5  |j                                        }|j                                        }d d d            n# 1 swxY w Y   |rH	 t;          j        |j        j                   }n;# t0          j        $ r t)          j                    }Y nw xY wt)          j!                    }d}| j        d         rH| "                    | j        ||| j#        |
d	|	 d
          }d}|r|$                                 |j%        }	 tM          j'        |j(                  }n(# t0          j        $ r t)          j)                    }Y nw xY w	 tM          j'        |j*                  }n(# t0          j        $ r t)          j)                    }Y nw xY wd|j        |j+        ,                    d|j+        j-        j.        d          ||||||ffV  -d S )Nwindowsr   )class_typesr      r!   Disabledr&   zpid..)r;   zError outputting filer   stringreplace)
max_lengtherrors)/r   IntermediateSymbolTablecreater6   config_pathr   rY   modulesconfigr   r,   get_kuser_structurer:   symbol_table_namer.   NtMajorVersionNtMinorVersionUniqueProcessIdadd_process_layerload_order_modulesr	   UnreadableValue
contextlibsuppressr   rA   BaseDllNamer@   r?   r   wintime_to_datetimeLoadTimeQuadPartNotApplicableValuerV   openclosepreferred_filenamer   HexrF   NotAvailableValueSizeOfImageImageFileNamecastrB   count)selfprocsr7   r   kusernt_major_versionnt_minor_versiondll_load_time_fieldprocproc_idproc_layer_nameentryrp   r?   DllLoadTimefile_outputrR   dllbasesize_of_images                      r2   
_generatorzDllList._generator{   s      8??L$*It @ 
 
 %dk(&;<	--L&+V-E
 
 u344u344/!3 
!;&6!&; 	  ?	 ?	D*G"4466O0022 ; ;,5,E,G,GGk()KLL A A"'"3">">"@"@K"'"3">">"@"@KA A A A A A A A A A A A A A A
 ' 
AB&0&D!N3' ' &= B B B&/&?&A&AB #,">"@"@K(;v& E"&,,%	'0g000 #/ # #K #:K" E#))+++&1&D<*.u}==GG!9 < < <'9;;GGG<B$0$4U5F$G$GMM!9 B B B$-$?$A$AMMMB ,*//$'+'9'='C#, 0  
  %####    W;	?	 ?	sH   ,3E++E/2E/9F"F=<F=+I"I*)I*.J"J-,J-c           
   #     K   | j         j        | j        d                  }|                     t          j                            | j         |j        |j                            D ]}|\  }}t          |d         t          j
                  s(d                    |d         |d         |d         |d         |d	         |d
                   }|t          j        j        |d         fV  d S )Nr   )r6   r:   symbol_tablerZ   z8DLL Load: Process {} {} Loaded {} ({}) Size {} Offset {}r   r!            r   )r6   rd   re   r   r   r*   list_processesr:   rg   
isinstancedatetimerC   r   TimeLinerTypeCREATED)r~   r   row_depthrow_datar   s         r2   generate_timelinezDllList.generate_timeline   s      %dk(&;<??M((!,#5 )  
 
 	N 	NC  #FHhqk8+<== JQQQKQKQKQKQKQK   	 7 ?!MMMMM)	N 	Nr4   c                    t           j                            | j                            dd                     }| j        j        | j        d                  }| j        d         rgt          j        	                    | j        |j
        |j        t          j                            | j        |j
        | j        d                             }n2t           j                            | j        |j
        |j        |          }t          j        dt           fdt"          fdt$          j        fd	t$          j        fd
t"          fdt"          fdt(          j        fdt"          fg|                     |                    S )Nr"   r   r%   )filter_func)r6   r:   r   r   PIDProcessBaseSizeNamePathrr   zFile output)r   )r   r*   create_pid_filterre   getr6   rd   r   r+   scan_processesr:   rg   create_offset_filterr   r	   TreeGridr.   strr   rx   r   r   )r~   r   r   r   s       r2   runzDllList.run   sL   m55dkooeT6R6RSS%dk(&;<;x  	M00!("M>>L%K) 	 1 	 	EE M00!,#5'	 1  E !C )*)*X./$	 OO%O((
 
 	
r4   )Nr5   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer3   r6   ContextInterfacer   objectsObjectInterfacer   pluginsFileHandlerInterfacer   rV   r   r   r    r4   r2   r   r      s       HH"+H"
j&>&S!T "
 "
 "
 ["
H  8 8#48 8 %5	8
 *,AB8 8 8 
*$9	:8 8 8 [8tO O ObN N N0#
 #
 #
 #
 #
r4   r   )#rn   r   loggingrD   typingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
   volatility3.framework.renderersr   r   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   volatility3.plugins.windowsr   r   r   	getLoggerr   rP   r   PluginInterfaceTimeLinerInterfacer   r   r4   r2   <module>r      sI          ' ' ' ' ' ' ' ' ' ' N N N N N N N N N N N N < < < < < < D D D D D D D D 2 2 2 2 2 2 ? ? ? ? ? ? ) ) ) ) ) ) < < < < < < < < < <		8	$	$r
 r
 r
 r
 r
j 0)2N r
 r
 r
 r
 r
r4   