
    [
#g&                         d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZmZmZ  ej:                  e      Z G d
 dej@                  jB                  ejD                        Z#y)    N)ListOptionalType)	constants
exceptions
interfaces	renderers)requirements)
conversionformat_hints)intermed)pe)	timeliner)infopslistpsscanpedumpc                   n    e Zd ZdZdZdZedeej                  j                     fd       Zd Zd Zd Zy	)
DllListz>Lists the loaded modules in a particular windows memory image.   r   r   )   r   r   returnc                    t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      t        j                  dt        j                  d      t        j                  dt        dd      t        j                  ddd      t        j                  ddd      t        j                  ddd      t        j                  dddd      t        j                  dddd      t        j                  dt        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   	componentversionr   )   r#   r   r   )r#   r   r   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optionaloffsetz,Process offset in the physical address space)r   r   r&   r   z1Specify a regular expression to match dll name(s)basez0Specify a base virtual address in process memoryignore-casezCSpecify case insensitivity for the regular expression name matchingF)r   r   defaultr&   dumpzExtract listed DLLsr   )r
   ModuleRequirementVersionRequirementr   PsListr   PsScanr   InfoListRequirementintIntRequirementStringRequirementBooleanRequirementr   PEDump)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/dlllist.pyget_requirementszDllList.get_requirements   s6    **,()4
 ++	 ++	 ++tyy) (( W	 ''J
 **O
 ''N
 ++"a	 ++1	 ++	a3
 3	
    c              #     K   t         j                  j                  | j                  | j                  ddt
        j                        }| j                  j                  | j                  d      }t        j                  j                  | j                  |j                  |j                        }t        |j                        }t        |j                         }|dkD  xs |dk(  xr |dk\  }|D ]  }|j"                  }	|j%                         }
|j'                         D ]y  }t)        j*                         x}}t-        j.                  t0        j2                        5  |j4                  j7                         }|j8                  j7                         }d d d        | j                  d   r	 | j                  d   rt:        j<                  nd	}t;        j>                  | j                  d   |      }tG        |t(        j*                        stG        |t(        j*                        r|jI                  |      s|jI                  |      s(| j                  d   r| j                  d   |jJ                  k7  rU|r+	 tM        jN                  |jP                  jR                        }nt)        jT                         }d}| j                  d   rAtV        jX                  j[                  | j                  ||| j\                  |
d|	 d      }|sd}	 t_        j`                  |jJ                        }	 t_        j`                  |jd                        }d	|j"                  |jf                  ji                  d|jf                  jj                  jl                  d      ||||||ff |  y # 1 sw Y   xY w# t:        j@                  $ r( tB        jE                  d
| j                  d          Y   y w xY w# t0        j2                  $ r t)        j*                         }Y `w xY w# t0        j2                  $ r t)        jb                         }Y w xY w# t0        j2                  $ r t)        jb                         }Y *w xY ww)Nwindowsr   )class_typesr      r#   r   r)   r   z$Error parsing regular expression: %sr(   Disabledr+   zpid..)prefixzError outputting filestringreplace)
max_lengtherrors)7r   IntermediateSymbolTablecreatecontextconfig_pathr   r=   modulesconfigr   r0   get_kuser_structure
layer_namesymbol_table_namer2   NtMajorVersionNtMinorVersionUniqueProcessIdadd_process_layerload_order_modulesr	   UnreadableValue
contextlibsuppressr   InvalidAddressExceptionBaseDllName
get_stringFullDllNamereIcompileerrorvollogdebug
isinstancesearchDllBaser   wintime_to_datetimeLoadTimeQuadPartNotApplicableValuer   r6   dump_ldr_entryopenr   HexNotAvailableValueSizeOfImageImageFileNamecastvolcount)selfprocspe_table_namer   kusernt_major_versionnt_minor_versiondll_load_time_fieldprocproc_idproc_layer_nameentryrX   rZ   flagsmod_reDllLoadTimefile_outputdllbasesize_of_images                       r8   
_generatorzDllList._generatorS   s     88??LL$**It @ 
 %%dkk(&;<		--LL&++V-E-E
 u334u334/!3 
!;&6!&; 	 D**G"446O002,5,E,E,GGk(()K)KL A"'"3"3">">"@K"'"3"3">">"@KA ;;v&$(,M(B!#DKK,?!G "+y/H/HIZ#Y%>%>N ! "==5fmm#? !;;v&4;;v+>%--+O&B&0&D&D!NN33' #,">">"@K(;;v&"(--">">%		'!%gYa0 #? #K '&=<*..u}}=GB$0$4$4U5F5F$GM
 ,,**//$'+'9'9'='='C'C#, 0 
  %#### K 3	 A A 88 $BDKKPVDW  $	$8 &== B&/&?&?&AB* "99 <'99;G<
 "99 B$-$?$?$AMBs   EQ35NQ3'AN++B	Q35)O)A'Q3P&QAQ3N(#Q3+6O&!Q3%O&&Q3)'PQ3PQ3'Q>Q3QQ3'Q0,Q3/Q00Q3c           
   #     K   | j                   j                  | j                  d      }| j                  t        j
                  j                  | j                   |j                  |j                              D ]o  }|\  }}t        |d   t        j                        s&dj                  |d   |d   |d   |d   |d	   |d
         }|t        j                  j                  |d   f q y w)Nr   )rH   rM   symbol_tabler>   z8DLL Load: Process {} {} Loaded {} ({}) Size {} Offset {}r   r#         r   r   )rH   rJ   rK   r   r   r.   list_processesrM   rN   ra   datetimeformatr   TimeLinerTypeCREATED)rq   r   row_depthrow_datar   s         r8   generate_timelinezDllList.generate_timeline   s     %%dkk(&;<??MM((!,,#55 ) 
C  #FHhqk8+<+<=JQQQKQKQKQKQKQK  	 7 7 ? ?!MM)
s   C)C+c                 \   t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }| j                  d   rt        j                  j                  | j
                  |j                  |j                  t        j                  j                  | j
                  |j                  | j                  d               }nAt         j                  j                  | j
                  |j                  |j                  |      }t        j                  dt         fdt"        fdt$        j&                  fd	t$        j&                  fd
t"        fdt"        fdt(        j(                  fdt"        fg| j+                  |            S )Nr$   r   r'   )filter_func)rH   rM   r   r   PIDProcessBaseSizeNamePathre   zFile output)rr   )r   r.   create_pid_filterrK   getrH   rJ   r   r/   scan_processesrM   rN   create_offset_filterr   r	   TreeGridr2   strr   rj   r   r   )rq   r   r   rr   s       r8   runzDllList.run   s^   mm55dkkooeT6RS%%dkk(&;<;;x MM00!!(("MM>>LL%%KK)	 1 	E MM00!,,#55'	 1 E !!C ))*))*X../$	 OO%O(
 	
r:   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer9   r   r   r    r:   r8   r   r      sM    H"+H5
j&>&>&S&S!T 5
 5
niVN0#
r:   r   )$rU   r   loggingr[   typingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
   volatility3.framework.renderersr   r   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   volatility3.plugins.windowsr   r   r   r   	getLoggerr   r_   pluginsPluginInterfaceTimeLinerInterfacer   r   r:   r8   <module>r      sh       	 ' ' N N < D 2 ? ) D D			8	$d
j  00)2N2N d
r:   