
    *1f                         d dl mZ d dl mZmZmZ d dlmZ d dlmZ d dl	m
Z
mZ g dZ G d dej        j                  Zd	S )
    )	constants)	renderers
exceptions
interfaces)requirements)format_hints)ssdt
driverscan)IRP_MJ_CREATEIRP_MJ_CREATE_NAMED_PIPEIRP_MJ_CLOSEIRP_MJ_READIRP_MJ_WRITEIRP_MJ_QUERY_INFORMATIONIRP_MJ_SET_INFORMATIONIRP_MJ_QUERY_EAIRP_MJ_SET_EAIRP_MJ_FLUSH_BUFFERSIRP_MJ_QUERY_VOLUME_INFORMATIONIRP_MJ_SET_VOLUME_INFORMATIONIRP_MJ_DIRECTORY_CONTROLIRP_MJ_FILE_SYSTEM_CONTROLIRP_MJ_DEVICE_CONTROLIRP_MJ_INTERNAL_DEVICE_CONTROLIRP_MJ_SHUTDOWNIRP_MJ_LOCK_CONTROLIRP_MJ_CLEANUPIRP_MJ_CREATE_MAILSLOTIRP_MJ_QUERY_SECURITYIRP_MJ_SET_SECURITYIRP_MJ_POWERIRP_MJ_SYSTEM_CONTROLIRP_MJ_DEVICE_CHANGEIRP_MJ_QUERY_QUOTAIRP_MJ_SET_QUOTA
IRP_MJ_PNPc                   8    e Zd ZdZdZed             Zd Zd ZdS )	DriverIrpz;List IRPs for drivers in a particular windows memory image.)   r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )   r   r   )r.   pluginversionr
   )r   ModuleRequirementPluginRequirementr	   SSDTr
   
DriverScan)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/driverirp.pyget_requirementszDriverIrp.get_requirements0   sr     *,()4  
 *DIy   *!**?  
 	
    c              #   v  K   | j         j        | j        d                  }t          j                            | j         |j        |j                  }t          j	        
                    | j         |j        |j                  D ]}	 |                                }n/# t          t          j        f$ r t          j                    }Y nw xY wt#          |j                  D ]Y\  }}|                    |          }d}|D ]\  }	}
d}d}|
D ]l}d}dt)          j        |j        j                  |t0          |         t)          j        |          |	|                    t4          j                  d         ffV  m|sVdt)          j        |j        j                  |t0          |         t)          j        |          |	t          j                    ffV  |sgdt)          j        |j        j                  |t0          |         t)          j        |          t          j                    t          j                    ffV  [d S )Nr+   FTr   r1   )contextmodulesconfigr	   r6   build_module_collection
layer_namesymbol_table_namer
   r7   scan_driversget_driver_name
ValueErrorr   InvalidAddressExceptionr   NotApplicableValue	enumerateMajorFunction'get_module_symbols_by_absolute_locationr   HexvoloffsetMAJOR_FUNCTIONSsplitr   BANGNotAvailableValue)selfr+   
collectiondriverdriver_nameiaddressmodule_symbolsmodule_foundmodule_namesymbol_generatorsymbols_foundsymbols                r9   
_generatorzDriverIrp._generator@   sw     %dk(&;<Y66L&+V-E
 

 !+88L&+V-E
 
 9	 9	F=$4466
 BC = = =':<<= ((<== 1 1
7!+!S!S" "  %5C  1K!1#'L$)M"2  (, , 01B C C + / 2 , 0 9 9 + &Y^ < <Q ?
 
 
 
 
 )  , 01B C C + / 2 , 0 9 9 + ) ; = =
 
 
 
 $ (,VZ->??'+A.(,W55%799%799
 
 
 
O19	 9	s   B)CCc           	          t          j        dt          j        fdt          fdt          fdt          j        fdt          fdt          fg|                                           S )NOffsetzDriver NameIRPAddressModuleSymbol)r   TreeGridr   rK   strr^   )rR   s    r9   runzDriverIrp.run   s^    !<+,$L,-33 OO

 

 
	
r;   N)	__name__
__module____qualname____doc___required_framework_versionclassmethodr:   r^   rg    r;   r9   r(   r(   +   s[        EE"+
 
 [
@ @ @D
 
 
 
 
r;   r(   N)volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   r
   rN   pluginsPluginInterfacer(   rn   r;   r9   <module>ru      s   
 , + + + + + C C C C C C C C C C < < < < < < 8 8 8 8 8 8 8 8 8 8 8 8 8 8  @b
 b
 b
 b
 b

"2 b
 b
 b
 b
 b
r;   