
    [
#g                         d dl mZ d dl mZmZmZ d dlmZ d dlmZ d dl	m
Z
mZ g dZ G d dej                  j                        Zy	)
    )	constants)	renderers
exceptions
interfaces)requirements)format_hints)ssdt
driverscan)IRP_MJ_CREATEIRP_MJ_CREATE_NAMED_PIPEIRP_MJ_CLOSEIRP_MJ_READIRP_MJ_WRITEIRP_MJ_QUERY_INFORMATIONIRP_MJ_SET_INFORMATIONIRP_MJ_QUERY_EAIRP_MJ_SET_EAIRP_MJ_FLUSH_BUFFERSIRP_MJ_QUERY_VOLUME_INFORMATIONIRP_MJ_SET_VOLUME_INFORMATIONIRP_MJ_DIRECTORY_CONTROLIRP_MJ_FILE_SYSTEM_CONTROLIRP_MJ_DEVICE_CONTROLIRP_MJ_INTERNAL_DEVICE_CONTROLIRP_MJ_SHUTDOWNIRP_MJ_LOCK_CONTROLIRP_MJ_CLEANUPIRP_MJ_CREATE_MAILSLOTIRP_MJ_QUERY_SECURITYIRP_MJ_SET_SECURITYIRP_MJ_POWERIRP_MJ_SYSTEM_CONTROLIRP_MJ_DEVICE_CHANGEIRP_MJ_QUERY_QUOTAIRP_MJ_SET_QUOTA
IRP_MJ_PNPc                   4    e Zd ZdZdZdZed        Zd Zd Z	y)	DriverIrpz;List IRPs for drivers in a particular windows memory image.)   r   r      r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r*   )r0   pluginversionr
   )r   ModuleRequirementPluginRequirementr	   SSDTr
   
DriverScan)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/driverirp.pyget_requirementszDriverIrp.get_requirements1   sb     **,()4
 **DIIy **!**?*?
 	
    c              #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   |j                  |j                        }t        j                  j                  | j                   |j                  |j                        D ]  }	 |j                         }t#        |j$                        D ]t  \  }}|j'                  |      }d}|D ]  \  }	}
d}d}|
D ]q  }d}dt)        j*                  |j,                  j.                        |t0        |   t)        j*                  |      |	|j3                  t4        j6                        d   ff s |rdt)        j*                  |j,                  j.                        |t0        |   t)        j*                  |      |	t        j8                         ff  |rdt)        j*                  |j,                  j.                        |t0        |   t)        j*                  |      t        j8                         t        j8                         ff w  y # t        t        j                  f$ r t        j                          }Y w xY ww)Nr-   FTr   r+   )contextmodulesconfigr	   r7   build_module_collection
layer_namesymbol_table_namer
   r8   scan_driversget_driver_name
ValueErrorr   InvalidAddressExceptionr   NotApplicableValue	enumerateMajorFunction'get_module_symbols_by_absolute_locationr   HexvoloffsetMAJOR_FUNCTIONSsplitr   BANGNotAvailableValue)selfr-   
collectiondriverdriver_nameiaddressmodule_symbolsmodule_foundmodule_namesymbol_generatorsymbols_foundsymbols                r:   
_generatorzDriverIrp._generatorA   s0    %%dkk(&;<YY66LL&++V-E-E

 !++88LL&++V-E-E
F=$446 ((<(<=
7!+!S!S"  %5C1K!1#'L$)M"2(, , 0 01B1B C + / 2 , 0 0 9 + &Y^^ <Q ?
 
 #3 ) , 0 01B1B C + / 2 , 0 0 9 + ) ; ; =
 
' 6D> $(,,VZZ->->?'+A.(,,W5%779%779
 
O >

 
 B BC ='::<=s9   B)J,I<B3J0A#JA8J-I>:J=I>>Jc           	          t        j                  dt        j                  fdt        fdt        fdt        j                  fdt        fdt        fg| j                               S )NOffsetzDriver NameIRPAddressModuleSymbol)r   TreeGridr   rL   strr_   )rS   s    r:   runzDriverIrp.run   s_    !!<++,$L,,-33 OO

 
	
r<   N)
__name__
__module____qualname____doc___required_framework_version_versionclassmethodr;   r_   rh    r<   r:   r(   r(   +   s.    E"+H
 
@D
r<   r(   N)volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   r
   rO   pluginsPluginInterfacer(   rp   r<   r:   <module>rw      s;   
 , C C < 8 8@c

""22 c
r<   