
    Xf                         d dl mZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZmZ g dZ G d dej        j                  Zd	S )
    )IteratorListTuple)	renderers
interfaces)requirements)format_hints)ssdt
driverscan)ACPI_HAL
PnpManagerRAWWMIxWDMWin32kFs_Recc                       e Zd ZdZdZdZedeej	        j
                 fd            Zdee         fdZdej        fdZdS )	DriverModulez9Determines if any loaded drivers were hidden by a rootkit)   r   r      r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionr   )r   ModuleRequirementPluginRequirementr
   SSDTr   
DriverScan)clss    d/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/drivermodule.pyget_requirementszDriverModule.get_requirements   sr     *,()4  
 *DIy   *!**?  
 	
    c              #     K   | j         j        | j        d                  }t          j                            | j         |j        |j                  }t          j	        
                    | j         |j        |j                  D ]~}t          |                    |j                            }|sSt          j	                            |          \  }}}|t          v }dt!          j        |j        j                  ||||ffV  dS )a  
        Attempt to match each driver's start code address to a known kernel module
        A common rootkit technique is to register drivers from modules that are hidden,
        which allows us to detect the disconnect between a malicious driver and its hidden module.
        r   r   N)contextmodulesconfigr
   r#   build_module_collection
layer_namesymbol_table_namer   r$   scan_driverslist'get_module_symbols_by_absolute_locationDriverStartget_names_for_driverKNOWN_DRIVERSr	   Hexvoloffset)	selfr   
collectiondrivermodule_symbolsdriver_nameservice_keyr   known_exceptions	            r&   
_generatorzDriverModule._generator$   s      %dk(&;<Y66L&+V-E
 

 !+88L&+V-E
 
 	 	F "BB6CUVV N " 
 )>>vFF	 #."> $():;;'##	 	 	 	!	 	r(   c                     t          j        dt          j        fdt          fdt
          fdt
          fdt
          fg|                                           S )NOffsetzKnown ExceptionzDriver NamezService KeyzAlternative Name)r   TreeGridr	   r6   boolstrr@   )r9   s    r&   runzDriverModule.runK   sV    !<+,"D)$$#S) OO	
 	
 		
r(   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer'   r   r   r@   r   rC   rF    r(   r&   r   r      s        CC"+H
j&>&S!T 
 
 
 [
%HUO % % % %N

Y' 

 

 

 

 

 

r(   r   N)typingr   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.plugins.windowsr
   r   r5   pluginsPluginInterfacer   rP   r(   r&   <module>rX      s    ) ( ( ( ( ( ( ( ( ( 7 7 7 7 7 7 7 7 < < < < < < 8 8 8 8 8 8 8 8 8 8 8 8 8 8 QPPG
 G
 G
 G
 G
:%5 G
 G
 G
 G
 G
r(   