
    Xf                         d dl mZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZmZ g dZ G d dej                  j                         Zy	)
    )IteratorListTuple)	renderers
interfaces)requirements)format_hints)ssdt
driverscan)ACPI_HAL
PnpManagerRAWWMIxWDMWin32kFs_Recc                       e Zd ZdZdZdZedeej                  j                     fd       Zdee   fdZdej                   fdZy)	DriverModulez9Determines if any loaded drivers were hidden by a rootkit)   r   r      r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionr   )r   ModuleRequirementPluginRequirementr
   SSDTr   
DriverScan)clss    d/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/drivermodule.pyget_requirementszDriverModule.get_requirements   sb     **,()4
 **DIIy **!**?*?
 	
    c              #   f  K   | j                   j                  | j                  d      }t        j                  j                  | j                   |j                  |j                        }t        j                  j                  | j                   |j                  |j                        D ]  }t        |j                  |j                              }|r*t        j                  j                  |      \  }}}|t        v }dt!        j"                  |j$                  j&                        ||||ff  yw)a  
        Attempt to match each driver's start code address to a known kernel module
        A common rootkit technique is to register drivers from modules that are hidden,
        which allows us to detect the disconnect between a malicious driver and its hidden module.
        r   r   N)contextmodulesconfigr
   r#   build_module_collection
layer_namesymbol_table_namer   r$   scan_driverslist'get_module_symbols_by_absolute_locationDriverStartget_names_for_driverKNOWN_DRIVERSr	   Hexvoloffset)	selfr   
collectiondrivermodule_symbolsdriver_nameservice_keyr   known_exceptions	            r&   
_generatorzDriverModule._generator$   s     %%dkk(&;<YY66LL&++V-E-E

 !++88LL&++V-E-E
 	F "BB6CUCUVN "
 ))>>vF	 #."> $(():):;'##	 	!	s   CD1A D1c                     t        j                  dt        j                  fdt        fdt
        fdt
        fdt
        fg| j                               S )NOffsetzKnown ExceptionzDriver NamezService KeyzAlternative Name)r   TreeGridr	   r6   boolstrr@   )r9   s    r&   runzDriverModule.runK   sT    !!<++,"D)$$#S) OO	
 		
r(   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer'   r   r   r@   r   rC   rF    r(   r&   r   r      s]    C"+H
j&>&>&S&S!T 
 
%HUO %N

Y'' 

r(   r   N)typingr   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.plugins.windowsr
   r   r5   pluginsPluginInterfacer   rP   r(   r&   <module>rX      s;    ) ( 7 < 8 8 QG
:%%55 G
r(   