
    Xf                     z    d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ  G d dej        j                  ZdS )	    )Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscannerc            
           e Zd ZdZdZdZed             Zedej	        j
        dededeej        j                 fd	            Zed
             Zd Zd ZdS )
DriverScanz?Scans for drivers present in a particular windows memory image.)   r   r      r   r   c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/driverscan.pyget_requirementszDriverScan.get_requirements   sR     *,()4  
 *";+BI  	
 		
    context
layer_namesymbol_tablereturnc              #      K   t           j                            |ddg          }t           j                            ||||          D ]}|\  }}}|V  dS )a  Scans for drivers using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures
        s   Dris   DrivN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r   r    r!   constraintsresult_constraint
mem_object_headers	            r   scan_driverszDriverScan.scan_drivers    s~      $ "-AA:w/
 
 "-@@Z{
 
 	 	F 06,KW		 	r   c                 x   	 |                                 }n/# t          t          j        f$ r t	          j                    }Y nw xY w	 |j        j        j        }n(# t          j        $ r t	          j                    }Y nw xY w	 |j	        j        }n(# t          j        $ r t	          j                    }Y nw xY w|||fS )z
        Convenience method for getting the commonly used
        names associated with a driver

        Args:
            driver: A Eriver object

        Returns:
            A tuple of strings of (driver name, service key, driver alt. name)
        )
get_driver_name
ValueErrorr   InvalidAddressExceptionr   NotApplicableValueDriverExtensionServiceKeyNameString
DriverName)r   driverdriver_nameservice_keyr   s        r   get_names_for_driverzDriverScan.get_names_for_driver<   s    	9 0022KKJ>? 	9 	9 	9#688KKK	9	9 0?FKK1 	9 	9 	9#688KKK	9	2$+DD1 	2 	2 	2/11DDD	2 K--s3    )AAA "A>=A>B "B43B4c              #   t  K   | j         j        | j        d                  }|                     | j         |j        |j                  D ]q}|                     |          \  }}}dt          j        |j	        j
                  t          j        |j                  t          j        |j                  |||ffV  rd S )Nr   r   )r   modulesconfigr+   r    symbol_table_namer8   r   HexvoloffsetDriverStart
DriverSize)selfr   r5   r6   r7   r   s         r   
_generatorzDriverScan._generatorY   s      %dk(&;<''L&+V-E
 
 	 	F .2-F-Fv-N-N*Kd  $VZ%677 $V%788 $V%677
 
 
 
 
	 	r   c           	          t          j        dt          j        fdt          j        fdt          j        fdt          fdt          fdt          fg|                                           S )NOffsetStartSizezService KeyzDriver NameName)r   TreeGridr   r=   strrC   )rB   s    r   runzDriverScan.runm   sc    !<+,,*+)*$$ OO

 

 
	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   ContextInterfacerJ   r   objectsObjectInterfacer+   r8   rC   rK    r   r   r   r      s        II"+H

 

 [

 #4  	
 
*$4	5   [6 . . [.8  (
 
 
 
 
r   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   pluginsPluginInterfacer   rV   r   r   <module>r^      s   
       C C C C C C C C C C < < < < < < 8 8 8 8 8 8 3 3 3 3 3 3k
 k
 k
 k
 k
#3 k
 k
 k
 k
 k
r   