
    Xf                         d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ  G d dej                  j                        Zy)	    )Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscannerc            
           e Zd ZdZdZdZed        Zedej                  j                  dededeej                  j                     fd	       Zed
        Zd Zd Zy)
DriverScanz?Scans for drivers present in a particular windows memory image.)   r   r      r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/driverscan.pyget_requirementszDriverScan.get_requirements   sG     **,()4
 **";+B+BI	
 		
    context
layer_namesymbol_tablereturnc              #      K   t         j                  j                  |ddg      }t         j                  j                  ||||      D ]  }|\  }}}|  yw)a  Scans for drivers using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures
        s   Dris   DrivN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r   r    r!   constraintsresult_constraint
mem_object_headers	            r   scan_driverszDriverScan.scan_drivers    sg     $ "--AA:w/
 "--@@Z{
 	F 06,KW		s   AAc                    	 |j                         }	 |j                  j                  j                  }	 |j                  j                  }|||fS # t        t        j                  f$ r t	        j
                         }Y lw xY w# t        j                  $ r t	        j
                         }Y xw xY w# t        j                  $ r t	        j
                         }Y w xY w)z
        Convenience method for getting the commonly used
        names associated with a driver

        Args:
            driver: A Eriver object

        Returns:
            A tuple of strings of (driver name, service key, driver alt. name)
        )
get_driver_name
ValueErrorr   InvalidAddressExceptionr   NotApplicableValueDriverExtensionServiceKeyNameString
DriverName)r   driverdriver_nameservice_keyr   s        r   get_names_for_driverzDriverScan.get_names_for_driver<   s    	9 002K	9 00??FFK	2$$++D K-- J>>? 	9#668K	9
 11 	9#668K	9
 11 	2//1D	2s3   A  B B/ -A?>A?'B,+B,/'CCc              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        D ]  }| j                  |      \  }}}dt        j                  |j                  j                        t        j                  |j                        t        j                  |j                        |||ff  y w)Nr   r   )r   modulesconfigr+   r    symbol_table_namer8   r   HexvoloffsetDriverStart
DriverSize)selfr   r5   r6   r7   r   s         r   
_generatorzDriverScan._generatorY   s     %%dkk(&;<''LL&++V-E-E
 	F .2-F-Fv-N*Kd  $$VZZ%6%67 $$V%7%78 $$V%6%67
 
	s   C C"c           	          t        j                  dt        j                  fdt        j                  fdt        j                  fdt        fdt        fdt        fg| j                               S )NOffsetStartSizezService KeyzDriver NameName)r   TreeGridr   r=   strrC   )rB   s    r   runzDriverScan.runm   sg    !!<++,,**+))*$$ OO

 
	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   ContextInterfacerJ   r   objectsObjectInterfacer+   r8   rC   rK    r   r   r   r      s    I"+H

 

 ##44  	
 
*$$44	5 6 . .8(
r   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   pluginsPluginInterfacer   rV   r   r   <module>r^      s3   
  C C < 8 3k
##33 k
r   