
    Xfz
                     z    d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ  G d dej        j                  ZdS )	    )Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscannerc            
           e Zd ZdZdZed             Zedej        j	        de
de
deej        j                 fd            Zd	 Zd
 ZdS )FileScanzDScans for file objects present in a particular windows memory image.)   r   r   c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/filescan.pyget_requirementszFileScan.get_requirements   sR     *,()4  
 *";+BI  	
 		
    context
layer_namesymbol_tablereturnc              #      K   t           j                            |ddg          }t           j                            ||||          D ]}|\  }}}|V  dS )a  Scans for file objects using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of File objects as found from the `layer_name` layer based on File pool signatures
        s   Fils   FileN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r   r   r    constraintsresult_constraint
mem_object_headers	            r   
scan_fileszFileScan.scan_files   s~      $ "-AA:w/
 
 "-@@Z{
 
 	 	F 06,KW		 	r   c              #   0  K   | j         j        | j        d                  }|                     | j         |j        |j                  D ]O}	 |j        j        }n# t          j	        $ r Y !w xY wdt          j        |j        j                  ||j        ffV  Pd S )Nr   r   )r   modulesconfigr*   r   symbol_table_nameFileNameStringr   InvalidAddressExceptionr   HexvoloffsetSize)selfr   fileobj	file_names       r   
_generatorzFileScan._generator;   s      %dk(&;<L&+V-E
 
 	W 	WG#,3		5    |'(:;;YUVVVVV	W 	Ws   	AA('A(c                     t          j        dt          j        fdt          fdt
          fg|                                           S )NOffsetNamer5   )r   TreeGridr   r2   strintr9   )r6   s    r   runzFileScan.runH   s>    !()FC=63-HOO
 
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   r   ContextInterfacer>   r   objectsObjectInterfacer*   r9   r@    r   r   r   r      s        NN"+

 

 [

 #4  	
 
*$4	5   [6W W W
 
 
 
 
r   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   pluginsPluginInterfacer   rJ   r   r   <module>rR      s   
       C C C C C C C C C C < < < < < < 8 8 8 8 8 8 3 3 3 3 3 3?
 ?
 ?
 ?
 ?
z!1 ?
 ?
 ?
 ?
 ?
r   