
    [
#gv
                         d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ  G d dej                  j                        Zy)	    )Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscannerc            
           e Zd ZdZdZdZed        Zedej                  j                  dededeej                  j                     fd	       Zd
 Zd Zy)FileScanzDScans for file objects present in a particular windows memory image.)   r   r   )   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )r   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/filescan.pyget_requirementszFileScan.get_requirements   sG     **,()4
 **";+B+BI	
 		
    context
layer_namesymbol_tablereturnc              #      K   t         j                  j                  |ddg      }t         j                  j                  ||||      D ]  }|\  }}}|  yw)a  Scans for file objects using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of File objects as found from the `layer_name` layer based on File pool signatures
        s   Fils   FileN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r   r   r    constraintsresult_constraint
mem_object_headers	            r   
scan_fileszFileScan.scan_files    sb     $ "--AA:w/
 "--@@Z{
F 06,KW	
s   AAc              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        D ]H  }	 |j                  j                  }dt        j                  |j                  j                        |ff J y # t        j                  $ r Y aw xY ww)Nr   r   )r   modulesconfigr*   r   symbol_table_nameFileNameStringr   InvalidAddressExceptionr   Hexvoloffset)selfr   fileobj	file_names       r   
_generatorzFileScan._generator<   s     %%dkk(&;<LL&++V-E-E
G#,,33	 |''(:(:;YGHH

 55 s*   AB?B&42B?&B<9B?;B<<B?c                 z    t        j                  dt        j                  fdt        fg| j                               S )NOffsetName)r   TreeGridr   r2   strr8   )r5   s    r   runzFileScan.runI   s6    !!(()FC=9OO
 	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   ContextInterfacer=   r   objectsObjectInterfacer*   r8   r>    r   r   r   r      s    N"+H

 

 ##44  	
 
*$$44	5 6I
r   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   pluginsPluginInterfacer   rI   r   r   <module>rQ      s3   
  C C < 8 3@
z!!11 @
r   