
    *1f}                         d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ  e j        e          Z G d d	ej        j                  ZdS )
    N)intermed)	renderers
interfaces
exceptions	constants)requirements)pslist)format_hints)pec                   8    e Zd ZdZdZed             Zd Zd ZdS )IATzfExtract Import Address Table to list API (functions) used by a program contained in external libraries)      r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          d
d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )r   r   r   )r   	componentversionpidz8Process ID to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementVersionRequirementr	   PsListListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/iat.pyget_requirementszIAT.get_requirements   st     *,()4  
 +	   ( V	  
 	
    c              #     K   | j         j        | j        d                  }|D ]}	 |j        }|                                }| j                             |j        t          j        z   dz   ||j	                  }|t          d          t          j                            | j         | j        ddt          j                  }t#          j                    }| j                             |t          j        z   dz   |j        |	          }	|	                                D ]/\  }
}|                    |
           |                    |           0t/          j        |                                d
          }|                    t.          j        d         g           t9          |d          r|j        D ]}|j        }|r|                                }nt@          j!        }d
}|j"        j#        }|sd}|j$        D ]}|j%        }|r|j%                                        }ntA          j!                    }|j&        j'        |j(        z   }|st@          j!        }d||j)        *                    d|j)        j+        j,        d          |||t[          j.        |          ffV  x# t^          j0        $ rD}tb          2                    d3                    ||j4        |j5                             Y d }~d }~ww xY wd S )Nr   _PEB)
layer_nameoffsetzadd_process_layer failedwindowsr   )class_types_IMAGE_DOS_HEADER)r(   r'   T)data	fast_loadIMAGE_DIRECTORY_ENTRY_IMPORTDIRECTORY_ENTRY_IMPORTFr   stringreplace)
max_lengtherrorsz*Process {}: invalid address {} in layer {})6contextmodulesconfigUniqueProcessIdadd_process_layerobjectsymbol_table_namer   BANGPeb	TypeErrorr   IntermediateSymbolTablecreateconfig_pathr   r*   ioBytesIOImageBaseAddressreconstructseekwritepefilePEgetvalueparse_data_directoriesDIRECTORY_ENTRYhasattrr/   dlldecoder   NotAvailableValuestructTimeDateStampimportsr   OPTIONAL_HEADER	ImageBaseaddressImageFileNamecastvolcountr
   Hexr   InvalidAddressExceptionvollogdebugformatinvalid_addressr'   )selfprocsr   procproc_idproc_layer_namepebpe_table_namepe_data
dos_headerr(   r,   pe_objentry	dll_entryboundtime_date_stampimpimport_namefunction_addressexcps                        r"   
_generatorzIAT._generator'   s_     %dk(&;< T	 T	DS."&"8"8":":l)),y~=F.8 *   #*#$>??? ( @ G GL$ " !H ! ! *,,!\00!IN25HH/. 1  
 %/$:$:$<$< ( (LFDLL(((MM$''''(8(8(:(:dKKK--+,JKL   6#;<< )!'!> ( ($)I	$ D(1(8(8(:(:II(1(CI $*/,*D. *$)E $)=  C*-(K* L.1hoo.?.?.7.I.K.K & 6 @3; N - $4 O3<3N 0 !"$+$($6$;$;(0373E3I3O/8 %< %& %&
 %.$)$/$0$45E$F$F!"#    6 5   @GG!5t   
 ]T	 T	s   I2JK-)9K((K-c                    | j         j        | j        d                  }t          j        dt
          fdt          fdt          fdt          fdt          fdt          j	        fg| 
                    t          j                            | j         |j        |j        t          j                            | j                            dd                     	                              S )
Nr   PIDNameLibraryBoundFunctionAddressr   )r4   r'   symbol_tablefilter_func)r4   r5   r6   r   TreeGridr    strboolr
   rZ   rr   r	   r   list_processesr'   r:   create_pid_filterget)r`   r   s     r"   runzIAT.run   s    %dk(&;<!C $S!L,- OO,, L%0!'!9 & ? ?t44! !	 -  	 	
 
 	
r$   N)	__name__
__module____qualname____doc___required_framework_versionclassmethodr#   rr   r    r$   r"   r   r      s[        pp"+
 
 [
$W W Wr
 
 
 
 
r$   r   )loggingrA   rG   volatility3.framework.symbolsr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.plugins.windowsr	   volatility3.framework.renderersr
   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr   r\   pluginsPluginInterfacer   r   r$   r"   <module>r      s                2 2 2 2 2 2 N N N N N N N N N N N N < < < < < < . . . . . . 8 8 8 8 8 8 ? ? ? ? ? ?		8	$	$G
 G
 G
 G
 G
*

, G
 G
 G
 G
 G
r$   