
    *1f}                         d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ  e j$                  e      Z G d d	ej*                  j,                        Zy)
    N)intermed)	renderers
interfaces
exceptions	constants)requirements)pslist)format_hints)pec                   0    e Zd ZdZdZed        Zd Zd Zy)IATzfExtract Import Address Table to list API (functions) used by a program contained in external libraries)      r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        d
d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )r   r   r   )r   	componentversionpidz8Process ID to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementVersionRequirementr	   PsListListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/iat.pyget_requirementszIAT.get_requirements   sa     **,()4
 ++	 (( V	
 	
    c              #     K   | j                   j                  | j                  d      }|D ]  }	 |j                  }|j	                         }| j                   j                  |j                  t        j                  z   dz   ||j                        }|t        d      t        j                  j                  | j                   | j                  ddt        j                         }t#        j$                         }| j                   j                  |t        j                  z   dz   |j&                  |	      }	|	j)                         D ]'  \  }
}|j+                  |
       |j-                  |       ) t/        j0                  |j3                         d
      }|j5                  t.        j6                  d   g       t9        |d      r:|j:                  D ]*  }|j<                  }|r|j?                         }nt@        jB                  }d
}|jD                  jF                  }|sd}|jH                  D ]  }|jJ                  }|r|jJ                  j?                         }ntA        jB                         }|jL                  jN                  |jP                  z   }|st@        jB                  }d||jR                  jU                  d|jR                  jV                  jX                  d      |||t[        j\                  |      ff  -  y # t^        j`                  $ rE}tb        je                  djg                  |jh                  |jj                               Y d }~*d }~ww xY ww)Nr   _PEB)
layer_nameoffsetzadd_process_layer failedwindowsr   )class_types_IMAGE_DOS_HEADER)r(   r'   T)data	fast_loadIMAGE_DIRECTORY_ENTRY_IMPORTDIRECTORY_ENTRY_IMPORTFr   stringreplace)
max_lengtherrorsz*Process {}: invalid address {} in layer {})6contextmodulesconfigUniqueProcessIdadd_process_layerobjectsymbol_table_namer   BANGPeb	TypeErrorr   IntermediateSymbolTablecreateconfig_pathr   r*   ioBytesIOImageBaseAddressreconstructseekwritepefilePEgetvalueparse_data_directoriesDIRECTORY_ENTRYhasattrr/   dlldecoder   NotAvailableValuestructTimeDateStampimportsr   OPTIONAL_HEADER	ImageBaseaddressImageFileNamecastvolcountr
   Hexr   InvalidAddressExceptionvollogdebugformatinvalid_addressr'   )selfprocsr   procproc_idproc_layer_namepebpe_table_namepe_data
dos_headerr(   r,   pe_objentry	dll_entryboundtime_date_stampimpimport_namefunction_addressexcps                        r"   
_generatorzIAT._generator'   s    %%dkk(&;< T	DS.."&"8"8":ll)),,y~~=F.88 *  #*#$>?? ( @ @ G GLL$$ " !H ! **,!\\00!INN25HH//. 1 
 %/$:$:$< (LFDLL(MM$'(  (8(8(:dK--++,JKL 6#;<!'!>!> ($)II	$(1(8(8(:I(1(C(CI $*/,,*D*D.$)E $)== C*-((K*.1hhoo.?.7.I.I.K & 6 6 @ @3;; N - $43<3N3N 0 !"$+$($6$6$;$;(0373E3E3I3I3O3O/8 %< %&
 %.$)$/$0$4$45E$F!"# (KT	\ 55 @GG!5!5t
 s/   -MKL>MM:MMMMc                    | j                   j                  | j                  d      }t        j                  dt
        fdt        fdt        fdt        fdt        fdt        j                  fg| j                  t        j                  j                  | j                   |j                  |j                  t        j                  j!                  | j                  j#                  dd             	                  S )
Nr   PIDNameLibraryBoundFunctionAddressr   )r4   r'   symbol_tablefilter_func)r4   r5   r6   r   TreeGridr    strboolr
   rZ   rr   r	   r   list_processesr'   r:   create_pid_filterget)r`   r   s     r"   runzIAT.run   s    %%dkk(&;<!!C $S!L,,- OO,, LL%00!'!9!9 & ? ?t4!	 - 	
 	
r$   N)	__name__
__module____qualname____doc___required_framework_versionclassmethodr#   rr   r    r$   r"   r   r      s)    p"+
 
$Wr
r$   r   )loggingrA   rG   volatility3.framework.symbolsr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.plugins.windowsr	   volatility3.framework.renderersr
   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr   r\   pluginsPluginInterfacer   r   r$   r"   <module>r      sN      2 N N < . 8 ?			8	$G
*


,
, G
r$   