
    XfU&                         d dl Z d dlmZmZmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ  G d	 d
ej                  ZdS )    N)ListTupleIterable)	constants
interfaceslayerssymbols)requirements)plugins)TreeGrid)intermed)
extensionsc                   N   e Zd ZdZdZdZedeej	        j
                 fd            Ze	 ddej        j        ded	edeeeej        j        f                  fd
            Zedej        j        dedefd            Zedej        j        dedededej        j        f
d            Zedej        j        dededej        j        fd            Zedej        j        dededej        j        fd            Zedej        j        dededej        j        fd            Zd Zd ZdS )Infoz=Show OS & kernel details of the memory sample being analyzed.)   r   r   )   r   r   returnc                 6    t          j        ddddg          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r
   ModuleRequirement)clss    \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/info.pyget_requirementszInfo.get_requirements   s1     *,()4  
 	
    r   context
layer_nameindexc              #      K   |j         |         }||fV  	 |j        D ]8}|                     |||dz             D ]\  }}||j         |j                 fV  9dS # t          $ r Y dS w xY w)aS  List the dependencies of a given layer.

        Args:
            context: The context to retrieve required layers from
            layer_name: the name of the starting layer
            index: the index/order of the layer

        Returns:
            An iterable containing the levels and layer objects for all dependent layers
        r   N)r   dependenciesget_dependsr   AttributeError)r   r    r!   r"   layerdependsjdeps           r   r%   zInfo.get_depends    s      " z*Ul	 - 6 6!oogw	JJ 6 6FAsW^CH55555566 6  	 	 	DD	s   A A 
A'&A'symbol_tablec                     |j         |         }t          |t           j        j                  st	          d          |j        d         }|                    |||          }|S )z=Returns the kernel module based on the layer and symbol_table#Virtual Layer is not an intel layerkernel_virtual_offset)r!   offset)r   
isinstanceintelIntel	TypeErrorconfigmodule)r   r    r!   r+   virtual_layerkvontkrnlmps          r   get_kernel_modulezInfo.get_kernel_module;   sa      z2-);<< 	CABBB"#:;>>,:c>RRr   config_pathc                    |                      |||          }|j        |         j        }|                    d          j        }t
          j                            |t          j	        
                    |d          dd|t          j        j                  }|                    |t          j        z   dz   |j        |z   |          }	|	S )z4Returns the KDDEBUGGER_DATA64 structure for a kernelKdDebuggerDataBlockkdbgwindows)native_typesclass_types_KDDEBUGGER_DATA64r/   r!   )r9   symbol_spacenatives
get_symboladdressr   IntermediateSymbolTablecreater   configuration	path_joinr   r=   r@   objectr   BANGr/   )
r   r    r:   r!   r+   r8   r?   kdbg_offsetkdbg_table_namer=   s
             r   get_kdbg_structurezInfo.get_kdbg_structureL   s     ((*lKK+L9A))*?@@H":AA$..{FCC%"3 B 
 
 ~~in,/CC?[0!  
 
 r   c                     |j         |         }t          |t           j        j                  st	          d          |                     |||          }|j        dk    rd}nd}|                    d||d          }|S )z5Returns the _KUSER_SHARED_DATA structure for a kernelr-       l      l        ^ _KUSER_SHARED_DATAT)object_typer!   r/   absolute)r   r0   r1   r2   r3   r9   bits_per_registerrK   )r   r    r!   r+   r6   r8   
kuser_addrkusers           r   get_kuser_structurezInfo.get_kuser_structurel   s      z2-);<< 	CABBB((*lKK *b00#JJ+J,!	   
 
 r   c                     |                      |||          }|                    d          j        }|                    d||          }|S )z4Returns the KdVersionBlock information from a kernelKdVersionBlock_DBGKD_GET_VERSION64rS   r!   r/   )r9   rE   rF   rK   )r   r    r!   r+   r8   vers_offsetverss          r   get_version_structurezInfo.get_version_structure   sZ     ((*lKK))*:;;C.!  
 
 r   c                    |j         |         }t          |t           j        j                  st	          d          |j        d         }t          j                            |t          j
                            |d          ddt          j        j                  }|                    |t           j        z   dz   ||          }|                                }|S )zAGets the ntheader structure for the kernel of the specified layerr-   r.   per>   )r@   _IMAGE_DOS_HEADERrB   )r   r0   r1   r2   r3   r4   r   rG   rH   r   rI   rJ   r   ra   r@   rK   r   rL   get_nt_header)	r   r    r:   r!   r6   r7   pe_table_name
dos_header	nt_headers	            r   get_ntheader_structurezInfo.get_ntheader_structure   s      z2-);<< 	CABBB"#:; 8??$..{DAA"1 @ 
 
 ^^IN*-@@! $ 
 

 ,,..	r   c           
   #   `  K   | j         j        | j        d                  }|j        }|j        }| j         j        |         }| j         j        |         }|                     | j         | j        ||          }ddt          |j        d                   ffV  ddt          |j        d                   ffV  dd|j        d         ffV  dd	t          t          j        | j         |                    ffV  dd
t          | j         j        |         j                            dd                    ffV  |                     | j         |          D ]!\  }}d|j        | d|j        j         ffV  "|j        j        dk    r`ddt          |j        j                  ffV  dd|                                ffV  ddt          |                                          ffV  |                     | j         ||          }ddt          |j        j                  ffV  dd|j         d|j         ffV  ddt          |j                  ffV  |                     | j         ||          }	|	                    d          j        }
|	                     d||
          }ddt          |          ffV  | !                    | j         ||          }ddt          |j"        #                                          ffV  ddt          |j$        %                    dddd                    ffV  dd t          |j&        j'                  ffV  dd!t          |j(                  ffV  dd"t          |j)                  ffV  | *                    | j         | j        |          }dd#t          |j+        j,                  ffV  dd$t          |j+        j-                  ffV  dd%t          |j.        j/                  ffV  dd&ta          j1        ta          j2        |j.        j3                            ffV  d S )'Nr   r   zKernel Baser.   DTBpage_map_offsetSymbolsisf_urlIs64BitIsPAEpaeF iKDBGr<   
NTBuildLab
CSDVersionrZ   zMajor/Minor.MachineTypeKeNumberProcessorszunsigned intr\   
SystemTimeNtSystemRootstringzutf-16replacei  )encodingerrors
max_lengthNtProductTypeNtMajorVersionNtMinorVersionzPE MajorOperatingSystemVersionzPE MinorOperatingSystemVersionz
PE MachinezPE TimeDateStamp)4r    modulesr4   r!   symbol_table_namer   rC   rO   r:   hexstrr	   symbol_table_is_64bitmetadatagetr%   r   	__class____name__HeaderOwnerTagvolr/   get_build_labget_csdversionr_   MajorVersionMinorVersionrt   r9   rE   rF   rK   rX   rv   get_timerw   castr}   r   r~   r   rg   OptionalHeaderMajorOperatingSystemVersionMinorOperatingSystemVersion
FileHeaderMachinetimeasctimegmtimeTimeDateStamp)selfr   r!   r+   r'   tabler=   ir^   r8   cpu_count_offset	cpu_countrW   rf   s                 r   
_generatorzInfo._generator   s     %dk(&;<&
/#J/),7&&L$*J
 
 =#el3J&K"L"LMNNNN5#el+<=>>?@@@@9el9567777G9$,UUVVW
 	
 	
 	

 c$,-j9BFFueTTUUV
 	
 	
 	

 ((zBB 	G 	GHAuuza#D#D%/*B#D#DEFFFFF;:--,c$(/.B.BCDDDD|T%7%7%9%9:;;;;|S)<)<)>)>%?%?@AAAA))$,
LQQ#S%9%9:;;;;=T%6"L"L9J"L"LMNNNN=#d&6"7"789999))$,
LQQ#../CDDLOO&:FV $ 
 
	 'Y89999((z<PP<U%5%>%>%@%@!A!ABCCCC&++ 8IRU ,   

 
	
 
	
 
	
 ?C(;(G$H$HIJJJJ#S)=%>%>?@@@@#S)=%>%>?@@@@ //L$*J
 
	
 0I,HII
 	
 	
 	
 0I,HII
 	
 	
 	
 <Y%9%A!B!BCDDDD"T[)=)KLLMM
 	
 	
 	
 	
 	
r   c                 f    t          dt          fdt          fg|                                           S )NVariableValue)r   r   r   )r   s    r   runzInfo.run  s*    *c*WcN;T__=N=NOOOr   N)r   )r   
__module____qualname____doc___required_framework_version_versionclassmethodr   r   rI   RequirementInterfacer   r    ContextInterfacer   intr   r   r   DataLayerInterfacer%   r9   objectsObjectInterfacerO   rX   r_   rg   r   r    r   r   r   r      s{       GG"+H
j&>&S!T 
 
 
 [
 
 	 #4  	
 
%Z.AAB	C   [4 #4  	   [  #4  	
  
		+   [> #4  	
 
		+   [8 #4  	
 
		+   [& #4  	
 
		+   [>^
 ^
 ^
@P P P P Pr   r   )r   typingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.framework.symbolsr   %volatility3.framework.symbols.windowsr   PluginInterfacer   r   r   r   <module>r      s   
  ( ( ( ( ( ( ( ( ( ( H H H H H H H H H H H H < < < < < < 4 4 4 4 4 4 4 4 4 4 4 4 2 2 2 2 2 2 < < < < < <NP NP NP NP NP7" NP NP NP NP NPr   