
    [
#gP&                         d dl Z d dlmZmZmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZ  G d	 d
ej*                        Zy)    N)ListTupleIterable)	constants
interfaceslayerssymbols)requirements)plugins)TreeGrid)intermed)kdbgpec                       e Zd ZdZdZdZedeej                  j                     fd       Ze	 ddej                  j                  dededeeeej$                  j&                  f      fd	       Zedej                  j                  ded
efd       Zedej                  j                  deded
edej,                  j.                  f
d       Zedej                  j                  ded
edej,                  j.                  fd       Zedej                  j                  ded
edej,                  j.                  fd       Zedej                  j                  dededej,                  j.                  fd       Zd Zd Zy)Infoz=Show OS & kernel details of the memory sample being analyzed.)   r   r   )   r   r   returnc                 8    t        j                  ddddg      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r
   ModuleRequirement)clss    \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/info.pyget_requirementszInfo.get_requirements   s*     **,()4
 	
    context
layer_nameindexc              #      K   |j                   |   }||f 	 |j                  D ]=  }| j                  |||dz         D ]"  \  }}||j                   |j                     f $ ? y# t        $ r Y yw xY ww)aS  List the dependencies of a given layer.

        Args:
            context: The context to retrieve required layers from
            layer_name: the name of the starting layer
            index: the index/order of the layer

        Returns:
            An iterable containing the levels and layer objects for all dependent layers
        r   N)r   dependenciesget_dependsr   AttributeError)r   r!   r"   r#   layerdependsjdeps           r   r&   zInfo.get_depends    s     " z*Ul	 --!oogw	JFAsW^^CHH555 K .  		s)   A5AA& %A5&	A2/A51A22A5symbol_tablec                     |j                   |   }t        |t         j                  j                        st	        d      |j
                  d   }|j                  |||      }|S )z=Returns the kernel module based on the layer and symbol_table#Virtual Layer is not an intel layerkernel_virtual_offset)r"   offset)r   
isinstanceintelIntel	TypeErrorconfigmodule)r   r!   r"   r,   virtual_layerkvontkrnlmps          r   get_kernel_modulezInfo.get_kernel_module;   s\      z2-););<ABB""#:;>>,:c>Rr    config_pathc                    | j                  |||      }|j                  |   j                  }|j                  d      j                  }t
        j                  j                  |t        j                  j                  |d      dd|t        j                        }|j                  |t        j                  z   dz   |j                   |z   |      }	|	S )z4Returns the KDDEBUGGER_DATA64 structure for a kernelKdDebuggerDataBlockr   windows)native_typesclass_types_KDDEBUGGER_DATA64r0   r"   )r:   symbol_spacenatives
get_symboladdressr   IntermediateSymbolTablecreater   configuration	path_joinr   r@   objectr   BANGr0   )
r   r!   r;   r"   r,   r9   r?   kdbg_offsetkdbg_table_namekdbg_objs
             r   get_kdbg_structurezInfo.get_kdbg_structureL   s     ((*lK++L9AA))*?@HH"::AA$$..{FC%(( B 
 >>inn,/CC??[0! " 
 r    c                     |j                   |   }t        |t         j                  j                        st	        d      | j                  |||      }|j                  dk(  rd}nd}|j                  d||d      }|S )z5Returns the _KUSER_SHARED_DATA structure for a kernelr.       l      l        ^ _KUSER_SHARED_DATAT)object_typer"   r0   absolute)r   r1   r2   r3   r4   r:   bits_per_registerrK   )r   r!   r"   r,   r7   r9   
kuser_addrkusers           r   get_kuser_structurezInfo.get_kuser_structurel   s      z2-););<ABB((*lK **b0#J+J,!	   
 r    c                     | j                  |||      }|j                  d      j                  }|j                  d||      }|S )z4Returns the KdVersionBlock information from a kernelKdVersionBlock_DBGKD_GET_VERSION64rT   r"   r0   )r:   rE   rF   rK   )r   r!   r"   r,   r9   vers_offsetverss          r   get_version_structurezInfo.get_version_structure   sR     ((*lK))*:;CC.!  
 r    c                    |j                   |   }t        |t         j                  j                        st	        d      |j
                  d   }t        j                  j                  |t        j                  j                  |d      ddt        j                        }|j                  |t        j                   z   dz   ||      }|j#                         }|S )zAGets the ntheader structure for the kernel of the specified layerr.   r/   r   r>   )r@   _IMAGE_DOS_HEADERrB   )r   r1   r2   r3   r4   r5   r   rG   rH   r   rI   rJ   r   r@   rK   r   rL   get_nt_header)	r   r!   r;   r"   r7   r8   pe_table_name
dos_header	nt_headers	            r   get_ntheader_structurezInfo.get_ntheader_structure   s      z2-););<ABB""#:; 88??$$..{DA @ 
 ^^INN*-@@! $ 

 ,,.	r    c           
   #   L	  K   | j                   j                  | j                  d      }|j                  }|j                  }| j                   j
                  |   }| j                   j                  |   }| j                  | j                   | j                  ||      }ddt        |j                  d         ff ddt        |j                  d         ff dd|j                  d   ff dd	t        t        j                  | j                   |            ff dd
t        | j                   j
                  |   j                  j                  dd            ff | j                  | j                   |      D ]0  \  }}d|j                   | d|j"                  j$                   ff 2 |j&                  j(                  dk(  r\ddt        |j*                  j,                        ff dd |j.                         ff ddt         |j0                               ff | j3                  | j                   ||      }ddt        |j*                  j,                        ff dd|j4                   d|j6                   ff ddt        |j8                        ff | j;                  | j                   ||      }	|	j=                  d      j>                  }
|	jA                  d||
      }ddt        |      ff | jC                  | j                   ||      }ddt        |jD                  jG                               ff ddt        |jH                  jK                  dddd            ff dd t        |jL                  jN                        ff dd!t        |jP                        ff dd"t        |jR                        ff | jU                  | j                   | j                  |      }dd#t        |jV                  jX                        ff dd$t        |jV                  jZ                        ff dd%t        |j\                  j^                        ff dd&ta        jb                  ta        jd                  |j\                  jf                              ff y w)'Nr   r   zKernel Baser/   DTBpage_map_offsetSymbolsisf_urlIs64BitIsPAEpaeF iKDBGr=   
NTBuildLab
CSDVersionr[   zMajor/Minor.MachineTypeKeNumberProcessorszunsigned intr]   
SystemTimeNtSystemRootstringzutf-16replacei  )encodingerrors
max_lengthNtProductTypeNtMajorVersionNtMinorVersionzPE MajorOperatingSystemVersionzPE MinorOperatingSystemVersionz
PE MachinezPE TimeDateStamp)4r!   modulesr5   r"   symbol_table_namer   rC   rP   r;   hexstrr	   symbol_table_is_64bitmetadatagetr&   r   	__class____name__HeaderOwnerTagvolr0   get_build_labget_csdversionr`   MajorVersionMinorVersionrt   r:   rE   rF   rK   rY   rv   get_timerw   castr}   r   r~   r   rg   OptionalHeaderMajorOperatingSystemVersionMinorOperatingSystemVersion
FileHeaderMachinetimeasctimegmtimeTimeDateStamp)selfr   r"   r,   r(   tabler   ir_   r9   cpu_count_offset	cpu_countrX   rf   s                 r   
_generatorzInfo._generator   s    %%dkk(&;<&&
//##J/)),7&&LL$**J
 =#ell3J&K"LMNN5#ell+<=>?@@9ell95677G99$,,UVW
 	

 c$,,--j9BBFFueTUV
 	

 ((zBHAuuzzaS%//*B*B)C#DEFF C ;;:-,c$((//.BCDD|%7T%7%7%9:;;|S)<)<)<)>%?@AA))$,,
LQ#S%9:;;=T%6%6$7q9J9J8K"LMNN=#d&6&6"7899))$,,
LQ#../CDLLOO&:FV $ 
	 'Y899((z<P<U%5%5%>%>%@!ABCC&&++ 8IRU , 

 
	
 ?C(;(;(G(G$HIJJ#S)=)=%>?@@#S)=)=%>?@@ //LL$**J
	
 0I,,HHI
 	
 0I,,HHI
 	
 <Y%9%9%A%A!BCDD"T[[)=)=)K)KLM
 	
s   R"R$c                 R    t        dt        fdt        fg| j                               S )NVariableValue)r   r   r   )r   s    r   runzInfo.run  s$    *c*WcN;T__=NOOr    N)r   )r   
__module____qualname____doc___required_framework_version_versionclassmethodr   r   rI   RequirementInterfacer   r!   ContextInterfacer   intr   r   r   DataLayerInterfacer&   r:   objectsObjectInterfacerP   rY   r`   rg   r   r    r    r   r   r      s;   G"+H
j&>&>&S&S!T 
 
 
 	##44  	
 
%Z..AAAB	C 4 ##44  	   ##44  	
  
			+	+ > ##44  	
 
			+	+ 8 ##44  	
 
			+	+ & ##44  	
 
			+	+ >^
@Pr    r   )r   typingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   r   PluginInterfacer   r   r    r   <module>r      s;   
  ( ( H H < 4 4 2 ENP7"" NPr    