
    [
#g                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ  e j                  e      Z G d dej$                  j&                        Zy)	    N)IteratorListTuple)	renderers
interfaces	constants)requirements)utility)format_hintsc                       e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  deded	edej                  j                   f
d
       Zdee   fdZd Zy)KPCRsz'Print KPCR structure for each processor)   r   r   )   r   r   returnc                 8    t        j                  ddddg      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r	   ModuleRequirement)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/kpcrs.pyget_requirementszKPCRs.get_requirements   s*     **,()4
 	
    contextkernel_module_name
layer_namesymbol_tablec              #   0  K   |j                   |   }|j                  d      j                  }|j                  d||      }|j                  d||j                  d      j                        }t	        j
                  ||||t        j                  z   dz         }	|	D ]u  }
|
j                         }|j                  d      j                  d	      }|j                  |t        j                  z   dz   |j                  j                  |z
  |
      }| w yw)a  Returns the KPCR structure for each processor

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            kernel_module_name: The name of the kernel module on which to operate
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            The _KPCR structure for each processor
        KeNumberProcessorszunsigned int)object_typer   offsetpointerKiProcessorBlock_KPRCB)r   arraycountsubtype_KPCRPrcb)r$   r   N)modules
get_symboladdressobjectr
   array_of_pointersr   BANGdereferenceget_typerelative_child_offsetvolr$   )r   r   r   r   r    r   cpu_count_offset	cpu_countprocessor_blockprocessor_pointersr%   kprcbreloffkpcrs                 r   
list_kpcrszKPCRs.list_kpcrs%   s    ( !34!,,-ABJJMM&:FV " 
	 !--!!$$%78@@ ( 

 %66! 9>>1H<	
 *G'')E__W-CCFKF>>y~~-7yy''&0% " D
 J *s   DDc              #     K   | j                   j                  | j                  d      }|j                  }|j                  }| j                  | j                   | j                  d   ||      D ]N  }dt        j                  |j                  j                        t        j                  |j                        ff P y w)Nr   r   )r   r-   configr   symbol_table_namer>   r   Hexr6   r$   CurrentPrcb)selfr   r   r    r=   s        r   
_generatorzKPCRs._generatorS   s     %%dkk(&;<&&
//OOLL$++h/\
D  $$TXX__5 $$T%5%56 
s   B<B>c                     t        j                  dt        j                  fdt        j                  fg| j	                               S )NOffsetzPRCB Offset)r   TreeGridr   rB   rE   )rD   s    r   runz	KPCRs.runc   sB    !!<++, 0 01 OO
 	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer   r   ContextInterfacestrobjectsObjectInterfacer>   r   r   rE   rI    r   r   r   r      s    1"+H
j&>&>&S&S!T 
 
 +##44+  + 	+
 + 
			+	++ +ZHUO  
r   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   	getLoggerrJ   vollogpluginsPluginInterfacer   rW   r   r   <module>rb      sQ   
  ( ( 
 = 1 8			8	$U
J.. U
r   