
    XfU                         d dl mZmZmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ  G d dej        j                  Zd	S )
    )	constants
exceptions
interfaces	renderers)requirements)format_hints)intermed)pe)pslistvadinfoc                   <    e Zd ZdZdZdZed             Zd Zd Z	dS )
LdrModulesz>Lists the loaded modules in a particular windows memory image.   r   r   )   r   r   c           	          t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          t          j        d
t          dd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   	componentversionr   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)	r   ModuleRequirementVersionRequirementr   PsListr   VadInfoListRequirementint)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/ldrmodules.pyget_requirementszLdrModules.get_requirements   s     *,()4  
 +	   +'/9   ( W	  
 	
    c              #     K   t           j                            | j        | j        ddt
          j                  }dt          j        j	        dt          fd}|}|D ]}|                                }t          d |                                D                       }t          d |                                D                       }t          d	 |                                D                       }	i }
t           j                            ||
          D ]}| j                            |t(          j        z   dz   |                                |          }	 |j        dk    rNn# t0          j        $ r Y `w xY w|                                |
|                                <   |
                                D ]}|                    |d           }|                    |d           }|	                    |d           }dt;          |j                  t?          |j         !                    d|j         j"        j#        d                    tI          j%        |          |d u|d u|d u|
|         gfV  d S )Nwindowsr
   )class_typesxreturnc                 f    	 |                                  dk    o| j         S # t          $ r Y dS w xY w)Nr   F)get_private_memoryControlAreaAttributeError)r+   s    r%   filter_functionz.LdrModules._generator.<locals>.filter_function*   sJ    0022a7IAMJJ!   uus   " 
00c              3   (   K   | ]}|j         |fV  d S NDllBase.0mods     r%   	<genexpr>z(LdrModules._generator.<locals>.<genexpr>6   :       " "'*c"" " " " " "r'   c              3   (   K   | ]}|j         |fV  d S r3   r4   r6   s     r%   r9   z(LdrModules._generator.<locals>.<genexpr>9   r:   r'   c              3   (   K   | ]}|j         |fV  d S r3   r4   r6   s     r%   r9   z(LdrModules._generator.<locals>.<genexpr><   s)       X X#+s!3 X X X X X Xr'   )filter_func_IMAGE_DOS_HEADER)offset
layer_nameiMZ  r   stringreplace)
max_lengtherrors)&r	   IntermediateSymbolTablecreatecontextconfig_pathr
   r*   r   objectsObjectInterfacebooladd_process_layerdictload_order_modulesinit_order_modulesmem_order_modulesr   r!   	list_vadsobjectr   BANG	get_starte_magicr   PagedInvalidAddressExceptionget_file_namekeysgetr#   UniqueProcessIdstrImageFileNamecastvolcountr   Hex)selfprocspe_table_namer1   r=   procproc_layer_nameload_order_modinit_order_modmem_order_modmapped_filesvad
dos_headerbaseload_modinit_modmem_mods                    r%   
_generatorzLdrModules._generator%   s      8??L$*It @ 
 
	z1A 	d 	 	 	 	 & 4	 4	D"4466O " " ".2.E.E.G.G" " "  N " " ".2.E.E.G.G" " "  N ! X Xt?U?U?W?W X X XXXM L00;0OO D D!\00!IN25HH==??. 1  

!)V33  4!>   H 140A0A0C0CS]]__--$))++  )--dD99)--dD99'++D$77 D011 .33 (+/+=+A+G'0 4    %(.. , ,t+$T*    ;4	 4	s   E%%E76E7c                    t           j                            | j                            dd                     }| j        j        | j        d                  }t          j        dt          fdt          fdt          j        fdt          fdt          fdt          fd	t          fg|                     t           j                            | j        |j        |j        |
                              S )Nr   r   PidProcessBaseInLoadInInitInMem
MappedPath)rG   r@   symbol_tabler=   )r   r    create_pid_filterconfigrY   rG   modulesr   TreeGridr#   r[   r   r`   rK   rp   list_processesr@   symbol_table_name)ra   r=   r   s      r%   runzLdrModules.runh   s    m55dkooeT6R6RSS%dk(&;<!C )*4 4 $s# OO,, L%0!'!9 +	 -   
 
 	
r'   N)
__name__
__module____qualname____doc___required_framework_version_versionclassmethodr&   rp   r    r'   r%   r   r   	   s`        HH"+H
 
 [
*A A AF
 
 
 
 
r'   r   N)volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr	   0volatility3.framework.symbols.windows.extensionsr
   volatility3.plugins.windowsr   r   pluginsPluginInterfacer   r   r'   r%   <module>r      s    N N N N N N N N N N N N < < < < < < 8 8 8 8 8 8 2 2 2 2 2 2 ? ? ? ? ? ? 7 7 7 7 7 7 7 7u
 u
 u
 u
 u
#3 u
 u
 u
 u
 u
r'   