
    [
#g                         d dl Z d dlmZmZmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZmZ  e j"                  e      Z G d d	ej(                  j*                        Zy)
    N)	constants
exceptions
interfaces	renderers)requirements)format_hints)intermed)pe)pslistvadinfoc                   4    e Zd ZdZdZdZed        Zd Zd Z	y)
LdrModulesz>Lists the loaded modules in a particular windows memory image.   r   r   )   r   r   c           	         t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
t        dd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   	componentversionr   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)	r   ModuleRequirementVersionRequirementr   PsListr   VadInfoListRequirementint)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/ldrmodules.pyget_requirementszLdrModules.get_requirements   s|     **,()4
 ++	 ++'//9 (( W	
 	
    c              #     K   t         j                  j                  | j                  | j                  ddt
        j                        }|D ]  }|j                         }t        d |j                         D              }t        d |j                         D              }t        d |j                         D              }i }t        j                  j                  |      D ]u  }	| j                  j                  |t         j"                  z   dz   |	j%                         |      }
	 |
j&                  d	k7  rT	 |	j9                         ||	j%                         <   w |j;                         D ]  }|j=                  |d       }|j=                  |d       }|j=                  |d       }dt?        |j@                        tC        |jD                  jG                  d|jD                  j4                  jH                  d            tK        jL                  |      |d u|d u|d u||   gf   y # t(        j*                  $ rI t,        j/                  t         j0                  d
t3        |
j4                  j6                         d       Y w xY ww)Nwindowsr
   )class_typesc              3   8   K   | ]  }|j                   |f  y wNDllBase.0mods     r%   	<genexpr>z(LdrModules._generator.<locals>.<genexpr>6         "'*c""   c              3   8   K   | ]  }|j                   |f  y wr,   r-   r/   s     r%   r2   z(LdrModules._generator.<locals>.<genexpr>9   r3   r4   c              3   8   K   | ]  }|j                   |f  y wr,   r-   r/   s     r%   r2   z(LdrModules._generator.<locals>.<genexpr><   s      X#++s!3 Xr4   _IMAGE_DOS_HEADER)offset
layer_nameiMZ  zSkipping vad at z due to InvalidAddressExceptionr   stringreplace)
max_lengtherrors)'r	   IntermediateSymbolTablecreatecontextconfig_pathr
   r*   add_process_layerdictload_order_modulesinit_order_modulesmem_order_modulesr   r!   	list_vadsobjectr   BANG	get_starte_magicr   InvalidAddressExceptionvolloglogLOGLEVEL_VVVVhexvolr8   get_file_namekeysgetr#   UniqueProcessIdstrImageFileNamecastcountr   Hex)selfprocspe_table_nameprocproc_layer_nameload_order_modinit_order_modmem_order_modmapped_filesvad
dos_headerbaseload_modinit_modmem_mods                  r%   
_generatorzLdrModules._generator-   sh     88??LL$**It @ 
 D"446O " ".2.E.E.G" N " ".2.E.E.G" N ! Xt?U?U?W XXM L006!\\00!INN25HH==?. 1 

	!))V3  4 140A0A0CS]]_-# 7& %))+)--dD9)--dD9'++D$7 D001 ..33 (+/+=+=+A+A+G+G'0 4  %((. , ,t+$T*  ,C 0 "99 JJ!//*3z~~/D/D+E*FFef s,   D!J$H&3C3J&AJ>JJJc                    t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }t        j                  dt        fdt        fdt        j                  fdt        fdt        fdt        fd	t        fg| j                  t         j                  j                  | j
                  |j                   |j"                  |
                  S )Nr   r   PidProcessBaseInLoadInInitInMem
MappedPath)r@   r9   symbol_tablefilter_func)r   r    create_pid_filterconfigrT   r@   modulesr   TreeGridr#   rV   r   rZ   boolrj   list_processesr9   symbol_table_name)r[   rt   r   s      r%   runzLdrModules.runl   s    mm55dkkooeT6RS%%dkk(&;<!!C ))*4 4 $s# OO,, LL%00!'!9!9 +	 - 
 	
r'   N)
__name__
__module____qualname____doc___required_framework_version_versionclassmethodr&   rj   r|    r'   r%   r   r      s-    H"+H
 
*=~
r'   r   )loggingvolatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr	   0volatility3.framework.symbols.windows.extensionsr
   volatility3.plugins.windowsr   r   	getLoggerr}   rM   pluginsPluginInterfacer   r   r'   r%   <module>r      sK   
  N N < 8 2 ? 7			8	$q
##33 q
r'   