
    Xf                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  ej        e          Z G d dej        j                  ZdS )	    N)List)
exceptions	renderers
interfaces)requirements)format_hints)pslistc                   ^    e Zd ZdZdZedeej        j	                 fd            Z
d Zd ZdS )MemmapzPrints the memory map   r   r   returnc           	          t          j        ddddg          t          j        dt          j        d          t          j        d	d
d          t          j        dddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r   )r   pluginversionpidz8Process ID to include (all other processes are excluded)T)r   r   optionaldumpzExtract listed memory segmentsF)r   r   defaultr   )r   ModuleRequirementPluginRequirementr	   PsListIntRequirementBooleanRequirement)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/memmap.pyget_requirementszMemmap.get_requirements   s     *,()4  
 *fmY   'V  
 +<	  
 	
    c              #     K   |D ]}d}	 |j         }|                                }| j        j        |         }nU# t          j        $ rC}t                              d                    ||j	        |j
                             Y d }~d }~ww xY w| j        d         r|                     d| d          }nt          j                    }|5 }d}	|                    d|j        d          D ]}
|
\  }}}}}d	}| j        d         r	 |                    ||d
          }|                    |           |j        }nK# t          j        $ r9 d}t                              d                    |||j                             Y nw xY wdt)          j        |          t)          j        |          t)          j        |          t)          j        |	          |ffV  |	|z  }	||z  }	 d d d            n# 1 swxY w Y   d S )NUnknownz*Process {}: invalid address {} in layer {}r   zpid.z.dmpr   T)ignore_errorsDisabled)padzError outputting to filez%Unable to write {}'s address {} to {})UniqueProcessIdadd_process_layercontextlayersr   InvalidAddressExceptionvollogdebugformatinvalid_address
layer_nameconfigopen
contextlib	ExitStackmappingmaximum_addressreadwritepreferred_filenamer   Hex)selfprocsprocr   proc_layer_name
proc_layerexcpfile_handle	file_datafile_offsetmapvaloffsetsizemapped_offsetmapped_sizemaplayerfile_outputdatas                     r"   
_generatorzMemmap._generator.   s      7	* 7	*DC
*"&"8"8":":!\0A

5   @GGT14?   
  {6" 5"ii(8s(8(8(899 )244 #*	(0034 1   !* !*F JPFFD-h",K{6* #-??64T?#J#JD%OOD111*5*HKK)A   *DK"LL G N N$3$*$/$B!" !"     (,V44(,];;(,[99(,[99'	 	 	 	  ;.Kk)FFC!*#* #* #* #* #* #* #* #* #* #* #* #* #* #* #*)7	* 7	*sM   -9B9BB
9G/4D98G/9AF	>G/ F	A!G//G3	6G3	c                    t           j                            | j                            dd           g          }| j        j        | j        d                  }t          j        dt          j
        fdt          j
        fdt          j
        fdt          j
        fdt          fg|                     t           j                            | j        |j        |j        |                              S )	Nr   r   VirtualPhysicalSizezOffset in FilezFile output)r,   r3   symbol_tablefilter_func)r	   r   create_pid_filterr4   getr,   modulesr   TreeGridr   r=   strrO   list_processesr3   symbol_table_name)r>   rU   r   s      r"   runz
Memmap.runh   s    m55t{ud7S7S6TUU%dk(&;<!L,-\-.)*!<#34$ OO,, L%0!'!9 +	 -   
 
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer#   rO   r]    r$   r"   r   r      so        "+
j&>&S!T 
 
 
 [
08* 8* 8*t
 
 
 
 
r$   r   )r6   loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   	getLoggerr^   r/   pluginsPluginInterfacer   rf   r$   r"   <module>rp      s               C C C C C C C C C C < < < < < < 8 8 8 8 8 8 . . . . . .		8	$	$l
 l
 l
 l
 l
Z/ l
 l
 l
 l
 l
r$   