
    Xf                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  ej                  e      Z G d dej"                  j$                        Zy)	    N)List)
exceptions	renderers
interfaces)requirements)format_hints)pslistc                   d    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zy)MemmapzPrints the memory map   r   r   returnc           	          t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
d      t        j                  dddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r   )r   pluginversionpidz8Process ID to include (all other processes are excluded)T)r   r   optionaldumpzExtract listed memory segmentsF)r   r   defaultr   )r   ModuleRequirementPluginRequirementr	   PsListIntRequirementBooleanRequirement)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/memmap.pyget_requirementszMemmap.get_requirements   sz     **,()4
 **fmmY ''V
 ++<	
 	
    c              #   "  K   |D ]Q  }d}	 |j                   }|j                         }| j                  j                  |   }| j                  d   r| j                  d| d      }nt        j                         }|5 }d}	|j                  d|j                   d      D ]  }
|
\  }}}}}d	}| j                  d   r2	 |j#                  ||d
      }|j%                  |       |j&                  }dt)        j*                  |      t)        j*                  |      t)        j*                  |      t)        j*                  |	      |ff |	|z  }	||z  } 	 d d d        T y # t        j
                  $ rE}t        j                  dj                  ||j                  |j                               Y d }~d }~ww xY w# t        j
                  $ r6 d}t        j                  dj                  |||j&                               Y w xY w# 1 sw Y   xY ww)NUnknownz*Process {}: invalid address {} in layer {}r   zpid.z.dmpr   T)ignore_errorsDisabled)padzError outputting to filez%Unable to write {}'s address {} to {})UniqueProcessIdadd_process_layercontextlayersr   InvalidAddressExceptionvollogdebugformatinvalid_address
layer_nameconfigopen
contextlib	ExitStackmappingmaximum_addressreadwritepreferred_filenamer   Hex)selfprocsprocr   proc_layer_name
proc_layerexcpfile_handle	file_datafile_offsetmapvaloffsetsizemapped_offsetmapped_sizemaplayerfile_outputdatas                     r"   
_generatorzMemmap._generator.   s     7	*DC
**"&"8"8":!\\00A
 {{6""ii$se4(89 )224 #*	(00334 1  !*F JPFFD-h",K{{6*#-??64T?#JD%OOD1*5*H*HK (,,V4(,,];(,,[9(,,[9'	 	  ;.Kk)FC!*#* #*)7	* 55 @GGT114??
 4  *AA *DK"LL G N N$3$*$/$B$B!"#* #*sl   	H5E;H<=H:1F6+A#HHF3.:F.(H.F33H6AG?	;H>G?	?HH	Hc                     t         j                  j                  | j                  j	                  dd       g      }| j
                  j                  | j                  d      }t        j                  dt        j                  fdt        j                  fdt        j                  fdt        j                  fdt        fg| j                  t         j                  j                  | j
                  |j                  |j                  |                  S )	Nr   r   VirtualPhysicalSizezOffset in FilezFile output)r,   r3   symbol_tablefilter_func)r	   r   create_pid_filterr4   getr,   modulesr   TreeGridr   r=   strrO   list_processesr3   symbol_table_name)r>   rU   r   s      r"   runz
Memmap.runh   s    mm55t{{ud7S6TU%%dkk(&;<!!L,,-\--.))*!<#3#34$ OO,, LL%00!'!9!9 +	 - 
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer#   rO   r]    r$   r"   r   r      s@    "+
j&>&>&S&S!T 
 
08*t
r$   r   )r6   loggingtypingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   	getLoggerr^   r/   pluginsPluginInterfacer   rf   r$   r"   <module>rp      sK       C C < 8 .			8	$l
Z// l
r$   