X f ddlZddlmZmZmZddlmZmZmZm Z ddl m Z ddl m Z ddlmZddlmZddlmZmZmZejeZGd d ejjZdS) N)IterableList Generator) renderers interfaces exceptions constants) requirements) format_hints)intermed)pe) poolscannerdlllistpslistc>eZdZdZdZdZedZedej j de de de ej jfd Ze ddej j de de d eedee d d ff d Zedej j d e e defdZdZdZd S)ModScanz?Scans for modules present in a particular windows memory image.rrrrc $tjddddgtjdtjdtjd t jd tjd tjd tj d d ddgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r componentversionrrrdumpzExtract listed modulesFT)rrdefaultoptional) r ModuleRequirementVersionRequirementr PoolScannerrPsListrDllListBooleanRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/modscan.pyget_requirementszModScan.get_requirementss  *,()4     +"k.Ey     +      +'/9     +4      context layer_name symbol_tablereturnc#Ktj|dg}tj||||D] }|\}}}|V dS)aScans for modules using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures sMmLdN)rr%builtin_constraintsgenerate_pool_scan) r)r-r.r/ constraintsresult _constraint mem_object_headers r* scan_moduleszModScan.scan_modules0s{$"-AA 7)  "-@@ Z{    F06 ,KW       r,Npidsc#Kg}tj|pg}tj||||D]}d} |j}|} ||tjzdz||j } | j |vrWnM#tj $r;ttjd|YwxYw|| j | VdS)aOBuild a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pids: A list of process identifiers to include exclusively or None for no filter Returns: A list of session layer names )r-r.r/ filter_funcUnknown_MM_SESSION_SPACE)r.offsetzSProcess {} does not have a valid Session or a layer could not be constructed for itN)rr&create_pid_filterlist_processesUniqueProcessIdadd_process_layerobjectr BANGSession SessionIdrInvalidAddressExceptionvolloglog LOGLEVEL_VVVformatappend) r)r-r.r/r:seen_idsr<procproc_idproc_layer_name session_spaces r*get_session_layerszModScan.get_session_layersLsR*>@m55djbAA M00!%# 1  ! "! "D  G ."&"8"8":":!( 9>14GG)<!/!! !*h6675    *ipp   OOM3 4 4 4! ! ! ! !C! "! "sAB!!AC+*C+session_layers base_addresscX|D]&}|j||r|cS'dS)agGiven a base address and a list of layer names, find a layer that can access the specified address. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols session_layers: A list of session layer names base_address: The base address to identify the layers that can access it Returns: Layer name or None if no layers that contain the base address can be found N)layersis_valid)r)r-rTrUr.s r*find_session_layerzModScan.find_session_layersH*) " "J~j)22<@@ "!!!! "tr,c#K|jj|jd}t||j|j|j}tj |j|j ddtj }| |j|j|jD]3} |j}n#t j$rd}YnwxYw |j}n#t j$rd}YnwxYwd}|jdrg||j||j}d|jd }|r9t*j|j|||j| } d }| r| j}d t5j|jjt5j|jt5j|j|||ffV5dS) Nrwindowsr ) class_typesDisabledr z'Cannot find a viable session layer for z#x)r.zError outputting filer)r-modulesconfiglistrSr.symbol_table_namer IntermediateSymbolTablecreate config_pathr r\r9 BaseDllName get_stringrrH FullDllNamerYDllBaserr'dump_peopenpreferred_filenamer Hexvolr? SizeOfImage) selfrrT pe_table_namemodrfrh file_outputsession_layer_name file_handles r* _generatorzModScan._generators6%dk(&;<  # # f/1I     !8?? L$*It@  $$ L&+V-E  ) ) C !!o88:: 5 ! ! !  ! !!o88:: 5 ! ! !  !%K{6" E%)%<%<L.#+&&"Y XXX % E")/"9"9 % #5 #:##K#:K"E&1&D  $SW^44 $S[11 $S_55      ?) ) s$5CC#"C#'DDDc tjdtjfdtjfdtjfdtfdtfdtfg|S)NOffsetBaseSizeNamePathz File output)rTreeGridr rmstrrv)rps r*runz ModScan.runsb!<+,)*)*  $   OO     r,)N)__name__ __module__ __qualname____doc___required_framework_version_version classmethodr+rr-ContextInterfacer~robjectsObjectInterfacer9rintrrSrYrvrr,r*rrsjII"+H  [ 0#4  *$4 5 [6  8"8"#48"8" 8" 3i 8" 3d? # 8"8"8"[8"t#4!  [4555n      r,r)loggingtypingrrrvolatility3.frameworkrrrr #volatility3.framework.configurationr volatility3.framework.renderersr volatility3.framework.symbolsr 0volatility3.framework.symbols.windows.extensionsr volatility3.plugins.windowsrrr getLoggerrrIpluginsPluginInterfacerrr,r*rs,,,,,,,,,,NNNNNNNNNNNN<<<<<<888888222222??????DDDDDDDDDD  8 $ $S S S S S j 0S S S S S r,