[ #g ddlZddlmZddlmZddlmZddlmZm Z m Z eje Z Gdde jZy)N)Iterable) interfaces) requirements) poolscannermodulespedumpc eZdZdZdZdZfdZedZede jjde de de e jjfd ZxZS) ModScanz?Scans for modules present in a particular windows memory image.rrcFt||i||j|_y)N)super__init__ scan_modules_enumeration_method)selfargskwargs __class__s _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/modscan.pyrzModScan.__init__s# $)&)#'#4#4 c tjddddgtjdtjdtjd t j d tjd d d dtjdddtjddddtjdtjdgS)NkernelzWindows kernelIntel32Intel64)name description architecturesr)rr)r componentversionrr dumpzExtract listed modulesFT)rrdefaultoptionalbasez)Extract a single module with BASE address)rrr$rzmodule name/sub string)rrr$r#r) rModuleRequirementVersionRequirementr PoolScannerrModulesBooleanRequirementIntRequirementStringRequirementrPEDump)clss rget_requirementszModScan.get_requirementss  * *,()4   + +"k.E.Ey   + +'//9   + +4    ' 'G   * *4    + +  ;  rcontext layer_name symbol_tablereturnc#Ktjj|dg}tjj||||D] }|\}}}|yw)aScans for modules using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures sMmLdN)rr(builtin_constraintsgenerate_pool_scan) r.r0r1r2 constraintsresult _constraint mem_object_headers rrzModScan.scan_modules<s_$"--AA 7) "--@@ Z{ F06 ,KW   sAA)__name__ __module__ __qualname____doc___required_framework_version_versionr classmethodr/rr0ContextInterfacestrrobjectsObjectInterfacer __classcell__)rs@rr r sI"+H5! ! F##44  *$$44 5 rr )loggingtypingrvolatility3.frameworkr#volatility3.framework.configurationrvolatility3.plugins.windowsrrr getLoggerr<vollogr)r rrrPs=,<DD   8 $HgooHr