X f!ddlZddlmZmZmZddlmZddlmZmZddlm Z ddl m Z ddl m Z ddlmZdd lmZdd lmZmZejeZGd d ejjZdS) N)ListIterable Generator) constants) exceptions interfaces) renderers) requirements) format_hints)intermed)pe)pslistdlllistcdeZdZdZdZdZedeej j fdZ dZ e ddej jd ed ed eedeeddff d Zedej jd eedefdZedej jd ed edeejjfdZdZdS)Modulesz Lists the loaded kernel modules.rr)rrreturnc tjddddgtjdtjdtjd t jdtjd d d d tjddd dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r componentversionrdumpzExtract listed modulesFT)rrdefaultoptionalrzmodule name/sub string)rrr!r ) r ModuleRequirementVersionRequirementrPsListrDllListBooleanRequirementStringRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/modules.pyget_requirementszModules.get_requirementss  *,()4     +      +'/9     +4      *4    %  c#lK|jj|jd}tj|j|jddtj}| |j|j |j D]4} |j }n#tj$rd}YnwxYw |j }n#tj$rd}YnwxYw|jdr|jd|vrd}|jdrKt"j|j|||j}d }|r||j}d t/j|jjt/j|jt/j|j|||ffV6dS) Nrwindowsr ) class_typesrDisabledrzError outputting filer)contextmodulesconfigr IntermediateSymbolTablecreate config_pathr r. list_modules layer_namesymbol_table_name BaseDllName get_stringrInvalidAddressException FullDllNamerr%dump_peopenclosepreferred_filenamer HexvoloffsetDllBase SizeOfImage)selfr pe_table_namemodr:r= file_output file_handles r) _generatorzModules._generator5s%dk(&;< 8?? L$*It@  $$ L&+V-E  $ $ C !!o88:: 5 ! ! !  ! !!o88:: 5 ! ! !  !{6" t{6':+'M'M$K{6" A%o55L-di 6 A%%'''"-"@K $SW^44 $S[11 $S_55      5$ $ s$BB0/B04CC"!C"Nr1r8 symbol_tablepidsc#Kg}tj|pg}tj||||D]}d} |j}|} ||tjzdz||j } | j |vrWnM#tj $r;ttjd|YwxYw|| j | VdS)aOBuild a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pids: A list of process identifiers to include exclusively or None for no filter Returns: A list of session layer names )r1r8rM filter_funcUnknown_MM_SESSION_SPACEr8rDzSProcess {} does not have a valid Session or a layer could not be constructed for itN)rr$create_pid_filterlist_processesUniqueProcessIdadd_process_layerobjectrBANGSession SessionIdrr<volloglog LOGLEVEL_VVVformatappend) r(r1r8rMrNseen_idsrPprocproc_idproc_layer_name session_spaces r)get_session_layerszModules.get_session_layersasR*>@m55djbAA M00!%# 1  ! "! "D  G ."&"8"8":":!( 9>14GG)<!/!! !*h6675    *ipp   OOM3 4 4 4! ! ! ! !C! "! "sAB!!AC+*C+session_layers base_addresscX|D]&}|j||r|cS'dS)agGiven a base address and a list of layer names, find a layer that can access the specified address. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols session_layers: A list of session layer names base_address: The base address to identify the layers that can access it Returns: Layer name or None if no layers that contain the base address can be found N)layersis_valid)r(r1rgrhr8s r)find_session_layerzModules.find_session_layersH*) " "J~j)22<@@ "!!!! "tr+c#2K|j|jd}||||} |d}n*#tj$r|d}YnwxYw|jtj d}| dj }| d|} | d } | || jj| z d } | jD]} | Vd S) aLists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Modules as retrieved from PsLoadedModuleList kernel_virtual_offsetrS_KLDR_DATA_TABLE_ENTRY_LDR_DATA_TABLE_ENTRYrPsLoadedModuleList _LIST_ENTRY) object_typerDInLoadOrderLinksT)rsrDabsoluteN)rjr3moduleget_typer SymbolError type_namesplitrrY get_symboladdressrXrelative_child_offsetrCrDrt) r(r1r8rMkvontkrnlmpldr_entry_typery list_head list_entryreloffrvrIs r)r7zModules.list_moduless<$nZ(/0GH>>,:c>RR H%../GHHNN% H H H%../FGGNNN H#,229>BB1E ''(<==E __y_QQ 556HII!*.*?&*HSW!  *  CIIII  sA $A10A1c tjdtjfdtjfdtjfdtfdtfdtfg|S)NOffsetBaseSizeNamePathz File output)r TreeGridr rBstrrL)rGs r)runz Modules.runsb!<+,)*)*  $   OO     r+)N)__name__ __module__ __qualname____doc___required_framework_version_version classmethodrr configurationRequirementInterfacer*rLr1ContextInterfacerintrrfrrlobjectsObjectInterfacer7rr+r)rrs**"+H j&>&S!T   [ 6***X  8"8"#48"8" 8" 3i 8" 3d? # 8"8"8"[8"t#4!  [4$#4$$ $ *$4 5 $$$[$L      r+r)loggingtypingrrrvolatility3.frameworkrrrr #volatility3.framework.configurationr volatility3.framework.renderersr volatility3.framework.symbolsr 0volatility3.framework.symbols.windows.extensionsr volatility3.plugins.windowsrr getLoggerrr\pluginsPluginInterfacerrr+r)rs ,,,,,,,,,,++++++88888888++++++<<<<<<888888222222??????77777777  8 $ $V V V V V j 0V V V V V r+