[ #g%ddlZddlmZmZmZddlmZmZmZm Z ddl m Z ddl m Z ddlmZddlmZddlmZmZej*eZGd d ej0j2Zy) N)ListIterable Generator) exceptions interfaces constants renderers) requirements) format_hints)intermed)pe)pslistpedumpceZdZdZdZdZfdZedee jjfdZ dZ dZe dd e jj d ed ed eedeeddff d Zed e jj deedefdZed e jj d ed edee j.j0fdZdZxZS)Modulesz Lists the loaded kernel modules.rrcFt||i||j|_yN)super__init__ list_modules_enumeration_method)selfargskwargs __class__s _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/modules.pyrzModules.__init__s# $)&)#'#4#4 returnc Ztjddddgtjdtjdtj d d d d tj ddd tjddd dtjdtjdgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)r% componentversiondumpzExtract listed modulesFT)r%r&defaultoptionalbasez)Extract a single module with BASE address)r%r&r,r%zmodule name/sub string)r%r&r,r+r)rr) r ModuleRequirementVersionRequirementrPsListBooleanRequirementIntRequirementStringRequirementrPEDump)clss rget_requirementszModules.get_requirementss  * *,()4   + +    + +4    ' 'G   * *4    + +  5  rc|j|j||j}d|jd}|r:I9=H>>I91I62I95I66I9Nr;r9 symbol_tablepidsc#>Kg}tjj|xsg}tjj||||D]}d} |j}|j } |j |tjzdz||j} | j|vrc |j#| j| y#tj$r6tjtjdj!|YwxYww)aOBuild a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols pids: A list of process identifiers to include exclusively or None for no filter Returns: A list of session layer names )r;r9r[ filter_funcUnknown_MM_SESSION_SPACEr9rXzSProcess {} does not have a valid Session or a layer could not be constructed for itN)rr1create_pid_filterlist_processesUniqueProcessIdadd_process_layerobjectrBANGSession SessionIdrrSvolloglog LOGLEVEL_VVVformatappend) r6r;r9r[r\seen_idsr^procproc_idproc_layer_name session_spaces rrOzModules.get_session_layerss*>@mm55djbA MM00!%# 1 D  G .."&"8"8":!( 9>>14GG)<<!/! !**h67 OOM33 4! !C ,55  **ipp  s,ADAC-$DADDDDr? base_addresscV|D]$}|j|j|s"|cSy)agGiven a base address and a list of layer names, find a layer that can access the specified address. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols session_layers: A list of session layer names base_address: The base address to identify the layers that can access it Returns: Layer name or None if no layers that contain the base address can be found N)layersis_valid)r6r;r?rtr9s rr:zModules.find_session_layers0*)J~~j)22<@!!)rc#:K|j|jd}|j|||} |jd}|j jtjd}|jdj}|jd|} |jd } |j|| jj| z d } | j D]} | y #tj $r|jd}YwxYww) aLists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols Returns: A list of Modules as retrieved from PsLoadedModuleList kernel_virtual_offsetra_KLDR_DATA_TABLE_ENTRY_LDR_DATA_TABLE_ENTRYr.PsLoadedModuleList _LIST_ENTRY) object_typerXInLoadOrderLinksT)r~rXabsoluteN)rvrJmoduleget_typer SymbolError type_namesplitrrg get_symboladdressrfrelative_child_offsetrWrXr) r6r;r9r[kvontkrnlmpldr_entry_typer list_head list_entryreloffrrAs rrzModules.list_moduless$nnZ(//0GH>>,:c>R H%../GHN#,,229>>B1E ''(<=EE __y_Q 556HI!*..*?*?&*HSW! **CI+%% H%../FGN Hs)1DC1B,D1$DDDDc tjdtjfdtjfdtjfdtfdtfdtfg|j S)NOffsetBaseSizeNamePathz File output)r TreeGridr rVstrrZ)rs rrunz Modules.runsf!!<++,))*))*  $   OO   rr)__name__ __module__ __qualname____doc___required_framework_version_versionr classmethodrr configurationRequirementInterfacer7rDrZr;ContextInterfacerintrrOrr:objectsObjectInterfacerr __classcell__)rs@rrrsP*"+H5 j&>&>&S&S!T  @$3j  8"##448"8" 8" 3i 8" 3d? # 8"8"t##44!  4$##44$$ $ *$$44 5 $$L  rr)loggingtypingrrrvolatility3.frameworkrrrr #volatility3.framework.configurationr volatility3.framework.renderersr volatility3.framework.symbolsr 0volatility3.framework.symbols.windows.extensionsr volatility3.plugins.windowsrr getLoggerrrjpluginsPluginInterfacerrrrsQ,,NN<82?6   8 $z j  00z r