
    Xf
                         d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ  G d dej                  j                        Zy)	    )Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscannerc            
           e Zd ZdZdZed        Zedej                  j                  de
de
deej                  j                     fd       Zd	 Zd
 Zy)
MutantScanz?Scans for mutexes present in a particular windows memory image.)   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/mutantscan.pyget_requirementszMutantScan.get_requirements   sG     **,()4
 **";+B+BI	
 		
    context
layer_namesymbol_tablereturnc              #      K   t         j                  j                  |ddg      }t         j                  j                  ||||      D ]  }|\  }}}|  yw)a  Scans for mutants using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
              A list of Mutant objects found by scanning memory for the Mutant pool signatures
        s   Muts   MutaN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r   r   r    constraintsresult_constraint
mem_object_headers	            r   scan_mutantszMutantScan.scan_mutants   sg     $ "--AA:w/
 "--@@Z{
 	F 06,KW		s   AAc              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        D ]B  }	 |j                         }dt        j                  |j                  j                        |ff D y # t        t        j                  f$ r t        j                         }Y aw xY ww)Nr   r   )r   modulesconfigr*   r   symbol_table_nameget_name
ValueErrorr   InvalidAddressExceptionr   NotApplicableValuer   Hexvoloffset)selfr   mutantr   s       r   
_generatorzMutantScan._generator;   s     %%dkk(&;<''LL&++V-E-E
 	CF6( |''

(9(9:DABB	C
 
 B BC 6 3356s*   ACB .2C -CCCCc                 z    t        j                  dt        j                  fdt        fg| j                               S )NOffsetName)r   TreeGridr   r3   strr8   )r6   s    r   runzMutantScan.runH   s;    !!<++, OO
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   r   ContextInterfacer=   r   objectsObjectInterfacer*   r8   r>    r   r   r   r      s    I"+

 

 ##44  	
 
*$$44	5 6C
r   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   pluginsPluginInterfacer   rH   r   r   <module>rP      s3   
  C C < 8 3B
##33 B
r   