
    [
#g                         d dl Z d dlmZmZ d dlmZmZ d dlmZ d dl	m
Z
mZ  e j                  e      Z G d de
j                        Zy)    N)List	Generator)
interfacessymbols)requirements)thrdscanssdtc            
            e Zd ZdZdZdZ fdZedee	j                  j                     fd       Zede	j                  j                  dedee	j"                  j$                  d	d	f   fd
       Z xZS )ThreadszLists process threads)      r      r   r   c                 F    t        |   |i | | j                  | _        y )N)super__init__list_orphan_kernel_threadsimplementation)selfargskwargs	__class__s      m/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/orphan_kernel_threads.pyr   zThreads.__init__   s#    $)&)"==    returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r    pluginversionr	   r   )r   ModuleRequirementPluginRequirementr   ThrdScanr	   SSDT)clss    r   get_requirementszThreads.get_requirements   sb     **,()4
 **(9(99 **DIIy
 	
r   contextmodule_nameNc              #     K   |j                   |   }|j                  }|j                  }t        j                  j                  |||      }t        j                  ||      rd}nd}t        j                  j                  ||      D ]m  }	 |j                         }	|	j                  dk7  r|	j                  dk7  r3|j                  |k  rCt!        |j#                  |j                              }
|
rj| o y# t        $ r Y |w xY ww)a+  Yields thread objects of kernel threads that do not map to a module

        Args:
            cls
            context: the context to operate upon
            module_name: name of the module to use for scanning
        Returns:
            A generator of thread objects of orphaned threads
        l        ` l        r   N)modules
layer_namesymbol_table_namer	   r(   build_module_collectionr   symbol_table_is_64bitr   r'   scan_threadsowning_processAttributeErrorUniqueProcessIdInheritedFromUniqueProcessIdStartAddresslist'get_module_symbols_by_absolute_location)r)   r+   r,   moduler/   symbol_table
collectionkernel_startthreadprocmodule_symbolss              r   r   z"Threads.list_orphan_kernel_threads*   s     -&&
//YY66Z

 ((,?-L%L''44WkJF,,. ##q(T-N-NRS-S""\1!BB6CVCVWN
 "1 K " s1   BD
C7AD0D7	D DDD)__name__
__module____qualname____doc___required_framework_version_versionr   classmethodr   r   configurationRequirementInterfacer*   r+   ContextInterfacestrr   objectsObjectInterfacer   __classcell__)r   s   @r   r   r      s    "+H> 
j&>&>&S&S!T 
 
  5##445 5 
:%%55tTA	B	5 5r   r   )loggingtypingr   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.plugins.windowsr   r	   	getLoggerrB   vollogr'   r    r   r   <module>rX      s<   
  " 5 < 6			8	$Qh Qr   