
    Xf                         d dl Z d dlmZmZmZmZ d dlmZmZ d dlm	Z	 d dlm
Z
mZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ  G d dej                  ZdS )    N)AnyIteratorListTuple)	constants
interfaces)contexts)
exceptionssymbols)	renderers)requirements)plugins)format_hints)modulesc            	           e Zd ZdZdZdZedeej	        j
                 fd            Zedej        j        dededej        fd	            Zdeeeeeeeef         f                  fd
Zdej        fdZdS )SSDTzLists the system call table.)   r   r      r   r   returnc                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   Modules)clss    \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/ssdt.pyget_requirementszSSDT.get_requirements   sQ     *,()4  
 *w	  	
 		
    context
layer_namesymbol_tablec           	         t           j                            |||          }g }|D ]}	 |j                                        }n# t
          j        $ r Y .w xY wt          j        	                    |          d         }d}	|t          j        j        v r|}	t          j                            ||||j        |j        |	          }
|                    |
           t          j        |          S )a  Builds a collection of modules.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A Module collection of available modules based on `Modules.list_modules`
        r   N)r'   module_namer(   offsetsizesymbol_table_name)r   r"   list_modulesBaseDllName
get_stringr
   InvalidAddressExceptionospathsplitextr   windowsKERNEL_MODULE_NAMESr	   SizedModulecreateDllBaseSizeOfImageappendModuleCollection)r#   r'   r(   r)   modscontext_modulesmodmodule_name_with_extr+   r.   context_modules              r$   build_module_collectionzSSDT.build_module_collection%   s   $ ++GZNN 	3 	3C'*'A'A'C'C$$5    '**+?@@CK $i/CCC$0!%188'%{_"3 9  N "">2222(999s   AAAc           
   #     K   | j         j        | j        d                  }|j        }|                     | j         ||j                  }| j         j        |         j        d         | j                             |j        |          }|                    d          j	        |                    d          j	        }|
                    d|          }t          j        | j         |j                  }|rd}d	t          d
t          ffd}	|	}
nd}d	t          d
t          fd}|}
|
                    d|                    |          |          }t          |          D ]\  }} |
|          }|                    |          }|D ]|\  }}d}|D ]C}d}d|t#          j        |          ||                    t(          j                  d         ffV  D|s-d|t#          j        |          |t-          j                    ffV  }d S )Nr   kernel_virtual_offset)r(   r,   KiServiceTableKiServiceLimitint)object_typer,   longfuncr   c                     z   | dz	  z   S )N    )rK   kvoservice_table_addresss    r$   kvo_calculatorz'SSDT._generator.<locals>.kvo_calculatorq   s    22dai@@r&   zunsigned longc                     | S )NrN   )rK   s    r$   passthroughz$SSDT._generator.<locals>.passthroughx   s    r&   array)rI   r,   subtypecountFTr   r   )r'   r   configr(   rC   r.   layersmodule
get_symboladdressobjectr   symbol_table_is_64bitrH   get_type	enumerate'get_module_symbols_by_absolute_locationr   Hexsplitr   BANGr   NotAvailableValue)selfr   r(   
collectionntkrnlmpservice_limit_addressservice_limitis_kernel_64array_subtyperQ   find_addressrS   	functionsidxfunction_objfunctionmodule_symbolsr+   symbol_generatorsymbols_foundsymbolrO   rP   s                        @@r$   
_generatorzSSDT._generatorT   s     %dk(&;<&
11L*f&>
 

 l!*-45LM<&&$C ' 
 
 !) 3 34D E E M ( 3 34D E E M EBWXX
 4L&2
 
  	'"MAS AS A A A A A A A *LL+M# #     'LOO(%%m44	 $ 
 
	 "+9!5!5 	 	C#|L11H'OO N 2@  -- %. 
 
F$(M(,X66'"LL88;	     % 	(,X66'%799	   !	 	r&   c                     t          j        dt          fdt          j        fdt
          fdt
          fg|                                           S )NIndexAddressModuleSymbol)r   TreeGridrH   r   ra   strru   )re   s    r$   runzSSDT.run   sK    !#L,-33	 OO
 
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer%   r'   ContextInterfacer|   r	   r=   rC   r   r   rH   r   ru   r   r{   r}   rN   r&   r$   r   r      s       &&"+H

j&>&S!T 

 

 

 [

 ,:#4,: ,: 	,:
 
	",: ,: ,: [,:\NHU3c3S6H0I+I%JK N N N N`	
Y' 	
 	
 	
 	
 	
 	
r&   r   )r3   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.plugins.windowsr   PluginInterfacer   rN   r&   r$   <module>r      s  
 
			 - - - - - - - - - - - - 7 7 7 7 7 7 7 7 * * * * * * 5 5 5 5 5 5 5 5 + + + + + + < < < < < < 4 4 4 4 4 4 8 8 8 8 8 8 / / / / / /[
 [
 [
 [
 [
7" [
 [
 [
 [
 [
r&   