
    [
#g                         d dl Z d dlmZmZmZmZ d dlmZmZ d dlm	Z	 d dlm
Z
mZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ  G d dej*                        Zy)    N)AnyIteratorListTuple)	constants
interfaces)contexts)
exceptionssymbols)	renderers)requirements)plugins)format_hints)modulesc            	          e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  dededej                   fd	       Zdeeeeeeeef   f      fd
Zdej0                  fdZy)SSDTzLists the system call table.   r   r   )   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   Modules)clss    \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/ssdt.pyget_requirementszSSDT.get_requirements   sE     **,()4
 **w		
 		
    context
layer_namesymbol_tablec           	          t         j                  j                  |||      }g }|D ]  }	 |j                  j	                         }t        j                  j                  |      d   }d}	|t        j                  j                  v r|}	t        j                  j                  ||||j                   |j"                  |	      }
|j%                  |
        t        j&                  |      S # t
        j                  $ r Y w xY w)a  Builds a collection of modules.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A Module collection of available modules based on `Modules.list_modules`
        r   N)r'   module_namer(   offsetsizesymbol_table_name)r   r"   list_modulesBaseDllName
get_stringr
   InvalidAddressExceptionospathsplitextr   windowsKERNEL_MODULE_NAMESr	   SizedModulecreateDllBaseSizeOfImageappendModuleCollection)r#   r'   r(   r)   modscontext_modulesmodmodule_name_with_extr+   r.   context_modules              r$   build_module_collectionzSSDT.build_module_collection%   s    $ ++GZNC'*'A'A'C$
 ''**+?@CK $i//CCC$0!%1188'%{{__"3 9 N "">2- 0 ((99+ 55 s   C''C=<C=c           
   #   H  K   | j                   j                  | j                  d      }|j                  }| j	                  | j                   ||j
                        }| j                   j                  |   j                  d   | j                   j                  |j
                  |      }|j                  d      j                  |j                  d      j                  }|j                  d|      }t        j                  | j                   |j
                        }|rd}d	t        d
t        ffd}	|	}
nd}d	t        d
t        fd}|}
|j                  d|j                  |      |      }t        |      D ]  \  }} |
|      }|j!                  |      }|D ]  \  }}d}|D ]A  }d}d|t#        j$                  |      ||j'                  t(        j*                        d   ff C |rQd|t#        j$                  |      |t-        j.                         ff   y w)Nr   kernel_virtual_offset)r(   r,   KiServiceTableKiServiceLimitint)object_typer,   longfuncr   c                     z   | dz	  z   S )N    )rK   kvoservice_table_addresss    r$   kvo_calculatorz'SSDT._generator.<locals>.kvo_calculatorq   s    22dai@@r&   zunsigned longc                     | S )NrN   )rK   s    r$   passthroughz$SSDT._generator.<locals>.passthroughx   s    r&   array)rI   r,   subtypecountFTr   r   )r'   r   configr(   rC   r.   layersmodule
get_symboladdressobjectr   symbol_table_is_64bitrH   get_type	enumerate'get_module_symbols_by_absolute_locationr   Hexsplitr   BANGr   NotAvailableValue)selfr   r(   
collectionntkrnlmpservice_limit_addressservice_limitis_kernel_64array_subtyperQ   find_addressrS   	functionsidxfunction_objfunctionmodule_symbolsr+   symbol_generatorsymbols_foundsymbolrO   rP   s                        @@r$   
_generatorzSSDT._generatorT   s;    %%dkk(&;<&&
11LL*f&>&>

 ll!!*-445LM<<&&$$C ' 
 !) 3 34D E M M ( 3 34D E M M EBWX
 44LL&22
 "MAS AS A *L+M# #  'LOO(%%m4	 $ 
	 "+9!5C#L1H'OON 2@-- %.F$(M(,,X6'"LL8;	  / %(,,X6'%779	 ! 2@ "6s   G)H".4H"c                     t        j                  dt        fdt        j                  fdt
        fdt
        fg| j                               S )NIndexAddressModuleSymbol)r   TreeGridrH   r   ra   strru   )re   s    r$   runzSSDT.run   sI    !!#L,,-33	 OO
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer%   r'   ContextInterfacer|   r	   r=   rC   r   r   rH   r   ru   r   r{   r}   rN   r&   r$   r   r      s    &"+H

j&>&>&S&S!T 

 

 ,:##44,: ,: 	,:
 
	"	",: ,:\NHU3c3S6H0I+I%JK N`	
Y'' 	
r&   r   )r3   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.plugins.windowsr   PluginInterfacer   rN   r&   r$   <module>r      s<   
 
 - - 7 * 5 + < 4 8 /[
7"" [
r&   