
    [
#g                         d dl Z d dlmZmZ d dlmZ d dlmZmZ d dl	m
Z
  e j                  e      Z G d dej                        Zy)    N)symbols
interfaces)requirements)svclistsvcscan)versionsc            	            e Zd ZdZdZ fdZed        Zedej                  j                  dededefd	       Z xZS )
SvcDiffzMCompares services found through list walking versus scanning to find rootkits)      r   c                 F    t        |   |i | | j                  | _        y )N)super__init__service_diff_enumeration_method)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/svcdiff.pyr   zSvcDiff.__init__   s#    $)&)#'#4#4     c                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   	componentversionr   )   r   r   )r   ModuleRequirementVersionRequirementr   SvcListr   SvcScan)clss    r   get_requirementszSvcDiff.get_requirements!   s`     **,()4
 ++'//9 ++'//9
 	
r   context
layer_namesymbol_tableservice_table_namec              #     K   t        j                  ||      rt        j                  ||      st        j                  d       yt               }t               }i }	t        j                  j                  ||||||      D ]  }
|j                  |
d          |
|	|
d   <     t        j                  j                  ||||||      D ]  }
|j                  |
d           ||z
  D ]	  }|	|     yw)z
        On Windows 10 version 15063+ 64bit Windows memory samples, walk the services list
        and scan for services then report differences
        )r)   r+   zPThis plugin only supports Windows 10 version 15063+ 64bit Windows memory samplesN   )r   symbol_table_is_64bitr   is_win10_15063_or_latervollogwarningsetr   r&   service_scanaddr   r%   service_list)r'   r)   r*   r+   r,   service_binary_dll_mapfilter_func	from_scan	from_listrecordsservicehidden_services               r   r   zSvcDiff.service_diff2   s      ,,\
11,
 NNb E	E	 33"
G MM'!*%")GGAJ
 33"
G MM'!*%
 ()3N.)) 4s   C.C0)__name__
__module____qualname____doc___required_framework_versionr   classmethodr(   r   r)   ContextInterfacestrr   __classcell__)r   s   @r   r
   r
      sk    W"+5 
 
  4*##444* 4* 	4*
  4* 4*r   r
   )loggingvolatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.plugins.windowsr   r   %volatility3.framework.symbols.windowsr   	getLoggerr>   r1   r&   r
    r   r   <module>rN      s:     5 < 8 :			8	$O*goo O*r   