
    [
#g)                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ  e j$                  e      Z G d d	ej*                        Zy)
    N)ListOptionalTuple)
interfaces
exceptionssymbols)requirements)versions)svcscanpslist)scannersc            	            e Zd ZdZdZ fdZedeej                  j                     fd       Zedeeeef      fd       Zedej                   j"                  ded	ed
efd       Z xZS )SvcListzMLists services contained with the services.exe doubly linked list of services)   r   r   c                 F    t        |   |i | | j                  | _        y )N)super__init__service_list_enumeration_method)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/svclist.pyr   zSvcList.__init__   s#    $)&)#'#4#4     returnc                     t        j                  dt        j                  d      t        j                  ddddg      gS )	Nr   )   r   r   )namepluginversionkernelzWindows kernelIntel32Intel64)r   descriptionarchitectures)r	   PluginRequirementr   SvcScanModuleRequirement)clss    r   get_requirementszSvcList.get_requirements   sE     **w	 **,()4		
 		
r   c                    |j                         }|j                         D ]e  }|j                         }t        |t              s$|j                         j                  d      sD|j                         |j                         fgc S  y)zh
        Returns a tuple of starting,ending address for
        the VAD containing services.exe
        z\services.exeN)	get_vad_roottraverseget_file_name
isinstancestrlowerendswith	get_startget_size)r*   procvad_rootvadfilenames        r   _get_exe_rangezSvcList._get_exe_range)   su     $$&$$&C((*H(C(X^^-=-F-F . #,,.9:: ' r   context
layer_namesymbol_tableservice_table_namec           	   #     K   t        j                  ||      rt        j                  ||      st        j                  d       y t        j                  j                  ||||      D ]  }	 |j                         }|j                  |   }| j                  |      }	|	st        j                  d       L|j!                  |t#        j$                  d      |	      D ]   }
| j'                  |||||
      D ]  }|  "  y # t        j                  $ r1 t        j                  dj                  |j                               Y w xY ww)	N)r;   r=   zPThis plugin only supports Windows 10 version 15063+ 64bit Windows memory samples)r;   r<   r=   filter_funcz<Unable to access memory of services.exe running with PID: {}zRCould not find the application executable VAD for services.exe. Unable to proceed.s   Sc27)needle)r;   scannersections)r   symbol_table_is_64bitr
   is_win10_15063_or_latervollogwarningr   PsListlist_processesadd_process_layerr   InvalidAddressExceptionformatUniqueProcessIdlayersr:   scanr   BytesScannerenumerate_vista_or_later_header)r*   r;   r<   r=   r>   service_binary_dll_mapr@   r6   layer	exe_rangeoffsetrecords               r   r   zSvcList.service_list:   sO     ,,\
11,
 NNb MM00!%#	 1 
D!335
 NN:.E**40Ih ** --W=" % 
 "AA&*F !L3
 55 RYY,,
 s,   A*E
-D=BE
AEE
EE
)__name__
__module____qualname____doc___versionr   classmethodr   r   configurationRequirementInterfacer+   r   r   intr:   r;   ContextInterfacer1   r   __classcell__)r   s   @r   r   r      s    WH5 
j&>&>&S&S!T 
 
 XeCHo%>    8!##448! 8! 	8!
  8! 8!r   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	   %volatility3.framework.symbols.windowsr
   volatility3.plugins.windowsr   r   volatility3.framework.layersr   	getLoggerrW   rF   r(   r    r   r   <module>rk      sF   
  ( ( A A < : 7 1			8	$a!goo a!r   