
    Xf                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  G d d	ej        j        ej                  ZdS )
    N)Iterable)	renderers
exceptions
interfaces)requirements)format_hints)	timeliner)poolscannerc            
           e Zd ZdZdZed             Zedej        j	        de
de
deej        j                 fd            Zd	 Zd
 Zd ZdS )SymlinkScanz=Scans for links present in a particular windows memory image.)   r   r   c                 6    t          j        ddddg          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r   ModuleRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/symlinkscan.pyget_requirementszSymlinkScan.get_requirements   s1     *,()4  
 	
    context
layer_namesymbol_tablereturnc              #      K   t           j                            |ddg          }t           j                            ||||          D ]}|\  }}}|V  dS )a  Scans for links using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of symlink objects found by scanning memory for the Symlink pool signatures
        s   Syms   SymbN)r
   PoolScannerbuiltin_constraintsgenerate_pool_scan)	r   r   r   r   constraintsresult_constraint
mem_object_headers	            r   scan_symlinkszSymlinkScan.scan_symlinks   s~      $ "-AA:w/
 
 "-@@Z{
 
 	 	F 06,KW		 	r   c              #     K   | j         j        | j        d                  }|                     | j         |j        |j                  D ]}	 |                                }n# t          t          j	        f$ r Y 0w xY w	 |j
        j        }n# t          j	        $ r Y Sw xY wdt          j        |j        j                  |                                ||ffV  d S )Nr   r   )r   modulesconfigr'   r   symbol_table_nameget_link_name
ValueErrorr   InvalidAddressException
LinkTargetStringr   Hexvoloffsetget_create_time)selfr   link	from_nameto_names        r   
_generatorzSymlinkScan._generator:   s     %dk(&;<&&L&+V-E
 
 	 	D ..00		
 BC   /05     $TX_55((**	    	 	s$   	AA76A7;BBBc              #      K   |                                  D ]7}|\  }}d|d          d|d          }|t          j        j        |d         fV  8d S )Nz	Symlink: r   z ->       )r9   r	   TimeLinerTypeCREATED)r5   row_depthrow_datar   s        r   generate_timelinezSymlinkScan.generate_timelineT   st      ??$$ 	N 	NC"FHDhqkDDx{DDK	 7 ?!MMMMM	N 	Nr   c                     t          j        dt          j        fdt          j        fdt
          fdt
          fg|                                           S )NOffset
CreateTimez	From NamezTo Name)r   TreeGridr   r1   datetimestrr9   )r5   s    r   runzSymlinkScan.runZ   sQ    !<+,x01c"C 	 OO
 
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   r   ContextInterfacerH   r   objectsObjectInterfacer'   r9   rB   rI    r   r   r   r      s        GG"+
 
 [
 #4  	
 
*$4	5   [6  4N N N	
 	
 	
 	
 	
r   r   )rG   typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.pluginsr	   volatility3.plugins.windowsr
   pluginsPluginInterfaceTimeLinerInterfacer   rS   r   r   <module>r]      s   
        C C C C C C C C C C < < < < < < 8 8 8 8 8 8 ) ) ) ) ) ) 3 3 3 3 3 3T
 T
 T
 T
 T
*$4i6R T
 T
 T
 T
 T
r   