
    Xf                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  G d d	ej                  j                   ej"                        Zy)
    N)Iterable)	renderers
exceptions
interfaces)requirements)format_hints)	timeliner)poolscannerc            
           e Zd ZdZdZed        Zedej                  j                  de
de
deej                  j                     fd       Zd	 Zd
 Zd Zy)SymlinkScanz=Scans for links present in a particular windows memory image.)   r   r   c                 8    t        j                  ddddg      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r   ModuleRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/symlinkscan.pyget_requirementszSymlinkScan.get_requirements   s*     **,()4
 	
    context
layer_namesymbol_tablereturnc              #      K   t         j                  j                  |ddg      }t         j                  j                  ||||      D ]  }|\  }}}|  yw)a  Scans for links using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of symlink objects found by scanning memory for the Symlink pool signatures
        s   Syms   SymbN)r
   PoolScannerbuiltin_constraintsgenerate_pool_scan)	r   r   r   r   constraintsresult_constraint
mem_object_headers	            r   scan_symlinkszSymlinkScan.scan_symlinks   sg     $ "--AA:w/
 "--@@Z{
 	F 06,KW		s   AAc              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        D ]i  }	 |j                         }	 |j                  j                  }dt        j                  |j                  j                        |j!                         ||ff k y # t        t        j                  f$ r Y w xY w# t        j                  $ r Y w xY ww)Nr   r   )r   modulesconfigr'   r   symbol_table_nameget_link_name
ValueErrorr   InvalidAddressException
LinkTargetStringr   Hexvoloffsetget_create_time)selfr   link	from_nameto_names        r   
_generatorzSymlinkScan._generator:   s     %%dkk(&;<&&LL&++V-E-E
 	D ..0	//00
  $$TXX__5((*	 	
 
 B BC 
 55 sI   AC?C/C&AC?C# C?"C##C?&C<9C?;C<<C?c              #      K   | j                         D ]7  }|\  }}d|d    d|d    }|t        j                  j                  |d   f 9 y w)Nz	Symlink: r   z ->       )r9   r	   TimeLinerTypeCREATED)r5   row_depthrow_datar   s        r   generate_timelinezSymlinkScan.generate_timelineT   s_     ??$ 	NC"FH%hqk]$x{mDK	 7 7 ? ?!MM	Ns   AAc                     t        j                  dt        j                  fdt        j                  fdt
        fdt
        fg| j                               S )NOffset
CreateTimez	From NamezTo Name)r   TreeGridr   r1   datetimestrr9   )r5   s    r   runzSymlinkScan.runZ   sR    !!<++,x001c"C 	 OO
 	
r   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   r   ContextInterfacerH   r   objectsObjectInterfacer'   r9   rB   rI    r   r   r   r      s    G"+
 
 ##44  	
 
*$$44	5 64N	
r   r   )rG   typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.pluginsr	   volatility3.plugins.windowsr
   pluginsPluginInterfaceTimeLinerInterfacer   rS   r   r   <module>r]      sA   
   C C < 8 ) 3T
*$$44i6R6R T
r   