
    [
#g                          d dl Z d dlmZmZmZmZ d dlmZmZm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZ  e j(                  e      Z G d d	ej.                  j0                        Zy)
    N)IteratorListTupleIterable)	renderers
interfaces	constantssymbols)requirements)format_hints)versions)ssdtkpcrsc                       e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  deded	edeeeeef      f
d
       Zdee   fdZd Zy)Timersz.Print kernel timers and associated module DPCs)   r   r      r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   )r   ModuleRequirementPluginRequirementr   SSDTr   KPCRs)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/timers.pyget_requirementszTimers.get_requirements   s`     **,()4
 **DIIy **U[[)
 	
    contextkernel_module_name
layer_namesymbol_tablec              #   `  K   |j                   |   }t        j                  ||      st        j                  ||      rt        j
                  j                  ||||      D ]  }t        |j                  j                  d      rf|j                  j                  j                  D ]B  }|D ];  }|j                  j                  |t        j                  z   dz   d      D ]  }	|	  = D |j                  j                  j                  D ];  }|j                  j                  |t        j                  z   dz   d      D ]  }	|	  =  yt        j                  ||      st        j                   ||      rt#        j$                  ||      }
|
st        j                   ||      rd}nd}|j'                  d|j)                  d      j*                  |j-                  d	      |
      }|D ]1  }|j                  |t        j                  z   dz   d      D ]  }	|	  3 yt/        d      w)a  Lists all kernel timers.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            kernel_module_name: The name of the kernel module on which to operate
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Yields:
            A _KTIMER entry
        )r'   r*   
TableState_KTIMERTimerListEntryi      arrayKiTimerTableListHead_LIST_ENTRY)object_typeoffsetsubtypecountz)This version of Windows is not supported!N)modulesr   is_windows_7is_windows_8_or_laterr   r"   
list_kpcrshasattrPrcb
TimerTableTimerEntriesEntryto_listr	   BANGis_xp_or_2003is_vista_or_laterr
   symbol_table_is_64bitobject
get_symboladdressget_typeNotImplementedError)r#   r'   r(   r)   r*   r   kpcrtimer_entriestimer_entrytimeris_64bit
array_sizetimer_table_list_headtables                 r$   list_timerszTimers.list_timers-   s     ( !34  ,
++G,W ..+Z 499//>)-)=)=)J)J+8K)4):):)B)B ,y~~ =	 I 0* ',	* ,9 *K *.)=)=)J)J%2%8%8%@%@(9>>9IE,&E #(K	& *K( ##,
''lS44WlKH855l
 !
 !
$*MM#(()?@HH6 	 %2 %! /"]] 9>>1I=$E  K	 / &&QRRs   H,H.c              #     K   | j                   j                  | j                  d      }|j                  }|j                  }t
        j                  j                  | j                   |j                  |j                        }| j                  | j                   | j                  d   ||      D ]  }|j                         s	 |j                         }|dk(  r,|j                  dk(  r<|j                  }t        |j                  |            }	|	r(|	D ]   \  }
}d}|D ]  }d}dt        j                   |j"                  j$                        |j'                         |j(                  |j+                         t        j                   |      |
|j-                  t.        j0                        d   ff  |rdt        j                   |j"                  j$                        |j'                         |j(                  |j+                         t        j                   |      |
t3        j4                         ff # dt        j                   |j"                  j$                        |j'                         |j(                  |j+                         t        j                   |      t3        j4                         t3        j4                         ff   y # t        $ r}Y d }~1d }~ww xY ww)Nr   r   FTr   )r'   r7   configr)   symbol_table_namer   r!   build_module_collectionrR   
valid_typeget_dpcDeferredRoutine	Exceptionlist'get_module_symbols_by_absolute_locationr   Hexvolr4   get_due_timePeriodget_signaledsplitr	   rA   r   NotAvailableValue)selfr   r)   r*   
collectionrM   dpcdeferred_routineemodule_symbolsmodule_namesymbol_generatorsymbols_foundsymbols                 r$   
_generatorzTimers._generator{   s    %%dkk(&;<&&
//YY66LL&++V-E-E

 %%LL$++h/\
E ##%mmo!8&&!+#&#6#6  "BBCSTN 5C1K!1$)M #3(, , 0 01A1A B % 2 2 4 % % 2 2 4 , 0 01A B + &Y^^ <Q ?  #3  ) , 0 01A1A B % 2 2 4 % % 2 2 4 , 0 01A B + ) ; ; = + 6DH $(()9)9:**,**,$(()9:!335!335 o
  sJ   B>K$KK$K&K$'K3C K$4DK$	K!K$K!!K$c           
          t        j                  dt        j                  fdt        fdt
        fdt        fdt        j                  fdt        fdt        fg| j                               S )NOffsetDueTimez
Period(ms)SignaledRoutineModuleSymbol)r   TreeGridr   r]   strintrn   )rd   s    r$   runz
Timers.run   sh    !!<++,C s#S!L,,-33 OO
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer%   r'   ContextInterfacerw   r   r   rx   rR   r   rn   ry    r&   r$   r   r      s    8"+H
j&>&>&S&S!T 
 
 KS##44KS  KS 	KS
 KS 
%S#&	'KS KSZKHUO KZ
r&   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.renderersr   %volatility3.framework.symbols.windowsr   volatility3.plugins.windowsr   r   	getLoggerrz   vollogpluginsPluginInterfacer   r   r&   r$   <module>r      sT   
  2 2  = 8 : 3			8	$}
Z// }
r&   