
    [
#g5                        d dl Z d dlZd dlmZmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ  e j*                  e      Z G d dej0                  j2                  ej4                        Zy)    N)ListIterable)	constants)
interfacessymbols)	renderers)requirements)configuration)format_hints
conversion)intermed)	timelinerc                   4   e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  dededefd	       Zedej                  j                  d
edededeej$                  j&                     f
d       Zd Zd Zd Zy)UnloadedModulesz"Lists the unloaded kernel modules.)   r   r   )   r   r   returnc                 8    t        j                  ddddg      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r	   ModuleRequirement)clss    g/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/unloadedmodules.pyget_requirementsz UnloadedModules.get_requirements   s*     **,()4
 	
    contextsymbol_tableconfig_pathc                     | j                   |   j                  }t        j                  | |      }d|i}|rd}nd}t        j
                  j                  | t        j                  |d      d|||      S )a  Creates a symbol table for the unloaded modules.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            symbol_table: The name of an existing symbol table containing the kernel symbols
            config_path: The configuration path within the context of the symbol table to create

        Returns:
            The name of the constructed unloaded modules table
        
nt_symbolszunloadedmodules-x64zunloadedmodules-x86unloadedmoduleswindows)native_typestable_mapping)	symbol_spacenativesr   symbol_table_is_64bitr   IntermediateSymbolTablecreater
   	path_join)r    r!   r"   r'   is_64bitr(   symbol_filenames          r   create_unloadedmodules_tablez,UnloadedModules.create_unloadedmodules_table%   s      ++L9AA00,G%|43O3O//66##K1BC%' 7 
 	
r   
layer_nameunloadedmodule_table_namec              #     K   |j                   |   j                  d   }|j                  |||      }|j                  d      j                  }|j                  d|d      }t        j                  ||      }	|	rd}
nd}
|j                  d	      j                  }|j                  |
|
      }|j                  |t        j                  z   dz   ||      }||j                  _        |j                  D ]  }|  yw)a  Lists all the unloaded modules in the primary layer.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of Unloaded Modules as retrieved from MmUnloadedDrivers
        kernel_virtual_offset)r2   offsetMmUnloadedDriverspointerarray)object_typer6   subtypezunsigned long longzunsigned longMmLastUnloadedDriver)r:   r6   _UNLOADED_DRIVERS)r:   r2   r6   N)layersconfigmodule
get_symboladdressobjectr   r+   r   BANGUnloadedDriverscount)r   r    r2   r!   r3   kvontkrnlmpunloadedmodules_offsetr%   r/   unloaded_count_typelast_unloadedmodule_offsetunloaded_countunloadedmodules_arraymods                  r   list_unloadedmodulesz$UnloadedModules.list_unloadedmodulesG   s    & nnZ(//0GH>>,:c>R!)!4!45H!I!Q!Q"//!) * 

 00,G"6"1%-%8%89O%P%X%X"!+4N ) 
 !(1nn!" "" !/ !
 7E--3(88CI 9s   C:C<c              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  | j
                        }| j                  | j                   |j                  |j                  |      D ]w  }d|j                  j                  t        j                  |j                        t        j                  |j                        t        j                  |j                         ff y y w)Nr   r   )r    modulesr?   r1   symbol_table_namer"   rO   r2   NameStringr   HexStartAddress
EndAddressr   wintime_to_datetimeCurrentTime)selfr   r3   rN   s       r   
_generatorzUnloadedModules._generatorz   s     %%dkk(&;<$($E$ELL&22D4D4D%
! ,,LL$$%	
C HHOO $$S%5%56 $$S^^4223??C	 
s   DDc              #      K   | j                         D ]1  }|\  }}d|d    }|t        j                  j                  |d   f 3 y w)NzUnloaded Module: r      )r[   r   TimeLinerTypeCHANGED)rZ   row_depthrow_datar   s        r   generate_timelinez!UnloadedModules.generate_timeline   sN     ??$C"FH-hqk];K	 7 7 ? ?!MM %s   AAc                     t        j                  dt        fdt        j                  fdt        j                  fdt
        j
                  fg| j                               S )NrS   rV   rW   Time)r   TreeGridstrr   rU   datetimer[   )rZ   s    r   runzUnloadedModules.run   sW    !!!1!12|//0**+	 OO
 	
r   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r
   RequirementInterfacer   staticmethodr    ContextInterfacerg   r1   r   objectsObjectInterfacerO   r[   rc   ri    r   r   r   r      s    ,"+H
j&>&>&S&S!T 
 
 
##44

 
 
	
 
B 0##440 0 	0
 $'0 
*$$44	50 0d.N	
r   r   )loggingrh   typingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.renderersr   r   volatility3.framework.symbolsr   volatility3.pluginsr   	getLoggerrj   vollogpluginsPluginInterfaceTimeLinerInterfacer   rv   r   r   <module>r      s\   
   ! + 5 + < : D 2 )			8	$K
j((88):V:V K
r   