
    Xf                         d dl Z d dlmZmZmZmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ  e j        e          Z G d d	ej        j                  ZdS )
    N)	GeneratorIteratorListTuple)
interfaces	renderers)requirements)utility)format_hints)pslistvadinfoc                       e Zd ZdZdZdZedeej	        j
                 fd            Zdeej        j        ddf         dee         fdZdej        fd	ZdS )
VadWalkzWalk the VAD tree.   r   r   )   r   r   returnc           	          t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          t          j        d
t          dd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)	r	   ModuleRequirementPluginRequirementr   PsListr   VadInfoListRequirementint)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadwalk.pyget_requirementszVadWalk.get_requirements   s     *,()4  
 *fmY   *w	   ( W	  
 	
    procsNc              #     K   |D ]Y}t           j                            |          D ]5}|r/d|j        t	          j        |j                  t          j        |j	        j
                  t          j        |                                | j        j        |j	        j                 j        z            t          j        |                                          t          j        |                                          t          j        |                                          t          j        |                                          |                                f	fV  7[d S )Nr   )r   r#   	list_vadsUniqueProcessIdr
   array_to_stringImageFileNamer   Hexvoloffset
get_parentcontextlayers
layer_nameaddress_maskget_left_childget_right_child	get_startget_endget_tag)selfr*   procvads       r'   
_generatorzVadWalk._generator-   s8       	 	D0066    0#3D4FGG(,SW^<<(, # 0 0"&,"5cg6H"I"V!W  ),S-?-?-A-ABB(,S-@-@-B-BCC(,S]]__==(,S[[]];;KKMM   	 	r)   c                 (   | j         j        | j        d                  }t          j                            | j                            dd                     }t          j        dt          fdt          fdt          j        fdt          j        fdt          j        fdt          j        fd	t          j        fd
t          j        fdt          fg	|                     t          j                            | j         |j        |j        |                              S )Nr   r   PIDProcessOffsetParentLeftRightStartEndTag)r4   r6   symbol_tablefilter_func)r4   modulesconfigr   r"   create_pid_filtergetr   TreeGridr%   strr   r0   r@   list_processesr6   symbol_table_name)r=   r   rL   s      r'   runzVadWalk.runE   s    %dk(&;<m55dkooeT6R6RSS!C <+,<+,)*,*+,*+()
 OO,, L%0!'!9 +	 -   
 
 	
r)   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer(   r   objectsObjectInterfacer   r   r@   r   rQ   rU    r)   r'   r   r      s        "+H
j&>&S!T 
 
 
 [
*z1A4MN	%   0
Y' 
 
 
 
 
 
r)   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerrV   vollogpluginsPluginInterfacer   ra   r)   r'   <module>rm      s   
  3 3 3 3 3 3 3 3 3 3 3 3 7 7 7 7 7 7 7 7 < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 7 7 7 7 7 7 7 7		8	$	$L
 L
 L
 L
 L
j 0 L
 L
 L
 L
 L
r)   