
    Xf                         d dl Z d dlmZmZmZmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ  e j$                  e      Z G d d	ej*                  j,                        Zy)
    N)	GeneratorIteratorListTuple)
interfaces	renderers)requirements)utility)format_hints)pslistvadinfoc                       e Zd ZdZdZdZedeej                  j                     fd       Zdeej                  j                  ddf   dee   fdZdej&                  fd	Zy)
VadWalkzWalk the VAD tree.   r   r   )   r   r   returnc           	         t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
t        dd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)	r	   ModuleRequirementPluginRequirementr   PsListr   VadInfoListRequirementint)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadwalk.pyget_requirementszVadWalk.get_requirements   s|     **,()4
 **fmmY **w	 (( W	
 	
    procsNc              #      K   |D ]t  }t         j                  j                  |      D ]N  }|sd|j                  t	        j
                  |j                        t        j                  |j                  j                        t        j                  |j                         | j                  j                  |j                  j                     j                  z        t        j                  |j!                               t        j                  |j#                               t        j                  |j%                               t        j                  |j'                               |j)                         f	f Q w y w)Nr   )r   r#   	list_vadsUniqueProcessIdr
   array_to_stringImageFileNamer   Hexvoloffset
get_parentcontextlayers
layer_nameaddress_maskget_left_childget_right_child	get_startget_endget_tag)selfr*   procvads       r'   
_generatorzVadWalk._generator-   s      	D006  00#33D4F4FG(,,SWW^^<(,, # 0"&,,"5"5cgg6H6H"I"V"V!W ),,S-?-?-AB(,,S-@-@-BC(,,S]]_=(,,S[[];KKM 	s   ,E>EE>c                 ~   | j                   j                  | j                  d      }t        j                  j                  | j                  j                  dd             }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        j                  fdt        j                  fd	t        j                  fd
t        j                  fdt        fg	| j                  t        j                  j                  | j                   |j                  |j                   |                  S )Nr   r   PIDProcessOffsetParentLeftRightStartEndTag)r4   r6   symbol_tablefilter_func)r4   modulesconfigr   r"   create_pid_filtergetr   TreeGridr%   strr   r0   r@   list_processesr6   symbol_table_name)r=   r   rL   s      r'   runzVadWalk.runE   s   %%dkk(&;<mm55dkkooeT6RS!!C <++,<++,))*,**+,**+(()
 OO,, LL%00!'!9!9 +	 - 
 	
r)   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer(   r   objectsObjectInterfacer   r   r@   r   rQ   rU    r)   r'   r   r      s}    "+H
j&>&>&S&S!T 
 
*z11AA4MN	%0
Y'' 
r)   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerrV   vollogpluginsPluginInterfacer   ra   r)   r'   <module>rm      sK   
  3 3 7 < 1 8 7			8	$L
j  00 L
r)   