
    Xf`                         d dl Z d dlmZmZmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ  e j        e          Z G d d	ej        j                  ZdS )
    N)IterableListTuple)
interfaces	renderers)requirements)format_hints)yarascan)pslistc                       e Zd ZdZdZdZedeej	        j
                 fd            Zd Zedej        j        deeeef                  fd            Zd	 Zd
S )VadYaraScanz@Scans all the Virtual Address Descriptor memory maps using yara.)      r   )   r   r   returnc           
      t   t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          t          j        dt          j        d          t          j	        dt          dd          g}t          j                                        }||z   S )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionyarascanner)r   	componentr   r
   )r   r   r   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr   PsListVersionRequirementr
   YaraScannerYaraScanListRequirementint get_yarascan_option_requirements)clsvadyarascan_requirementsyarascan_requirementss      c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadyarascan.pyget_requirementszVadYaraScan.get_requirements   s     *,()4  
 *fmY   +"h.BI   *(99   ( W	  $
 0 !) 1 R R T T %'???    c              #     K   | j         j        | j        d                  }t          j                            t          | j                            }t          j        	                    | j        
                    dd                     }t          j                            | j         |j        |j        |          D ]}|                                }| j         j        |         }|                    | j         t          j        |          |                     |                    D ])\  }}}	}
dt'          j        |          |j        ||	|
ffV  *d S )Nr   r   )context
layer_namesymbol_tablefilter_func)rules)r0   scannersectionsr   )r0   modulesconfigr
   r%   process_yara_optionsdictr   r"   create_pid_filtergetlist_processesr1   symbol_table_nameadd_process_layerlayersscanr$   get_vad_mapsr	   HexUniqueProcessId)selfr   r4   r3   taskr1   layeroffset	rule_namer   values              r,   
_generatorzVadYaraScan._generator7   s^     %dk(&;<!66tDK7H7HIIm55dkooeT6R6RSSM00L(1#	 1 
 
 	 	D //11JL'
3E27** ,5999**400 3= 3 3  .	4
  $V,,(     	 	r.   rF   c              #      K   |                                  }|                                D ],}|                                |                                fV  -dS )a!  Creates a map of start/end addresses within a virtual address
        descriptor tree.

        Args:
            task: The EPROCESS object of which to traverse the vad tree

        Returns:
            An iterable of tuples containing start and end addresses for each descriptor
        N)get_vad_roottraverse	get_startget_size)rF   vad_rootvads      r,   rB   zVadYaraScan.get_vad_mapsS   sb       $$&&$$&& 	4 	4C==??CLLNN33333	4 	4r.   c                     t          j        dt          j        fdt          fdt
          fdt
          fdt          fg|                                           S )NOffsetPIDRule	ComponentValue)r   TreeGridr	   rC   r'   strbytesrK   )rE   s    r,   runzVadYaraScan.rund   sT    !<+,c"%  OO	
 	
 		
r.   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer-   rK   staticmethodobjectsObjectInterfacer   r   r'   rB   r\    r.   r,   r   r      s        JJ"+H@j&>&S!T @ @ @ [@>  8 4 04	%S/	"4 4 4 \4 

 

 

 

 

r.   r   )loggingtypingr   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.pluginsr
   volatility3.plugins.windowsr   	getLoggerr]   vollogpluginsPluginInterfacer   ri   r.   r,   <module>ru      s   
  ( ( ( ( ( ( ( ( ( ( 7 7 7 7 7 7 7 7 < < < < < < 8 8 8 8 8 8 ( ( ( ( ( ( . . . . . .		8	$	$]
 ]
 ]
 ]
 ]
*$4 ]
 ]
 ]
 ]
 ]
r.   