
    [
#g                         d dl Z d dlmZmZmZ d dlmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ  e j                   e      Z G d d	ej&                  j(                        Zy)
    N)IterableListTuple)
interfaces	renderers)requirements)format_hints)yarascan)pslistc                       e Zd ZdZdZdZedeej                  j                     fd       Zd Zedej                  j                  deeeef      fd       Zd	 Zy
)VadYaraScanz@Scans all the Virtual Address Descriptor memory maps using yara.)      r   )   r   r   returnc           	      J   t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
t        dd      g}t
        j                  j                         }||z   S )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionr
   pidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)
r   ModuleRequirementPluginRequirementr   PsListr
   YaraScanListRequirementint get_yarascan_option_requirements)clsvadyarascan_requirementsyarascan_requirementss      c/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadyarascan.pyget_requirementszVadYaraScan.get_requirements   s     **,()4
 **fmmY **(9(99 (( W	$
 * !) 1 1 R R T %'???    c              #   N  K   | j                   j                  | j                  d      }t        j                  j                  t        | j                              }t        j                  j                  | j                  j                  dd             }d}t        j                  j                  | j                   |j                  |j                  |      D ]I  }|j                         }| j                   j                  |   }| j!                  |      D ]  \  }}	|	|kD  rt"        j%                  d|dd       '|j'                  ||	d      }
t        j                  j(                  s|j+                  |
	      D ]  }t        j                  j-                         rv|j.                  D ]f  }|j0                  D ]U  }d
t3        j4                  |j6                  |z         |j8                  |j:                  |j<                  |j>                  ff W h |j.                  D ];  \  }}}d
t3        j4                  ||z         |j8                  |j:                  ||ff =  K|jA                  |
      jB                  D ]  }|jD                  D ]  }|jF                  D ]~  }d
t3        j4                  |j6                  |z         |j8                  |jH                   d|j<                   |j<                  |
|j6                  |j6                  |jJ                  z    ff     L y w)Nr   r   i   @)context
layer_namesymbol_tablefilter_funcz	VAD at 0xxz% over sanity-check size, not scanningT)datar   .)&r,   modulesconfigr
   r!   process_yara_optionsdictr   r    create_pid_filtergetlist_processesr-   symbol_table_nameadd_process_layerlayersget_vad_mapsvollogwarnread_yara_xmatchyara_returns_instancesstrings	instancesr	   HexoffsetUniqueProcessIdrule
identifiermatched_datascanmatching_rulespatternsmatches	namespacelength)selfr   rulesr/   sanity_checktaskr-   layerstartsizer1   rB   match_stringinstancerG   r   values                    r(   
_generatorzVadYaraScan._generator4   s    %%dkk(&;<!!66tDKK7HImm55dkkooeT6RS)MM00LL((11#	 1 
D //1JLL''
3E#006t,&KK#E!9,QR zz%t4((00!&$!7#,,CCE050<0F0FH*+(4(8(859P(Q(,(<(<(-

(4(?(?(0(=(=.& +& %& 1G 1> 8=}} 3e&'$0$4$4Ve^$D$($8$8$)JJ$($)*" '" !" 8E "8* "'D!1!@!@,1NNL,8,@,@&'$0$4$4X__u5L$M$($8$8',&7q9I9I8J$K$0$;$;$((0(//*2//;:%&	*" 	'" 	!" -A -; "A=  7
s   L#L%rU   c              #      K   | j                         }|j                         D ]$  }|j                         |j                         f & yw)a  Creates a map of start/end addresses within a virtual address
        descriptor tree.

        Args:
            task: The EPROCESS object of which to traverse the vad tree

        Returns:
            An iterable of tuples containing start and size for each descriptor
        N)get_vad_roottraverse	get_startget_size)rU   vad_rootvads      r(   r=   zVadYaraScan.get_vad_mapsq   s@      $$&$$&C==?CLLN33 's   A	Ac                     t        j                  dt        j                  fdt        fdt
        fdt
        fdt        fg| j                               S )NOffsetPIDRule	ComponentValue)r   TreeGridr	   rF   r#   strbytesr\   )rR   s    r(   runzVadYaraScan.run   sR    !!<++,c"%  OO	
 		
r*   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer)   r\   staticmethodobjectsObjectInterfacer   r   r#   r=   rm    r*   r(   r   r      s    J"+H@j&>&>&S&S!T @ @8;"z 4  004	%S/	"4 4 

r*   r   )loggingtypingr   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.pluginsr
   volatility3.plugins.windowsr   	getLoggerrn   r>   pluginsPluginInterfacer   rz   r*   r(   <module>r      sK   
  ( ( 7 < 8 ( .			8	${
*$$44 {
r*   