
    Xf                         d dl Z d dlmZmZmZmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ  e j        e          Z G d dej        j                  ZdS )	    N)ListTupleDict	Generator)
interfaces	renderers
exceptions)requirements)intel)format_hintsc                      e Zd ZdZdZedeej        j	                 fd            Z
d Zedej        j        deeeeeef                  f         fd            Zeded	edej        j        d
ej        j        deeeeeef                  f         f
d            Zedej        j        deeeef         ddf         fd            Zd ZdS )VirtMapzLists virtual mapped sections.)   r   r   returnc                 6    t          j        ddddg          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r
   ModuleRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/virtmap.pyget_requirementszVirtMap.get_requirements   s1     *,()4  
 	
    c              #      K   t          |          D ]=}||         D ]2\  }}d|t          j        |          t          j        |          ffV  3>d S )Nr   )sortedr   Hex)selfmapentrystartends        r   
_generatorzVirtMap._generator    sy      C[[ 	S 	SE!%j S S
s5,"25"9"9<;KC;P;PQRRRRRS	S 	Sr   modulec                 b   |j         j        |j                 }t          |t          j                  s i }|                    d          }|j        dz  |                    d          j	        z  }|
                    d          rd|                    d          }|                    d|j        |                    d                                                    }t          |d          rt!          |j        j                  D ]i}|                    |          }	|                    |	g           }
|
                    |j        |         j        |j        |         j        f           |
||	<   jn>t          |d	          rM|                    d|                    d
          j                  }|                     ||||j                  }nt5          j        d|j        d          |
                    d          r|                    d|                    d
          j                  }|                    d          }d|z
  |z  }|                    d|j        ||                    d                    }|                     ||||          }nt5          j        d|j        d          |S )z5Returns the virtual map from a windows kernel module._MI_SYSTEM_VA_TYPEr   _MMPTEMiVisibleStatepointer_MI_VISIBLE_STATE)object_typeoffsetsubtypeSystemVaRegionsSystemVaTypeMmSystemRangeStart)r-   r.   NzRequired structures not foundMiSystemVaTypel        arraychar)r-   r.   countr/   )contextlayers
layer_name
isinstancer   Intelget_enumeration	page_sizeget_typesize
has_symbol
get_symbolobjectaddressdereferencehasattrranger0   r6   lookupgetappendBaseAddressNumberOfBytes_enumerate_system_va_typer1   r	   SymbolErrorr   )r   r&   layerresultsystem_va_typelarge_page_sizesymbolvisible_stateirG   region_rangesystem_range_startarray_count
type_arrays                 r   determine_mapzVirtMap.determine_map%   s   
 %f&78%-- 	35//0DEE ?A-&//(2K2K2PP-.. 5	&&'788F"MM%~(;<< *   kmm	 
 }&788 }<BCC 	2 	2A+22155F#)::fb#9#9L '')9!<H)9!<J   &2F6NN	2 77 %+]] )!,,-ABBJ &3 & &" 66#&!.	  !,&+'F   /00 	!'%(()=>>F "/ " " &&'788F),>>?RK#~!//	 '  J 22!3VZ FF (fk#B   r   rQ   rV   rX   c                    i }|                     d          }|}d}|}	|D ]^}
|                    |
          }
|
|k    r:|                    |
g           }|                    ||	f           |||
<   ||	z   }|}	n|	|z  }	|
}_|S )Nr(   )r<   rG   rH   rI   )r   rQ   rV   r&   rX   rO   rP   r#   
prev_entrycur_sizer"   rU   s               r   rL   z!VirtMap._enumerate_system_va_typek   s     46//0DEE"
" 
	 
	E"))%00E
""%zz%44##UH$5666 ,u(*O+JJr   Nc              #   d   K   |                      |          }|D ]}d|vr||         D ]}|V  d S )NUnused)rY   )r   r&   mappingr"   values        r   scannable_sectionszVirtMap.scannable_sections   s^       ##F++ 	  	 Eu$$$U^    EKKKK	  	 r   c                    | j         j        | j        d                  }| j         j        |j                 }| j                             |j        |j        |j        d                   }t          j	        dt          fdt          j        fdt          j        fg|                     |                     |                              S )Nr   kernel_virtual_offset)r9   r.   RegionzStart offsetz
End offset)r&   )r7   modulesconfigr8   r9   r&   symbol_table_namer   r   TreeGridstrr   r   r%   rY   )r    r   rN   r&   s       r   runzVirtMap.run   s    %dk(&;<#F$56$$$z< 78 % 
 
 !3!12|/0
 OOD..f.==>>
 
 	
r   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer   r%   r7   ModuleInterfacer   rj   r   intrY   objectsObjectInterfacerL   r   rb   rk    r   r   r   r      s       (("+
j&>&S!T 
 
 
 [
S S S
 C'7C	c4c3h((	)C C C [CJ    "2	
 &6 
c4c3h((	)   [4  '7 	5c?D$.	/      [ 
 
 
 
 
r   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   volatility3.framework.renderersr   	getLoggerrl   vollogpluginsPluginInterfacer   rx   r   r   <module>r      s   
  / / / / / / / / / / / / C C C C C C C C C C < < < < < < . . . . . . 8 8 8 8 8 8		8	$	$Q
 Q
 Q
 Q
 Q
j 0 Q
 Q
 Q
 Q
 Q
r   