
    [
#g                         d dl Z d dlmZmZmZmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ  e j                   e      Z G d dej&                  j(                        Zy)	    N)ListTupleDict	Generator)
interfaces	renderers
exceptions)requirements)intel)format_hintsc                      e Zd ZdZdZedeej                  j                     fd       Z
d Zedej                  j                  deeeeeef      f   fd       Zeded	edej                  j                  d
ej&                  j(                  deeeeeef      f   f
d       Zedej                  j                  deeeef   ddf   fd       Zd Zy)VirtMapzLists virtual mapped sections.)   r   r   returnc                 8    t        j                  ddddg      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitectures)r
   ModuleRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/virtmap.pyget_requirementszVirtMap.get_requirements   s*     **,()4
 	
    c              #      K   t        |      D ]>  }||   D ]4  \  }}d|t        j                  |      t        j                  |      ff 6 @ y w)Nr   )sortedr   Hex)selfmapentrystartends        r   
_generatorzVirtMap._generator    sN     C[E!%j
s5,"2"25"9<;K;KC;PQRR ) !s   AAmodulec                 T   |j                   j                  |j                     }t        |t        j
                        s i }|j                  d      }|j                  dz  |j                  d      j                  z  }|j                  d      r`|j                  d      }|j                  d|j                  |j                  d            j                         }t        |d      rt!        |j"                  j$                        D ]k  }|j'                  |      }	|j)                  |	g       }
|
j+                  |j"                  |   j,                  |j"                  |   j.                  f       |
||	<   m |S t        |d	      rL|j                  d|j                  d
      j                        }| j1                  ||||j2                        }|S t5        j6                  d|j8                  d      |j                  d      r|j                  d|j                  d
      j                        }|j                  d      }d|z
  |z  }|j                  d|j                  ||j                  d            }| j1                  ||||      }|S t5        j6                  d|j8                  d      )z5Returns the virtual map from a windows kernel module._MI_SYSTEM_VA_TYPEr   _MMPTEMiVisibleStatepointer_MI_VISIBLE_STATE)object_typeoffsetsubtypeSystemVaRegionsSystemVaTypeMmSystemRangeStart)r-   r.   zRequired structures not foundMiSystemVaTypel        arraychar)r-   r.   countr/   )contextlayers
layer_name
isinstancer   Intelget_enumeration	page_sizeget_typesize
has_symbol
get_symbolobjectaddressdereferencehasattrranger0   r6   lookupgetappendBaseAddressNumberOfBytes_enumerate_system_va_typer1   r	   SymbolErrorr   )r   r&   layerresultsystem_va_typelarge_page_sizesymbolvisible_stateirG   region_rangesystem_range_startarray_count
type_arrays                 r   determine_mapzVirtMap.determine_map%   s   
 %%f&7&78%-35//0DE ??A-&//(2K2P2PP-.&&'78F"MM%~~(;< *  km	 
 }&78}<<BBCA+2215F#)::fb#9L '')99!<HH)99!<JJ &2F6N D^ K 7%+]] )!,,-ABJJ &3 &" 66#&!..	@ 3 !,,%v{{4S  /0!'%(()=>FF "/ " &&'78F),>>?RK#~~!/	 ' J 22!3VZF 	 (( &++/N r   rQ   rV   rX   c                     i }|j                  d      }|}d}|}	|D ]Q  }
|j                  |
      }
|
|k7  r2|j                  |
g       }|j                  ||	f       |||
<   ||	z   }|}	n|	|z  }	|
}S |S )Nr(   )r<   rG   rH   rI   )r   rQ   rV   r&   rX   rO   rP   r#   
prev_entrycur_sizer"   rU   s               r   rL   z!VirtMap._enumerate_system_va_typek   s     46//0DE"
"E"))%0E
"%zz%4##UH$56 ,u(*O+J   r   Nc              #   b   K   | j                  |      }|D ]  }d|vs||   D ]  }|   y w)NUnused)rY   )r   r&   mappingr"   values        r   scannable_sectionszVirtMap.scannable_sections   s=      ##F+Eu$$U^EK , s   //c                    | j                   j                  | j                  d      }| j                   j                  |j                     }| j                   j                  |j                  |j                  |j                  d         }t        j                  dt        fdt        j                  fdt        j                  fg| j                  | j                  |                  S )Nr   kernel_virtual_offset)r9   r.   RegionzStart offsetz
End offset)r&   )r7   modulesconfigr8   r9   r&   symbol_table_namer   r   TreeGridstrr   r   r%   rY   )r    r   rN   r&   s       r   runzVirtMap.run   s    %%dkk(&;<##F$5$56$$$$zz<< 78 % 
 !!3!1!12|//0
 OOD..f.=>
 	
r   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer   r%   r7   ModuleInterfacer   rj   r   intrY   objectsObjectInterfacerL   r   rb   rk    r   r   r   r      sC   ("+
j&>&>&S&S!T 
 
S
 C''77C	c4c3h((	)C CJ    ""22	
 &&66 
c4c3h((	) 4  ''77 	5c?D$.	/   
r   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   volatility3.framework.renderersr   	getLoggerrl   vollogpluginsPluginInterfacer   rx   r   r   <module>r      sK   
  / / C C < . 8			8	$Q
j  00 Q
r   