
    vf                          d dl Z d dlmZ d dlmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ  e j                   e      Z G d d	ej&                  j(                        Zy)
    N)List)	constants
exceptions
interfaces	renderers)requirements)format_hints)ssdt)hivelistc                   d    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zy)GetCellRoutinez;Reports registry hives with a hooked GetCellRoutine handler)   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionr
   )r   ModuleRequirementPluginRequirementr   HiveListr
   SSDT)clss    o/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/getcellroutine.pyget_requirementszGetCellRoutine.get_requirements   sb     **,()4
 **(9(99 **DIIy
 	
    c           	   #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   |j                  |j                        }t        j                  j                  | j                   | j                  |j                  |j                        D ]  }|j                  }	 |j                  }t!        |j#                  |            }|r~|D ]x  \  }}|t$        j&                  j(                  vs#dt+        j,                  |j.                  j0                        |j3                         xs d|t+        j,                  |      ff z dt+        j,                  |j.                  j0                        |j3                         xs dt5        j6                         t+        j,                  |      ff ! y # t        j                  $ r Y 9w xY ww)Nr   )contextbase_config_path
layer_namesymbol_tabler    )r#   modulesconfigr
   r   build_module_collectionr%   symbol_table_namer   r   
list_hivesconfig_pathhiver   r   InvalidAddressExceptionlist'get_module_symbols_by_absolute_locationr   windowsKERNEL_MODULE_NAMESr	   Hexvoloffsetget_namer   NotAvailableValue)	selfr   
collectionhive_objectr.   cellroutinemodule_symbolsmodule_name_s	            r   
_generatorzGetCellRoutine._generator&   s    %%dkk(&;<YY66LL&++V-E-E

 $,,77LL!--((11	 8 
 (	K ##D"11 "BB;ON &4 NK")*;*;*O*OO , 0 0 A + 4 4 6 <" + , 0 0 =	  $((9#,,.4"!335$((5	 A(	 55 s2   CG0GA G0CG0G-)G0,G--G0c                     t        j                  dt         j                  j                  fdt        fdt        fdt         j                  j                  fg| j                               S )NzHive Offsetz	Hive NamezGetCellRoutine ModulezGetCellRoutine Handler)r   TreeGridr	   r4   strr@   )r9   s    r   runzGetCellRoutine.runY   s^    !!	 6 6 : :;c"(#.)9+A+A+E+EF	 OO
 	
r!   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer    r@   rD    r!   r   r   r      s@    E"+
j&>&>&S&S!T 
 
1f	
r!   r   )loggingtypingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.plugins.windowsr
   $volatility3.plugins.windows.registryr   	getLoggerrE   vollogpluginsPluginInterfacer   rM   r!   r   <module>rY      sK   
   N N < 8 , 9			8	$Q
Z''77 Q
r!   