
    Xf                         d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZ  G d dej        j                  Zd	S )
    )Iterable)	renderers
interfacessymbols)requirements)format_hints)versions)poolscannerbigpoolsc            
           e Zd ZdZdZdZed             Zedej	        j
        dededeej        j                 fd	            Zd
 Zd ZdS )HiveScanzJScans for registry hives present in a particular windows memory
    image.)   r   r      r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionr   )r   ModuleRequirementPluginRequirementr
   PoolScannerr   BigPools)clss    i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/hivescan.pyget_requirementszHiveScan.get_requirements   ss     *,()4  
 *";+BI   *(99  
 	
    context
layer_namesymbol_tablereturnc              #     K   t          j        ||          }t          j        ||          }|r||rz|j        |         j        d         }|                    |||          }t          j        	                    |||dg          D ]#}|
                    d|j        d          }	|	V  $d
S t          j                            |d	g          }
t          j                            ||||
          D ]}|\  }}}|V  d
S )a  Scans for hives using the poolscanner module and constraints or bigpools module with tag.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of Hive objects as found from the `layer_name` layer based on Hive pool signatures
        )r"   r$   kernel_virtual_offset)r#   offsetCM10)r#   r$   tags_CMHIVET)object_typer(   absolutes   CM10N)r   symbol_table_is_64bitr	   is_windows_8_1_or_laterlayersconfigmoduler   r   list_big_poolsobjectVar
   r   builtin_constraintsgenerate_pool_scan)r   r"   r#   r$   is_64bitr/   kvontkrnlmppoolcmhiveconstraintsresult_constraint
mem_object_headers                  r   
scan_hiveszHiveScan.scan_hives%   sX     $ 0,GG"*"B,#
 #
 #
 # 	!x 	!.,34KLC~~lzRU~VVH )88J\QWPX 9     " )$'D )     &1EEwi K &1DD\;  ! ! 4:0Z     	! !r!   c              #      K   | j         j        | j        d                  }|                     | j         |j        |j                  D ]%}dt          j        |j        j	                  ffV  &d S )Nr   r   )
r"   modulesr1   rB   r#   symbol_table_namer   Hexvolr(   )selfr   hives      r   
_generatorzHiveScan._generatorS   sz      %dk(&;<OOL&+V-E
 
 	< 	<D |'88:;;;;;	< 	<r!   c                 j    t          j        dt          j        fg|                                           S )NOffset)r   TreeGridr   rF   rJ   )rH   s    r   runzHiveScan.run[   s*    !Hl.>#?"@$//BSBSTTTr!   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr    r   r"   ContextInterfacestrr   objectsObjectInterfacerB   rJ   rN    r!   r   r   r      s          #,H
 
 [
 +!#4+! +! 	+!
 
*$4	5+! +! +! [+!Z< < <U U U U Ur!   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   %volatility3.framework.symbols.windowsr	   volatility3.plugins.windowsr
   r   pluginsPluginInterfacer   rZ   r!   r   <module>rc      s   
       @ @ @ @ @ @ @ @ @ @ < < < < < < 8 8 8 8 8 8 : : : : : : = = = = = = = =NU NU NU NU NUz!1 NU NU NU NU NUr!   