
    Xf                         d dl mZ d dlmZmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZ  G d dej                  j                         Zy	)
    )Iterable)	renderers
interfacessymbols)requirements)format_hints)versions)poolscannerbigpoolsc            
           e Zd ZdZdZdZed        Zedej                  j                  dededeej                  j                     fd	       Zd
 Zd Zy)HiveScanzJScans for registry hives present in a particular windows memory
    image.)   r   r      r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      gS )
NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionr   )r   ModuleRequirementPluginRequirementr
   PoolScannerr   BigPools)clss    i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/hivescan.pyget_requirementszHiveScan.get_requirements   sd     **,()4
 **";+B+BI **(9(99
 	
    context
layer_namesymbol_tablereturnc              #   
  K   t        j                  ||      }t        j                  ||      }|r~|r||j                  |   j
                  d   }|j                  |||      }t        j                  j                  |||dg      D ]$  }|j                  d|j                  d      }	|	 & y
t        j                  j                  |d	g      }
t        j                  j                  ||||
      D ]  }|\  }}}|  y
w)a  Scans for hives using the poolscanner module and constraints or bigpools module with tag.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of Hive objects as found from the `layer_name` layer based on Hive pool signatures
        )r"   r$   kernel_virtual_offset)r#   offsetCM10)r#   r$   tags_CMHIVET)object_typer(   absolutes   CM10N)r   symbol_table_is_64bitr	   is_windows_8_1_or_laterlayersconfigmoduler   r   list_big_poolsobjectVar
   r   builtin_constraintsgenerate_pool_scan)r   r"   r#   r$   is_64bitr/   kvontkrnlmppoolcmhiveconstraintsresult_constraint
mem_object_headers                  r   
scan_hiveszHiveScan.scan_hives%   s    $ 00,G"*"B"B,#
 #x..,334KLC~~lzRU~VH ))88J\QWPX 9   " )$''D )   &11EEwiK &11DD\; ! 4:0Z  	!s   DDc              #      K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        D ]0  }dt        j                  |j                  j                        ff 2 y w)Nr   r   )
r"   modulesr1   rB   r#   symbol_table_namer   Hexvolr(   )selfr   hives      r   
_generatorzHiveScan._generatorS   su     %%dkk(&;<OOLL&++V-E-E
 	<D |''8:;;	<s   BBc                 l    t        j                  dt        j                  fg| j	                               S )NOffset)r   TreeGridr   rF   rJ   )rH   s    r   runzHiveScan.run[   s*    !!Hl.>.>#?"@$//BSTTr!   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr    r   r"   ContextInterfacestrr   objectsObjectInterfacerB   rJ   rN    r!   r   r   r      s     #,H
 
 +!##44+! +! 	+!
 
*$$44	5+! +!Z<Ur!   r   N)typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   %volatility3.framework.symbols.windowsr	   volatility3.plugins.windowsr
   r   pluginsPluginInterfacer   rZ   r!   r   <module>rc      s8   
  @ @ < 8 : =NUz!!11 NUr!   