*1fm(dZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z mZmZmZddlmZmZddlmZddlZddlZddlmZddlmZmZddlmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%dd l&m'Z'ej(Z)ej(e*Z+ej,Z-e-.ej/ej0d Z1e-2e1Gd d e3Z4Gdde4Z5GddZ6dZ7dS)aXA CommandLine User Interface for the volatility framework. User interfaces make use of the framework to: * determine available plugins * request necessary information for those plugins from the user * determine what "automagic" modules will be used to populate information the user does not provide * run the plugin * display the results N)AnyDictListTupleTypeUnion)parserequest) text_filter) framework) text_renderer volargparse) automagic configuration constantscontexts exceptions interfacesplugins)stacker) requirementsz(%(levelname)-8s %(name)-12s: %(message)sc:eZdZdZdZddeeefdefdZ dS)PrintedProgressz`A progress handler that prints the progress value and the description onto the command line.cd|_dSNr)_max_message_lenselfs J/home/panchajanya/Development/work/volatility3/volatility3/cli/__init__.py__init__zPrintedProgress.__init__9s !Nprogress descriptioncdt|ddd|pd}t|}t|j|g|_tj|d|j|z zzdzdS) zA simple function for providing text-based feedback. .. warning:: Only for development use. Args: progress: Percentage of progress of the current procedure z Progress: z 7.2fz   N)roundlenmaxrsysstderrwrite)rr"r#message message_lens r__call__zPrintedProgress.__call__<sSx!3!3RRR{?PbRR'll #T%:K$H I I C4+@;+N$OPSWWXXXXXr!N) __name__ __module__ __qualname____doc__r rintfloatstrr1r!rrr5sf""" Y YsEz!2 Y Y Y Y Y Y Yr!rc4eZdZdZddeeefdefdZdS) MuteProgressz=A dummy progress handler that produces no output when called.Nr"r#cdSr2r:)rr"r#s rr1zMuteProgress.__call__Ms r!r2) r3r4r5r6rr7r8r9r1r:r!rr<r<JsJGG  sEz!2       r!r<c |eZdZdZdZdZedZdZede de fdZ de de e e e e fee efffd Zd Zd Zd ejjd ee eejjfdejde ddf dZdZddZdeejej fdeejjfdZ!dS) CommandLinezDConstructs a command-line interface object for users to run plugins. volatilityc<|d|_dSr2) setup_logging output_dirrs rr zCommandLine.__init__Vs r!cxtdttdS)N)rootlogsetLevel addHandlerconsole)clss rrBzCommandLine.setup_loggingZs2 7#####r!c tjdddtdtjt jD}|d\}}tj d|j d}| dd d tj d |j | d dddt | dddgdddt | ddddd| dddd t | d!d"d#d t | d$d%d&dd'| d(d)d*dt | d+d,d-t#jt | d.d/d0dd1| d2d3d4d5d6t)|d7d8t)|9| d:d;d| d?d@dd1| dAdBdt | dCdDdd1| dEdFt*jdGt*jt | dHdIdd1| dJdKgd|jdui|dLt0jD}||\}}t0j}||jjr t0j}|dMt*j dN|j!rtEj#|j!} | $dOtEj%dPdQR} | &| tN(| tR*dS|+|j,dTkrG|j,dOkr dt0_-t\$tDj/|j,dUzz n/t\$tDj0|j,dz z |D] \} } tR!| | !|j1r@dV|j12dWDt*j3ztj4_5|j6r@dX|j62dWDt*j7ztj8_5|j9r|j9t*_tR*dYtj4j5tR*dZtj8j5|j:dkrt*j;j<t*_=nB|j:d[krt*j;j>t*_=nt*j;j?t*_=|j@rtj@|jAr|jAt*_BtjD} tjEtj4d\}|rId]d6t|z|_GtR*|jGtjI| }tjJ}t}i}|D]V}||vr|L|t|tjOjPr|Q||jRW|Sd^d_d`|j tjTa}t|D]@}|U|||jVb}|Q|||A|W}|jX|YdctR!t*jZddt*j||jX}|||jX<de}tjO[||j\}|j]ri tj_`|j]}|| jadf<n9#t$r,}|Yt!|Yd}~nd}~wwxYw|jaryt|jadg5}tje|}| jaf|tjOg|dddn #1swxYwYtjh||}|D]}|||jRj\<| jaidhdtjk|| jadh<|jl|_lt"jmn|jls|Ydi|jl|o| ||||jprv|jpD]n}dj|vrtdk|d|qdjtjr||qdjdOzd} }| | ja|<od}! t}"|jtrt}"tijv| ||||"|w}!|jxr!tRydldm|_z|jzrtR{dnt"jmnt"jm||jzr|Ydo|jzdpt|jzdq5}tj}t|!~|d\dr|dNdddn #1swxYwYnZ#tj$rH}|||dOdsdt|jDdNYd}~nd}~wwxYw |!r`|!}#||j}$t j|#|j|$_|$|#dSdS#tj$r }||Yd}~dSd}~wwxYw)vzyExecutes the command line module, taking the system arguments, determining the plugin to run and then running it.r%rcDg|]}|j|fSr:)namelower.0xs r z#CommandLine.run..gs7   #   r!zvol.jsonFz)An open-source memory forensics framework)add_helpprogr#-h--helphelpzYShow this help message and exit, for specific plugin options use '{} --help')actiondefaultrWz-cz--configz'Load the configuration from a json fileN)rWrYtypez --parallelismz:Enables parallelism (defaults to off if no argument given)?) processesthreadsoffr\)rWnargschoicesconstrYrZz-ez--extendz8Extend the configuration with a new (or changed) settingappend)rWrYrXz-pz --plugin-dirsz2Semi-colon separated list of paths to find pluginsr&z-sz --symbol-dirsz2Semi-colon separated list of paths to find symbolsz-vz --verbosityzIncrease output verbositycountz-lz--logz+Log output to a file as well as the consolez-oz --output-dirz0Directory in which to output any generated filesz-qz--quietzRemove progress feedback store_truez-rz --rendererRENDERERz%Determines how to render the output (z, )quick)metavarrWrYr`z-fz--fileFILEzIShorthand for --single-location=file:// if single-location is not defined)rhrYrZrWz--write-configz0Write configuration JSON file out to config.jsonz --save-configz&Save configuration JSON file to a filez --clear-cachez&Clears out all short-term cached itemsz --cache-pathzChange the default path (z) used to store the cachez --offlinez.Do not search online for additional JSON filesz --filterszPList of filters to apply to the output (in the form of [+-]columname,pattern[!])c*g|]}|dk|dk|S)rVrUr:)rPargs rrRz#CommandLine.run..s%QQQcSD[[c[[[r!zVolatility 3 Framework  rEz%y-%m-%d %H:%M:%Sz3%(asctime)s %(name)-12s %(levelname)-8s %(message)s)datefmtfmtzLogging started cLg|]!}tj|"Sr:ospathabspathrPps rrRz#CommandLine.run..3,,,'("",,,r!;cLg|]!}tj|"Sr:rrrvs rrRz#CommandLine.run..rxr!zVolatility plugins path: zVolatility symbols path: r]Tz@The following plugins could not be loaded (use -vv to see why): Pluginspluginz5For plugin specific options, run '{} --help')titledestr#rX)rWzPlease select a plugin to runzCache directory used: rz&automagic.LayerStacker.single_locationrzautomagic.LayerStacker.stackersz/The output directory specified does not exist: =zNInvalid extension (extensions must be of the format "conf.path.value='value'")zOUse of --write-config has been deprecated, replaced by --save-config z config.jsonz4Writing out configuration data to {args.save_config}z!Cannot write configuration: file z already existsw) sort_keysindentz,Unable to validate the plugin requirements: cg|]}|Sr:r:rOs rrRz#CommandLine.run..s?\?\?\a?\?\?\r!r:) volatility3r require_interface_versiondictclass_subclassesr CLIRendererload_system_defaultsrHelpfulArgParserCLI_NAME add_argumentargparseSUPPRESSformatrTr9rsgetcwdjoinlistr CACHE_PATH set_defaultsr,argvparse_known_argsstdoutrendererstructured_outputr-r.PACKAGE_VERSIONloglogging FileHandlerrG Formatter setFormatterrFrHvolloginfoorder_extra_verbose_levels verbositytracebacklimitrIWARNINGDEBUG plugin_dirssplit PLUGINS_PATHr__path__ symbol_dirsSYMBOL_BASEPATHSsymbols cache_path parallelism ParallelismMultiprocessing PARALLELISM ThreadingOff clear_cacheofflineOFFLINErContext import_filessortedepilogr available list_pluginssetadd isinstancerrConfigurableInterfacepopulate_requirements_argparse __class__add_subparsersHelpfulSubparserAction add_parserr6 parse_argsr|error LOGLEVEL_VVV path_joinr3filerURIRequirementlocation_from_fileconfig ValueErroropenjsonloadspliceHierarchicalDictchoose_automagicgetrchoose_os_stackersrCrtexistspopulate_configextendfindloadsrquietr<construct_pluginfile_handler_class_factory write_configwarning save_configdebugrudumpbuild_configurationrUnsatisfiedExceptionprocess_unsatisfied_exceptionsexit unsatisfiedrunr CLIFilterfiltersfilterrenderVolatilityExceptionprocess_exceptions)%r renderers delayed_logsdefault_configparser known_args partial_args_ banner_output file_loggerfile_formatterlevelmsgctxfailures automagics plugin_listseen_automagicschosen_configurables_listamagic subparserr| plugin_parserargsbase_config_pathplugin_config_pathsingle_locationexcpfjson_val extensionaddressvalue constructedprogress_callbackgridrs% rrzCommandLine.run`s 771a@@@  "3M4MNN     (,'@'@'L'L$ n-C      %lss        :      M333       K       E       E       ,       >       CIKK       +       V4 ??9S9SVVVOO       \      C     9     9     \Y-A\\\(     A     c     --n---RQSXQQQ  11*== a \* + = 'JMSi6OSSSTTT   +!-l.>??K   # # #$.+IN  $ $^ 4 4 4   { + + + KK) * * * '')))  !A % %%))%)"   W_ 0F0KL M M M M   W]l.Dq.HI J J J& # #JE3 JJuc " " " "  # ',,,8,D,J,J3,O,O,,,&,'K  (  # +,,,8,D,J,J3,O,O,,,*,+K  (  " ;#/#:I  N 0C0LNNOOO N 0C0LNNOOO  #{ 2 2$-$9$II ! !  % 2 2$-$9$CI ! !$-$9$=I !  # $  ! # # #   5 , 4I   )      'R))F8,,--. M KK & & &(-- ,.. %%$&!  N NF((    ' ' '&*":"PQQ N33FF>;T B B J>"'//$2B"C"CDDLL]D>??"&  GGDMMM""""""""""""""".     / / 5 5 5 KK`?\?\4K[?\?\?\```          * &"((39T]355"-"7dl"K"K%%%%%  & & - * * *  # #D ) ) ) ) ) ) ) ) ) *s5.c$$ d."dd9A fff"D q-A q: qq  q q qr)!>r$$r)-A tu t;;ufilenamereturncttdtj|S)zReturns the URL location from a file parameter (which may be a URL) Args: filename: The path to the file (either an absolute, relative, or URL path) Returns: The URL for the location of the file zc.location_from_file has been deprecated and moved to requirements.URIRequirement.location_from_file)rrr3rrr)rJrs rrzCommandLine.location_from_files?   | | |   *==hGGGr!c Rtjtjddd|}tjdkr\tjtjdtjdd|}g}tj|rt|d5}tj |}dddn #1swxYwYt|ts&|tjd|d fna|tjd |f|tjd tj|d d f||fS|ifS)zIModify the main configuration based on the default configuration override~z.configrwin32APPDATArbNzDefault configuration file z does not contain a dictionaryz+Loading default configuration options from zLoaded configuration: r%T)rr)rsrtr expanduserr,platformenvironrrrrrrrrbrINFOrdumps)rrdefault_config_pathr config_jsonresults rrz CommandLine.load_system_defaultss !gll G  s # #Y x   <7 " ""$',, y"'*<*>- . . ,)400 0K;// 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0fd++ ,## i6Iiii## [FY[[ ## cFQ\`1a1a1acc $V++RsC>>DDctjdtjtjt j|d}t d |t|tjrd}t|tjr)dt!|jd|jd|d }d d g}n8t|tjr(d t!|jd|jd|d }gd }nt!|jd|jd|d }gd}nt|tjr&d}|jt,j|jd|}gd}nt|tjr d}|}gd}nkt|tjrd|j}|}dg}n@t|tjrd|j}|}dg}nd}d}ddt,jg}tj}||d||d|D]}|d|d|dtjddS)zHProvide useful feedback if an exception occurs during a run of a plugin.z T)chainr&z/Volatility was unable to read a requested page:z Swap error z in layer z (rfzUNo suitable swap file having been provided (locate and provide the correct swap file)z;An intentionally invalid page (operating system protection)z Page error )>Memory smear during acquisition (try re-acquiring if possible)BAn intentionally invalid page lookup (operating system protection)AA bug in the plugin/volatility3 (re-run with -vvv and file a bug))zDThe base memory file being incomplete (try re-acquiring if possible)r&r'r(z.Volatility experienced a symbol-related issue:: )zAn invalid symbol tablez A plugin requesting a bad symbolz1A plugin requesting a symbol from the wrong tablez:Volatility experienced an issue related to a symbol table:z.Volatility experienced a layer-related issue: z?A faulty layer implementation (re-run with -vvv and file a bug)z0Volatility could not import a necessary module: zIA required python module is not installed (install the module and re-run)z/Volatility encountered an unexpected situation.z ? ?; GG$ IJJ fs4+?'@'@ffDOff_cfffkQ D*"IJJ fs4+?'@'@ffDOff_cfff 4/00VVDOVVtVVV j4 5 5" FGSS9ISSTSSFII j9 : : RGYFII j7 8 8 XtXXGYFQIIj? @ @ VVVGYF[IIHGFN)i'))I  ^^^$$$ ___%%% * *E LLu ) ) ) ) >???  r!ctdd}d}|jD]}|p)t|j|tjj}|p)t|j|tjj}td|d|j|j|rtd|rtddSdS)zNProvide useful feedback if an exception occurs during requirement fulfillment.r&FzUnsatisfied requirement r)z A translation layer requirement was not fulfilled. Please verify that: A file was provided to create this layer (by -f, --single-location or by config) The file exists and is readable The file is a valid memory image and was acquired cleanlya9 A symbol table requirement was not fulfilled. Please verify that: The associated translation layer requirement was fulfilled You have the correct symbol file for the requirement The symbol file is under the correct directory or zip file The symbol file is named appropriately or contains the correct banner N)printrrrrTranslationLayerRequirementSymbolTableRequirementr#)rr translation_failedsymbols_failed config_paths rrz*CommandLine.process_unsatisfied_exceptionses b "+  K!3"z -*F88 ,z -*A00N e;ee$:J;:W:cee       N      \       r!contextconfigurables_listrr Nc t|}|D]}||D] | jd}|t t jrt |trtj |j }|rt|dkrftj |std|ddt!jtj |}t t jrJt |t(s't+d j fd|D}t/j||s||j} n|} t4j| j} ||j| <dS)aPopulate the context config based on the returned args. We have already determined these elements must be descended from ConfigurableInterface Args: context: The volatility3 context to operate on configurables_list: A dictionary of configurable items that can be configured on the plugin args: An object containing the arguments necessary plugin_config_path: The path within the context's config containing the plugin's configuration NrEzNon-existent file z passed to URIRequirementzfile://z4Configuration for ListRequirement was not a list: {}c:g|]}|Sr:) element_type)rPrQ requirements rrRz/CommandLine.populate_config..s' L L L!9!9!!CommandLine.file_handler_class_factory..CLIFileHandlerctdtjd|jd}tjd|dd|d}}|d|}d}tj|r.|d|d|}|dz }tj|.|S) zGets the final filenameNz Output directory is not a stringT)exist_ok.rE-)rWrsmakedirspreferred_filenamerrtrr)rpref_name_arrayrroutput_filenamecounterrCs r_get_final_filenamezRCommandLine.file_handler_class_factory..CLIFileHandler._get_final_filenames%#$FGGG J6666"&"9"?"?"D"DGLLSXXocrc6J-K-KLL#B'$&.";"; ";";gnn_55!)1&I&IG&I&Ii&I&IOqLGgnn_55!'&r!N)r3r4r5rq)rCsrCLIFileHandlerrfs. ' ' ' ' ' ' 'r!rrc0eZdZdeffd ZfdZxZS)ACommandLine.file_handler_class_factory..CLIMemFileHandlerrcrtj|||dSr2)ioBytesIOr )rrrrs rr zJCommandLine.file_handler_class_factory..CLIMemFileHandler.__init__s5 ##D)))''h77777r!c|jrdS|d|}t|d5}||d|_ttj d|dddn #1swxYwYt dS)NrwbTzSaved stored plugin file: ) closedseekrqrr.read _committedrrrrsuperclose)rro current_filers rrzGCommandLine.file_handler_class_factory..CLIMemFileHandler.closes; 4 ! "&":":"<"</400L &&tyy{{333&*DOJJ &T?&T&T sAB''B+.B+)r3r4r5r9r r __classcell__)rrrs@rCLIMemFileHandlerrts^ 8 8 8 8 8 8 8         r!rcpeZdZdeffd ZdZedZedZedZ dZ dS) DCommandLine.file_handler_class_factory..CLIDirectFileHandlerrc Ptjdd\}|_tj|d|_||t|jD]?}|ds(|dvr$t||t|j|@dS)Nz.vol3tmp_)suffixprefixdirzw+b)moder)rzrrrM) tempfilemkstemp_namervr_filer r startswithsetattrgetattr)rrfditemrrrCs rr zMCommandLine.file_handler_class_factory..CLIDirectFileHandler.__init__s!)!1"6z"""DJ WRe444 ''h777 OOGGD??3//GDA55  dGDJ,E,EFFFGGr!c,t|j|Sr2)rr)rrs r __getattr__zPCommandLine.file_handler_class_factory..CLIDirectFileHandler.__getattr__stz4000r!c|jjSr2)rrzrs rrzzKCommandLine.file_handler_class_factory..CLIDirectFileHandler.closeds z((r!c|jjSr2)rrrs rrzICommandLine.file_handler_class_factory..CLIDirectFileHandler.mode  z&r!c|jjSr2)rrMrs rrMzICommandLine.file_handler_class_factory..CLIDirectFileHandler.namerr!c|jjrdS|j|}t j|j|dS)zMCloses and commits the file (by moving the temporary file to the correct nameN)rrzrrqrsrenamer)rros rrzJCommandLine.file_handler_class_factory..CLIDirectFileHandler.closesU:$ 4   """"&":":"<"< $*o66666r!N) r3r4r5r9r rpropertyrzrrMr)rrrCsrCLIDirectFileHandlerrs G G G G G G G G 1 1 1 ) )X ) ' 'X ' ' 'X ' 7 7 7 7 7r!r)rCrrFileHandlerInterfacervrw)rdirectrrrrrCs @@rrz&CommandLine.file_handler_class_factorys_  ' ' ' ' ' ' 'Z/D ' ' '(        N   .' 7' 7' 7' 7' 7' 7' 7' 7>' 7' 7' 7R  %' '$ $r!rr[c t|tjjst dt ||D]}i}t|tjjs't d |j t|tjj rQ|j |d<t|tjrd|d<t|tjr d|d<d|vr|d=nt|t jjj jr2|jt(krd|d<n |j|d<|jrdnd }||d <n@t|t jjj jrt.|d<|j|d <nV|jd |jd dzf|j|j|j|j d|dS)zAdds the plugin's simple requirements to the provided parser. Args: parser: The parser to add the plugin's (simple) requirements to configurable: The plugin object to pull the requirements from z*Expected ConfigurableInterface type, not: zCPlugin contains requirements that are not RequirementInterfaces: {}rZc"t|dSrr7rQs rz.B3q!99r!rdrXc"t|dSrrrs rrz.Mrr!*+r_r`z--rrk)rWrYr~requiredN) issubclassrrrrWrZrQrRequirementInterfacerr3SimpleTypeRequirement instance_typerIntRequirementBooleanRequirementrr rVrNr7optionalChoiceRequirementr9r`rrMreplacer#rY)rrr[rO additionalr_s rrz*CommandLine.populate_requirements_argparse#sL, (@(VWW QT,=O=OQQ  (88::, , K)+JZ5J  Y``$- +z'?'UVV %0%> 6"k<+FGG=)<)h-x/FFG>:3IJ>>>>>>r!r?cFtdS)z^A convenience function for constructing and running the :class:`CommandLine`'s run method.N)r?rr:r!rmainrds MMr!)8r6rrXrvrrrsr,rr+typingrrrrrrurllibr r volatility3.clir volatility3.pluginsrvolatility3.symbolsr r rvolatility3.frameworkrrrrrrrvolatility3.framework.automagicr#volatility3.framework.configurationr getLoggerrFr3r StreamHandlerrIrGrr formatterrobjectrr<r?rr:r!rrs  6666666666666666!!!!!!!!''''''!!!!!!66666666433333<<<<<< '     8 $ $ '  ! !!!! G H I I YYYYYYfYYY*     ?   P P P P P P P P fr!