
    *1fA                         d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
 d dlmZmZ d dlmZ d dlmZmZmZ d dlmZ  e j        e          Z G d d	e	j        j                  Z G d
 dej                  ZdS )    N)OptionalTupleTypeUnion)	constants
interfaces
exceptions)symbol_cachesymbol_finder)requirements)intelscannersarm)linuxc                   f   e Zd ZdZddgZej        j        Ze		 ddej
        j        dedej        deej        j                 fd	            Ze		 ddej
        j        ded
ej        dededededej        deej        ej        df         fd            Ze		 ddej
        j        ded
ej        dededededej        deej                 fd            Ze	dej
        j        dedededef
d            Z e		 ddej
        j        dededej        de!eef         f
d            Z"e	dedefd            Z#dS )LinuxStacker#   macwindowsNcontext
layer_nameprogress_callbackreturnc                    d}t           j                            |t          j        j                  s1t                              d| dt          j        j                    dS |j        |         }t          |t          j                  st          |t          j                  rdS t          j                            t"          j        t"          j                  }t          j        |                              d          }|st                              d           dS g }t+          j        d |D                       }	|                    ||	|	          D ]\  }
}||v r|                    |           t                              d
t5          |                      |                    |d          }|r3|j                            d          }t=          j        |d|z   ||          }|j                            |           |j                             d          }|                     d|          }||j!        |                     |d          <   tE          |d          |j!        |                     |tF          j$                  <   | j%        | j&        g}|D ]O}	  |||||||||          }|r|c c S # tN          $ r$}t          (                    |           Y d}~Hd}~ww xY wt                              d           dS )z-Attempts to identify linux within this layer.)   r   r   z+SQLiteCache version not suitable: required z found Nr   )operating_systemz[No Linux banners found - if this is a linux plugin, please check your symbol files locationc                     g | ]}||S N ).0xs     W/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/linux.py
<listcomp>z&LinuxStacker.stack.<locals>.<listcomp>?   s    *U*U*Uq}1}}}    )r   scannerr   zIdentified banner: r   z
temporary.)nameisf_url
LinuxLayerLinuxHelpermemory_layerzlatin-1)r   r   table
table_nameconfig_pathnew_layer_namebannerr   z)No suitable linux banner could be matched))r   VersionRequirementmatches_requiredr
   SqliteCacheversionvolloginfolayers
isinstancer   Intelr   AArch64ospathjoinr   
CACHE_PATHIDENTIFIERS_FILENAMEget_identifier_dictionaryr   MultiStringScannerscanappenddebugreprgetsymbol_spacefree_table_namer   LinuxKernelIntermedSymbolsfree_layer_nameconfigstrLinuxSymbolFinderbanner_config_keyintel_stackeraarch64_stacker	Exception	exception)clsr   r   r   requiredlayeridentifiers_pathlinux_bannersseen_bannersmss_r/   isf_pathr,   r+   r.   r-   linux_arch_stackerslinux_arch_stackeres                       r"   stackzLinuxStacker.stack   sf    .??l.6
 
 	 KKqhqq|OgOoqq   4 z* eU[)) 	Zs{-K-K 	47<< )"@
 
 %0
 

#
#W
#
=
= 	  	KKm   4)*U*Um*U*U*UVVS<M $ 
 
 ,	, ,	,IAv %%##F+++LL=tF||==>>>$((66H  ,$1AA.QQ
8 :-#$	   $++E222!(!?!?!M!M!hh}nEEHRsxx^DDE 	** HH[*;*MNN (+'8#:M&N#*= , ,&, 2 2$+'1"''1(3+9#).?	! 	! 	! ! )#(LLLLL)$ , , ,((++++++++, 	@AAAts   !J==
K+K&&K+r+   r,   r-   r.   r/   c	                    t           j        }	d|j        v rt           j        }	d}
nd|j        v rt           j        }	d}
nd}
|                     ||||	|          \  }}|                     |                    |
          j        |z             }||j        | 	                    |d          <    |	|||ddi          }||j        d	<   |                    d
          j        |z   }| 
                    |||||          }|r>|r<|r:t                              d|d           t                              d           |S |                                 d S )Ninit_top_pgtinit_level4_pgtswapper_pg_dirr   page_map_offsetr:   Linuxr-   r&   metadatakernel_virtual_offsetlinux_bannerr   rT   r   linux_banner_addresstarget_bannerzDTB was found at: 0x0xzIntel image found)r   r8   symbolsIntel32e	find_aslrvirtual_to_physical_address
get_symboladdressrJ   r<   verify_translation_by_bannerr4   rC   destroy)rR   r   r   r+   r,   r-   r.   r/   r   layer_classdtb_symbol_namekaslr_shift
aslr_shiftdtbrT   rk   test_banner_equalitys                    r"   rN   zLinuxStacker.intel_stackerq   s    "KU]**.K,OO%-//.K/OO.O"%--/ #0 #
 #
Z --_--5C
 

 DGsxx->??@#G_	
 
 
 1;,-$//??G*T"??!!5   @  
  
  	S 	1 	LL8888999LL,---LMMOOOtr$   c	           	      d   t           j        }	|                     ||||	|          \  }
}|                    d          j        |
z   }||j        |                     |d          <   ||j        |                     |d          <   |                    d          j        j	        j
        }||j        |                     |d          <   d}d|j        v r|                    d          j        }d	|j        v r ||                    d	          j        d
z  z  }d|j        v r||                    d          j        z  }|dz	  dz  }d|cxk    rdk    r	n nd|z  gng d}|                    d          j        |z   }dd|j        v rW|                    d          j        |
z   }t                              |j        |                             |d          |          s	 |dz                                  dz   	 gfdt#          ddd          D             z   }|D ]dz
  }||j        |                     |d          <   ||j        |                     |d          <   |D ]}||j        |                     |d          <   ||j        |                     |d          <    |	|||ddi          }||j        d<   |                     |||||           }|rB|r@|r>t&                              d!|d"           t&                              d#           |c c S |                                 ̐d S )$Nrc   rb   rd   page_map_offset_kernelpointerkernel_endiannessr   _kernel_flags_le_kernel_flags_le_hi32    _kernel_flags_le_lo32r         )r      @   ri   vabits_actual   l    c                     g | ]}|z   S r   r   )r    iva_bitss     r"   r#   z0LinuxStacker.aarch64_stacker.<locals>.<listcomp>   s    )Q)Q)Q!'A+)Q)Q)Qr$   r   tcr_el1_t1sztcr_el1_t0szpage_size_kernel_spacepage_size_user_spacer:   re   rf   rh   rj   zKernel DTB was found at: 0xrm   zAArch64 image found)r   r9   rp   rr   rs   rJ   r<   get_typevoldata_format	byteorderrn   int
from_bytesr6   read
bit_lengthrangert   r4   rC   ru   )rR   r   r   r+   r,   r-   r.   r/   r   rv   rx   ry   rz   r   kernel_flagspage_size_kernel_space_bit!page_size_kernel_space_candidatesrk   vabits_actual_phys_addrva_bits_candidatesr   r   rT   r{   r   s                           @r"   rO   zLinuxStacker.aarch64_stacker   s    k"%--/ #0 #
 #
Z /008;FCFsxx->??@JMsxx-EFFG!NN9559EOEVsxx-@AAB .. ++,>??GL"em33E,,-DEEMQSSSL"em33E,,-DEEMML '3a&71%<" .3333!33333 **++ 	*  %//??G*Tem++  119KG $ nnz*//0GKK! G  	L ,y9EEGG!KG	 &Y)Q)Q)Q)QuRR?P?P)Q)Q)QQ) &	$ &	$G<LDPGN388K@@ADPGN388K@@A +L $ $& + sxx5MNNO + sxx5KLLM $ +'"G_	   9C45'*'G'G#))="( (H ( ($  $S $%9 $LL!Gs!G!G!GHHHLL!6777 LLLLLMMOOOO=$@ tr$   rk   rl   c                    	 |                     |          d         }|j        |                             |t          |                    }nB# t          j        $ r0}t                              t          j	        d           Y d}~dS d}~ww xY w||k    s.t                              t          j
        d| d| d           dS dS )	zDetermine if a stacked layer is correct or a false positive, by calling the underlying
        _translate method against the linux_banner symbol virtual address. Then, compare it with
        the detected banner to verify the correct translation.
        r   z7Cannot translate "linux_banner" symbol virtual address.NFzAMismatch between scanned and virtually translated linux banner : z != .T)
_translater6   r   lenr	   InvalidAddressExceptionr4   logr   LOGLEVEL_VVVVLOGLEVEL_VV)	rR   r   rT   r   rk   rl   banner_phys_addressbanner_valuer]   s	            r"   rt   z)LinuxStacker.verify_translation_by_banner'  s    
	"'"2"23G"H"H"K">*5::#S%7%7 LL 1 	 	 	JJ'I   55555	 },,JJ%vTavvgsvvv   5ts   A	A B%BBsymbol_tablec                    |t           j        z   dz   }|j                            |          j        }d}|                    ||d          }	|j        |         j                            dd          }
|	                    d          }|	                    d          }|j
        |                             t          j        |          ||          D ]}||z
  }|	                    d|d	
          }|j        dk    r,|                    d          r|j                            d          dk    r`|j                            d          |	                    d          j        z
  }|t(          j        k    r||z
  }n||                     |          z
  }|
r||
z  }|dz  dk    s	|dz  dk    rt.                              d                    ||                     ||fc S t.                              d           dS )zXDetermines the offset of the actual DTB in physical space and its
        symbol offset.	init_tasks-   swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00r   symbol_maskNtask_structcomm)r%   r   r   T)object_typeoffsetabsolutestatezunsigned intzunsigned long
init_filesi  z@Linux ASLR shift values determined: physical {:0x} virtual {:0x}z>Scanners could not determine any ASLR shifts, using 0 for both)r   r   )r   BANGrF   rr   rs   modulerJ   rE   r   relative_child_offsetr6   rA   r   RegExScannerobjectpid
has_memberr   castfilesr   r9   rq   r4   rC   format)rR   r   r   r   rv   r   init_task_symbolinit_task_json_addressswapper_signaturer   address_masktask_symbolcomm_child_offsetr   init_task_addressr   ry   rx   s                     r"   rp   zLinuxStacker.find_aslrJ  sT    ().8;F!(!5!@!@"
 "

 	 Nj!<<+L9@DD4
 
 oom44'==fEEnZ055)*;<</ 6 
 
 &	+ &	+F
 !'): :)2Cd &  I }!!$$W--O((88A== $$_55##L119:  ck))/2HH/#2Q2Q*3 3   7',6
E!Q&&+*=*B*BLLRYY   
 
**** 	UVVVtr$   addrc                 "    |dk    r|dz
  S |dz
  S )zUConverts a virtual linux address to a physical one (does not account
        of ASLR)l        l        r   )rR   r   s     r"   rq   z(LinuxStacker.virtual_to_physical_address  s'     $$$,,,j  r$   r   )$__name__
__module____qualname__stack_orderexclusion_listr   configuration	path_joinr<   classmethodr   ContextInterfacerK   r   ProgressCallbackr   r6   DataLayerInterfacer^   r   rH   r   r   r8   ro   rN   bytesr   r9   rO   r   boolrt   r   rp   rq   r   r$   r"   r   r      s       KY'N#-D
 9=	W W#4W W %5	W
 
*#6	7W W W [Wr  9=; ;#4; ; /	;
 ; ; ; ; %5; 
u{END0	1; ; ; [;z  9=u u#4u u /	u
 u u u u %5u 
#+	u u u [un  #4  	 
 "    
      [ D  9=A A#4A A 	A %5A 
sCxA A A [AF !s !s ! ! ! [! ! !r$   r   c                   ,    e Zd ZdZdZdZdZd ZddgZdS )	rL   z5Linux symbol loader based on uname signature strings.kernel_bannerr   z>volatility3.framework.symbols.linux.LinuxKernelIntermedSymbolsc                 *    t          j        | d         S )Nr   )r   rp   )rR   argss     r"   <lambda>zLinuxSymbolFinder.<lambda>  s    <#94#@#C r$   r   r   N)	r   r   r   __doc__rM   r   symbol_classrp   r   r   r$   r"   rL   rL     s7        ??'SLCCIY'NNNr$   rL   )loggingr:   typingr   r   r   r   volatility3.frameworkr   r   r	   volatility3.framework.automagicr
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   r   r   volatility3.framework.symbolsr   	getLoggerr   r4   	automagicStackerLayerInterfacer   SymbolFinderrL   r   r$   r"   <module>r      s7  
  				 / / / / / / / / / / / / C C C C C C C C C C G G G G G G G G < < < < < < = = = = = = = = = = / / / / / /		8	$	$B! B! B! B! B!:'= B! B! B!J( ( ( ( (2 ( ( ( ( (r$   