
    [
#gP                     L   d dl Z d dlZd dlZd dlZd dlmZmZmZmZ d dl	m
Z
mZmZ d dlmZmZ d dlmZ d dlmZmZmZ d dlmZ d dlmZ  e j4                  e      Z G d	 d
ej:                  j<                        Z G d d      Z  G d d      Z! G d dejD                        Z#y)    N)OptionalTupleUnionDict)	constants
interfaces
exceptions)symbol_cachesymbol_finder)requirements)intelscannersarm)linux)	path_joinc                      e Zd ZdZddgZe	 ddej                  j                  de	de
j                  deej                  j                     fd	       Zeefdej                  j                  de	d
ededej(                  defd       Ze ej0                         	 ddej                  j                  de	de	de
j                  deeef   f
d              Zy)LinuxStacker#   macwindowsNcontext
layer_nameprogress_callbackreturnc                 b   d}t         j                  j                  |t        j                  j
                        s4t        j                  d| dt        j                  j
                          y|j                  |   }t        |t        j                        st        |t        j                        ryt        j                  j!                  t"        j$                  t"        j&                        }t        j                  |      j)                  d      }|st        j                  d       yg }t+        j,                  |D 	cg c]  }	|	|		 c}	      }
|j/                  ||
|      D ]  \  }}||v r|j1                  |       t        j3                  d	t5        |              |j7                  |d      }|sS|j8                  j;                  d
      }t=        j>                  |d|z   ||      }|j8                  j1                  |       |j                  jA                  d      }tC        d|      }||jD                  tC        |d      <   tG        |d      |jD                  tC        |tH        jJ                        <   tL        tN        g}|D ]Y  }	  ||       }|jQ                  ||||||||      }|r3t        j3                  d|jR                  jT                   d       |c c S [  t        j3                  d       yc c}	w # tV        $ r}t        jY                  |       Y d}~d}~ww xY w)z-Attempts to identify linux within this layer.)   r   r   z+SQLiteCache version not suitable: required z found Nr   )operating_systemz[No Linux banners found - if this is a linux plugin, please check your symbol files location)r   scannerr   zIdentified banner: r   z
temporary.)nameisf_url
LinuxLayerLinuxHelpermemory_layerzlatin-1)r   r   table
table_nameconfig_pathnew_layer_namebannerr   z	Detected z layerz)No suitable Linux banner could be matched)-r   VersionRequirementmatches_requiredr
   SqliteCacheversionvolloginfolayers
isinstancer   Intelr   AArch64ospathjoinr   
CACHE_PATHIDENTIFIERS_FILENAMEget_identifier_dictionaryr   MultiStringScannerscanappenddebugreprgetsymbol_spacefree_table_namer   LinuxKernelIntermedSymbolsfree_layer_namer   configstrLinuxSymbolFinderbanner_config_keyLinuxIntelSubStackerLinuxAArch64SubStackerstack	__class____name__	Exception	exception)clsr   r   r   requiredlayeridentifiers_pathlinux_bannersseen_bannersxmss_r(   isf_pathr%   r$   r'   r&   linux_arch_stackerslinux_arch_stackersub_stackeres                         W/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/linux.pyrI   zLinuxStacker.stack   s    ..??l..66
 KK=hZw|OgOgOoOoNpq  z* eU[[)Zs{{-K77<<  )"@"@
 %00

#
#W
#
= 	 KKm ))m*Uq}1*UVS<M $ 
IAv %##F+LL.tF|n=>$((6H$11AA.Q
88 :-#$	 $$++E2!(!?!?!M'~FISynEF 	* k+<+N+NO (<=S&T#*=&,&8&= + 1 1$+'1"''1(3+9#).? !2 	! !"LL9U__5M5M4Nf)UV#(L ! +>;
` 	@Ae +V\ % ,((++,s%   L	LAL	L.L))L.linux_banner_addresstarget_bannerloggerc                 ^   	 |j                  |      d   }|j                  |   j                  |t        |            }||k(  s(|j                  t        j                  d| d| d       yy# t        j
                  $ r-}	|j                  t        j                  d|	        Y d}	~	yd}	~	ww xY w)	zDetermine if a stacked layer is correct or a false positive, by calling the underlying
        _translate method against the linux_banner symbol virtual address. Then, compare it with
        the detected banner to verify the correct translation.
        r   z<Unable to translate "linux_banner" symbol virtual address : NFzAMismatch between scanned and virtually translated linux banner : z != .T)

_translater/   readlenr	   InvalidAddressExceptionlogr   LOGLEVEL_VVVVLOGLEVEL_VV)
rN   r   rP   r   r]   r^   r_   banner_phys_addressbanner_valuer[   s
             r\   verify_translation_by_bannerz)LinuxStacker.verify_translation_by_banneru   s    
	"'"2"23G"H"K">>*5::#S%7L },JJ%%STaSbbfgsfttuv  11 	JJ''NqcR 	s   <A, ,B,?#B''B,symbol_tablec           	      R   |j                  ||d      }d}|j                  |   j                  j                  dd      }|t        j
                  z   dz   }|j                  j                  |      j                  }	|j                  d      }
|
j                  d      }|j                  |   j                  t        j                  |      ||      D ]?  }||z
  }|j                  d|d	
      }|j                  dk7  r-|j!                  d      r|j"                  j%                  d      dk7  r]t&        j)                  |j*                  j%                  d|j*                  j,                  j.                        |j*                  j,                  j0                  j2                        |j                  d      j                  z
  }|r||z  }||	z
  }|dz  dk7  s|dz  dk7  rt4        j7                  dt9        |       dt9        |              ||fc S  t4        j7                  d       y)zXDetermines the offset of the actual DTB in physical space and its
        symbol offset.r   s-   swapper(\/0|\x00\x00)\x00\x00\x00\x00\x00\x00symbol_maskN	init_tasktask_structcomm)r   r   r   T)object_typeoffsetabsolutestatezunsigned intbytes)length)	byteorder
init_filesi  z<Linux addresses shift values determined: KASLR (physical) = z, ASLR (virtual) = z>Scanners could not determine any ASLR shifts, using 0 for both)r   r   )moduler?   rC   r>   r   BANG
get_symboladdressget_typerelative_child_offsetr/   r:   r   RegExScannerobjectpid
has_memberru   castint
from_bytesfilesvolsizedata_formatrx   r-   r<   hex)rN   r   rl   r   r   rz   swapper_signatureaddress_maskinit_task_symbolinit_task_json_addresstask_symbolcomm_child_offsetrs   init_task_addressro   
aslr_shiftkaslr_shifts                    r\   	find_aslrzLinuxStacker.find_aslr   s=    j!<M++L9@@DD4
 ()..8;F!(!5!5!@!@"

' 	 oom4'==fEnnZ055))*;</ 6 
F
 !'): :)2Cd & I }}!$$W-OO((8A= OO((9L9L9Q9Q(R'oo11==GG   ##L199	:  ',6
 ,.DDK E!Q&+*=*BLLNsS^O_N``stw  yC  uD  tE  F 
**K
P 	UV    N)rK   
__module____qualname__stack_orderexclusion_listclassmethodr   r   ContextInterfacerD   r   ProgressCallbackr   r/   DataLayerInterfacerI   r-   r   rv   loggingLoggerboolrk   	functools	lru_cacher   r    r   r\   r   r      sR   KY'N
 9=	Y##44Y Y %55	Y
 
*##66	7Y Yv  "(!##44! 	!
 "! ! ! 
! !F Y 9=?##44? ? 	?
 %55? 
sCx?  ?r   r   c                       e Zd Z ej                  e de       ZdZdZdeddfdZ		 dde
j                  j                  d	ed
ej                  dededededej"                  deej(                  ej*                  df   fdZededefd       Zy)rG   ra   l        l        parent_stackerr   Nc                     || _         y r   r   selfr   s     r\   __init__zLinuxIntelSubStacker.__init__   
    ,r   r   r   r$   r%   r&   r'   r(   r   c	                    t         j                  }	d|j                  v rt         j                  }	d}
n#d|j                  v rt         j                  }	d}
nd}
| j                  j                  ||||      \  }}|j                  |
      j                  }|dk7  r||z   n| j                  |      }||j                  t        |d      <    |	|||ddi	      }||j                  d
<   | j                  j                  ||||j                  d      j                  |z   || j                        }|r-|r+|r)| j                  j                  dt        |              |S |j                          y )Ninit_top_pgtinit_level4_pgtswapper_pg_dirr   r   page_map_offsetr3   Linuxr&   r   metadatakernel_virtual_offsetlinux_bannerr   rP   r   r]   r^   r_   zDTB was found at: )r   r1   symbolsIntel32er   r   r|   r}   virtual_to_physical_addressrC   r   rk   _loggerr<   r   destroy)r   r   r   r$   r%   r&   r'   r(   r   layer_classdtb_symbol_namer   r   dtbrP   test_banner_equalitys                   r\   rI   zLinuxIntelSubStacker.stack   s{    kkU]]*..K,O%--/..K/O.O"&"5"5"?"?/	 #@ #
Z /77 a +11#6 	 EHy.?@A#G_	
 1;,-  $22OO!!&!1!1.!A!I!IJ!V <<  P  
 S1LL!3CH:>?LMMOr   addrc                 \    || j                   kD  r|| j                   z
  S || j                  z
  S )z[Converts a virtual Intel Linux address to a physical one (does not account
        of ASLR))+_LinuxIntelSubStacker__START_KERNEL_map_x64+_LinuxIntelSubStacker__START_KERNEL_map_x86)rN   r   s     r\   r   z0LinuxIntelSubStacker.virtual_to_physical_address$  s4    
 #,,,#4444c0000r   r   )rK   r   r   r   	getLoggerr   r   r   r   r   r   r   r   rD   r   rA   r   r   r   r   r1   r   rI   r   r   r   r   r   r\   rG   rG      s    g:,a~ >?G/'-| - - 9==##44= = //	=
 = = = = %55= 
u{{ENND0	1=~ 1s 1s 1 1r   rG   c                      e Zd Z ej                  e de       Zej                  j                  j                   diZ	de
ddfdZ	 ddej                  j                  ded	ej"                  d
ededededej(                  deej,                     fdZedej                  j                  ded
edeeef   dedeeef   fd       Zy)rH   ra   reg_id_aa64mmfr1r   r   Nc                     || _         y r   r   r   s     r\   r   zLinuxAArch64SubStacker.__init__6  r   r   r   r   r$   r%   r&   r'   r(   r   c	           
      Z   t         j                  }	| j                  j                  ||||      \  }
}|j	                  d      j
                  |
z   }t        j                  |t         j                  j                  j                        |j                  t        |t         j                  j                  j                        <   ||j                  t        |d      <   |j                  d      j                  j                  j                   dk(  rdnd}||j                  d      j                  j                  j"                  dk(  rd	nd
z  }||j                  t        |d      <   d}d|j$                  v r|j	                  d      j
                  }d|j$                  v r!||j	                  d      j
                  dz  z  }d|j$                  v r||j	                  d      j
                  z  }|dz	  dz  }d|cxk  rdk  r	n nd|z  gng d}d}d|j$                  v rS|j	                  d      j
                  |
z   }t'        j(                  ||j*                  |   j-                  |d            \  }|s0	 |j	                  d      j
                  dz  j/                         dz   }	 |gt1        ddd      D cg c]  }||z   	 c}z   }|D ]  }d}t        j                  d|z
  t         j                  j2                  j4                  |      }t        j                  d|z
  t         j                  j2                  j6                  |      }|D ]  }t         j8                  j;                  |d      }t         j8                  j=                  |d      }t        j                  |t         j                  j2                  j>                  |      }t        j                  |t         j                  j2                  j@                  |      }||j                  t        |t         j                  j2                  j                        <    |	|||ddi      }||j                  d<   | j                  jC                  ||||j	                  d      j
                  |z   || jD                         }|r|r|r	 | jG                  |||| jH                  |
!      }|jK                         D cg c]  }|jL                   }}|jO                         D ]  \  }}||v s||j                  |<    	 | jD                  j[                  d#t]        |              |c c S |j_                            y c c}w c c}w # tP        jR                  $ r6} | jD                  jU                  tV        jX                  | d"       Y d } ~ d } ~ ww xY w)$Nr   r   r   pointerlittle<big   QIentry_formatr   _kernel_flags_le_kernel_flags_le_hi32    _kernel_flags_le_lo32r         )r      @   vabits_actualr   l    r   Tr3   r   r   r   r   )r   r   r%   	registersr   )exc_infozTTB1 was found at: )0r   LinuxAArch64r   r   r|   r}   set_reg_bitsAArch64RegMap	TTBR1_EL1BADDRrC   r   rK   r~   r   r   rx   rw   r   structunpackr/   rc   
bit_lengthrangeTCR_EL1T1SZT0SZAArch64RegFieldValues_get_ttbr1_el1_granule_size_get_ttbr0_el1_granule_sizeTG1TG0rk   r    get_registers_from_cpuinfo_arm64_optional_cpu_registersget_requirementsr   itemsr	   SymbolErrorrf   r   LOGLEVEL_VVVr<   r   r   )!r   r   r   r$   r%   r&   r'   r(   r   r   r   r   ttb1r   kernel_flagspage_size_kernel_space_bit!page_size_kernel_space_candidatesva_bitsvabits_actual_phys_addriva_bits_candidatestcr_el1page_size_kernel_spacetcr_el1_tg1tcr_el1_tg0rP   r   optional_cpu_registersreq	layer_reqregreg_valr[   s!                                    r\   rI   zLinuxAArch64SubStacker.stack9  sp    &&"&"5"5"?"?/	 #@ #
Z  0199KGT3#4#4#>#>#D#DE 	yc.?.?.I.I.R.RST EIy.?@A ~~i(,,88BBhN  	
 	>>),00<<CCqHCc	
 BNyn=> . ++,>?GGL"emm3E,,-DEMMQSSSL"emm3E,,-DEMMML '3a&71%<" .3!3 **+ 	* emm+  199KG $  z*//0GKJW    088IFjlQG	 &YuRR?P)Q!'A+)QQ)GG&&Wc//77<<gG &&Wc//77<<gG +L&!77SS*D "77SS*D **!2!2!:!:!>!> **!2!2!:!:!>!>
  k3+<+<+D+D+M+MN
 $ +'"G_	 9C45'+':':'W'W#)).)9)9.)I)Q)Q *!"(<< (X ($ T&:S151V1V$+'1'1&*&B&B(3 2W 2. :?9O9O9Q$R#SXX$R	$R,B,H,H,JLC"i/4;S 1 -K LL&&)<SYK'HI LMMOq +L *L O *Rv %S
 &11 S(()?)?T(RRSs6   0U2U!U$U!U!U!!V*4,V%%V*r   r   c                     |j                  |||      }|j                  d      }i }|j                         D ]  \  }	}
	 t        ||
      }|||	<    |S # t        $ r1 | j
                  j                  t        j                  d|
 d       Y Uw xY w)Nboot_cpu_dataz*boot_cpu_data struct does not include the z field.)	rz   object_from_symbolr   getattrAttributeErrorr   rf   r   r   )rN   r   r   r%   r   r   tmp_kernel_moduleboot_cpu_data_structresultsr  reg_attribute_namecpu_reg_values               r\   r   z7LinuxAArch64SubStacker.get_registers_from_cpuinfo_arm64  s     $NN:z;O0CCOT'0'8#C# '(<>P Q, (9  " **@AS@TT[\s   A7BBr   )rK   r   r   r   r   r   r   r   ID_AA64MMFR1_EL1r   r   r   r   r   r   rD   r   rA   rv   r   r   r   r   rI   r   r   r   r   r   r   r\   rH   rH   .  sN   g:,a~ >?G 	**335G-| - - 9=\##44\ \ //	\
 \ \ \ \ %55\ 
#""	#\| ##44  	
 S>  
c3h r   rH   c                   *    e Zd ZdZdZdZdZd ZddgZy)	rE   z5Linux symbol loader based on uname signature strings.kernel_bannerr   z>volatility3.framework.symbols.linux.LinuxKernelIntermedSymbolsc                 ,    t        j                  | d   S )Nr   )r   r   )rN   argss     r\   <lambda>zLinuxSymbolFinder.<lambda>  s    <#9#94#@#Cr   r   r   N)	rK   r   r   __doc__rF   r   symbol_classr   r   r   r   r\   rE   rE     s%    ?'SLCIY'Nr   rE   )$r   r3   r   r   typingr   r   r   r   volatility3.frameworkr   r   r	   volatility3.framework.automagicr
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   r   r   volatility3.framework.symbolsr   .volatility3.framework.interfaces.configurationr   r   rK   r-   	automagicStackerLayerInterfacer   rG   rH   SymbolFinderrE   r   r   r\   <module>r%     s   
  	   / / C C G < = = / D			8	$E:''== EPN1 N1b@ @F(22 (r   