
    Xf'                         d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	 d dl
mZmZ d dlmZ d dlmZmZ d dlmZ  e j        e          Z G d d	ej        j                  Z G d
 dej                  ZdS )    N)Optional)	constants
exceptions
interfaceslayers)symbol_cachesymbol_finder)requirements)intelscanners)macc                      e Zd ZdZddgZe	 ddej        j        de	de
j        deej        j                 fd	            Ze	 	 	 ddej        j        de	de	de	dede
j        defd            Zededefd            Zed             ZdS )MacIntelStacker#   windowslinuxNcontext
layer_nameprogress_callbackreturnc           	      	   d}t           j                            |t          j        j                  s1t                              d| dt          j        j                    dS |j        |         }d}t          j
        j        }t          |t          j                  rdS t          j                            t$          j        t$          j                  }t          j        |                              d          }	|	st                              d           dS t-          j        d |	D                       }
|                    ||
|	          D ]\  }}d}t                              d
t5          |                      |	                    |d          }|r|j                            d          }t=          j        | |d|          ||          }|j                             |           | !                    ||||||          }|dk    r)t          "                    t$          j#        d|            | $                    |%                    d          j&        |z             }|j        '                    d          } |dd|          }||j(         ||d          <   ||j(         ||d          <   t          j        )                    |||ddi          }|%                    d          j&        |z   }	 |*                    |d          }n?# tV          j,        $ r- t          "                    t$          j-        d|d           Y w xY wt]          j/        d|          d         }|}|dz  r+t          "                    t$          j#        d |d           P|}|j        '                    d!          } |dd|          }||j(         ||d          <   ||j(         ||d          <   ta          |d"          |j(         ||tb          j2                  <   t          j)        |||ddi          }||j(        d#<   |r$|r"t                              d$|d           |c S t                              d%           dS )&z+Attempts to identify mac within this layer.)   r   r   z+SQLiteCache version not suitable: required z found Nr   )operating_systemzWNo Mac banners found - if this is a mac plugin, please check your symbol files locationc                     g | ]}||S  r   .0xs     U/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/mac.py
<listcomp>z)MacIntelStacker.stack.<locals>.<listcomp>@   s    *G*G*GQ*G1*G*G*G    )r   scannerr   zIdentified banner: MacintelStacker	temporary)r   config_pathnameisf_url)r   symbol_tabler   compare_bannercompare_banner_offsetr   r   z%Invalid kalsr_shift found at offset: BootPML4MacDTBTempLayer	automagicMacIntelHelpermemory_layerpage_map_offsetosMac)r%   r&   metadataIdlePML4   z!Skipping invalid idlepml4_ptr: 0x0x<Ii   z!Skipping non-page aligned DTB: 0x
IntelLayerzlatin-1kernel_virtual_offsetzDTB was found at: 0xz'No suitable mac banner could be matched)3r
   VersionRequirementmatches_requiredr   SqliteCacheversionvolloginfor   r   configuration	path_join
isinstancer   Intelr1   pathjoinr   
CACHE_PATHIDENTIFIERS_FILENAMEget_identifier_dictionaryr   MultiStringScannerscandebugreprgetsymbol_spacefree_table_namer   MacKernelIntermedSymbolsappend	find_aslrlogLOGLEVEL_VVVvirtual_to_physical_address
get_symboladdressfree_layer_nameconfigIntel32ereadr   InvalidAddressExceptionLOGLEVEL_VVVVstructunpackstrMacSymbolFinderbanner_config_key)clsr   r   r   requiredlayer	new_layerrE   identifiers_pathmac_bannersmssbanner_offsetbannerdtbisf_path
table_nametablekaslr_shiftbootpml4_addrnew_layer_namer%   idlepml4_ptridlepml4_stridlepml4_addrtmp_dtbs                            r   stackzMacIntelStacker.stack   s    .??l.6
 
 	 KKqhqq|OgOoqq   4 z*	'1 eU[)) 	47<< )"@
 
 #.
 

#
#U
#
;
; 	  	KKi   4)*G*Gk*G*G*GHH%*ZZS<M &0 &
 &
 Z	! Z	!!M6 CLL=tF||==>>>"vt44H OH$1AABSTT
4# $[* = =#$	   $++E222!mm#!+)#)*7&7 ,   !##JJ!.OOO    # ? ?$$Z008;F! ! ")!?!?@Q!R!R"d;0@.QQDNttK@@AGTttK1BCCD-- +'"E]	 .    %//
;;CkQ#(::lA#>#>LL!9   JJ!/MLMMM   H !'dL A A! D'T> JJ!.HGHHH    ")!?!?!M!M"d;0@.QQDNttK@@AGJttK1BCCD	** ttK1RSST "N +'"E]	  	 =H	 !89 !S !<C<<<===    >???ts   <L8MM r   r(   r)   r*   c                    |t           j        z   dz   }|j                            |          j        }|t           j        z   dz   }	|j                            |	          j        }
|                     |
          }|t           j        z   dz   }|j                            |          j        }|                     |          }|r|s|                     |||          }n||fg}d}|D ]\  }}d |dd                             d          dd	         D             \  }}||                     |          z
  }|j        |         	                    ||z   d
          }t          j        d|          d         }||k    r|j        |         	                    ||z   d
          }t          j        d|          d         }||k    r|dz  dk    r|dz  } t                              t           j        d|d           |S )zXDetermines the offset of the actual DTB in physical space and its
        symbol offset.r=   version_majorversion_minorr   c                 ,    g | ]}t          |          S r   )intr   s     r   r    z-MacIntelStacker.find_aslr.<locals>.<listcomp>   s    )W)W)WQ#a&&)W)W)Wr!      N   .   r5   r7   i  l    zMac find_aslr returned: r6   )r   BANGrN   rV   rW   rU   _scan_generatorsplitr   r[   r^   r_   r>   rS   r]   )rc   r   r(   r   r)   r*   r   version_symbolversion_json_addressversion_major_symbolversion_major_json_addressversion_major_phys_offsetversion_minor_symbolversion_minor_json_addressversion_minor_phys_offsetoffset_generator
aslr_shiftoffsetrk   banner_majorbanner_minortmp_aslr_shiftmajor_stringmajorminor_stringminors                             r   rR   zMacIntelStacker.find_aslr   se    &	6B&3>>~NNV+in<N%,%9%D%D &
 &

 	# %($C$C&%
 %
!  ,in<N%,%9%D%D &
 &

 	# %($C$C&%
 %
! % 	IN 	I"22%6    "7 GH
. 	 	NFF)W)W&+:K:KD:Q:QRSTURU:V)W)W)W&L,#c&E&E$' ' N #>*5::)N:A L M$55a8E$$">*5::)N:A L M$55a8E$$%**'*4J

9*,Vz,V,V,VWWWr!   addrc                 (    |dk    r|dz
  }n|dz
  }|S )zSConverts a virtual mac address to a physical one (does not account
        of ASLR)l        ~ l        ~ r   )rc   r   s     r   rU   z+MacIntelStacker.virtual_to_physical_address   s,     $$$,,DD.(Dr!   c              #     K   d}|j         |                             t          j        |          ||          D ]N}|j         |                             |d          }|                    d          }|dk    r
|d |         }||fV  Od S )Ns=   Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00)r"   r   r          )r   rJ   r   RegExScannerr[   find)rc   r   r   r   darwin_signaturer   rk   idxs           r   r   zMacIntelStacker._scan_generator   s       N 	 nZ055)*:;;/ 6 
 
 	! 	!F
 ^J/44VSAAF++g&&Cbyy&.    	! 	!r!   )N)rx   r   N)__name__
__module____qualname__stack_orderexclusion_listclassmethodr   r   ContextInterfacer`   r   ProgressCallbackr   r   DataLayerInterfacerw   r}   rR   rU   r   r   r!   r   r   r      sb       K)N
 9=	E E#4E E %5	E
 
*#6	7E E E [EN  !%&8<F F#4F F 	F
 F  #F %5F 
F F F [FP s s    [ ! ! [! ! !r!   r   c                   4    e Zd ZdZdZdZej        ZdZddgZ	dS )ra   z3Mac symbol loader based on uname signature strings.kernel_bannerr   z:volatility3.framework.symbols.mac.MacKernelIntermedSymbolsr   r   N)
r   r   r   __doc__rb   r   r   rR   symbol_classr   r   r!   r   ra   ra     s7        ==')IOL)NNNr!   ra   )loggingr1   r^   typingr   volatility3.frameworkr   r   r   r   volatility3.framework.automagicr   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   r   volatility3.framework.symbolsr   	getLoggerr   r>   r-   StackerLayerInterfacer   SymbolFinderra   r   r!   r   <module>r      s.  
  				        K K K K K K K K K K K K G G G G G G G G < < < < < < 8 8 8 8 8 8 8 8 - - - - - -		8	$	$q! q! q! q! q!j*@ q! q! q!h* * * * *m0 * * * * *r!   