
    Xf'                        d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	 d dl
mZmZ d dlmZ d dlmZmZ d dlmZ  e j(                  e      Z G d d	ej.                  j0                        Z G d
 dej4                        Zy)    N)Optional)	constants
exceptions
interfaceslayers)symbol_cachesymbol_finder)requirements)intelscanners)macc                   D   e Zd ZdZddgZe	 ddej                  j                  de	de
j                  deej                  j                     fd	       Ze	 	 	 ddej                  j                  d
e	de	de	dede
j                  defd       Zededefd       Zed        Zy)MacIntelStacker#   windowslinuxNcontext
layer_nameprogress_callbackreturnc           	      	   d}t         j                  j                  |t        j                  j
                        s4t        j                  d| dt        j                  j
                          y|j                  |   }d}t        j                  j                  }t        |t        j                        ryt        j                   j#                  t$        j&                  t$        j(                        }t        j                  |      j+                  d      }	|	st        j                  d       yt-        j.                  |	D 
cg c]  }
|
s|
	 c}
      }|j1                  |||      D ]  \  }}d}t        j3                  d	t5        |              |	j7                  |d      }|rc|j8                  j;                  d
      }t=        j>                  | |d|      ||      }|j8                  jA                  |       | jC                  ||||||      }|dk(  r(t        jE                  t$        jF                  d|        | jI                  |jK                  d      jL                  |z         }|j                  jO                  d      } |dd|      }||jP                   ||d      <   ||jP                   ||d      <   t        j                  jS                  |||ddi      }|jK                  d      jL                  |z   }	 |jU                  |d      }t]        j^                  d|      d   }|}|dz  r*t        jE                  t$        jF                  d|d       |}|j                  jO                  d       } |dd|      }||jP                   ||d      <   ||jP                   ||d      <   ta        |d!      |jP                   ||tb        jd                        <   t        jR                  |||ddi      }||jP                  d"<   |s|st        j3                  d#|d       |c S  t        j3                  d$       yc c}
w # tV        jX                  $ r, t        jE                  t$        jZ                  d|d       Y !w xY w)%z+Attempts to identify mac within this layer.)   r   r   z+SQLiteCache version not suitable: required z found Nr   )operating_systemzWNo Mac banners found - if this is a mac plugin, please check your symbol files location)r   scannerr   zIdentified banner: MacintelStacker	temporary)r   config_pathnameisf_url)r   symbol_tabler   compare_bannercompare_banner_offsetr   r   z%Invalid kalsr_shift found at offset: BootPML4MacDTBTempLayer	automagicMacIntelHelpermemory_layerpage_map_offsetosMac)r   r   metadataIdlePML4   z!Skipping invalid idlepml4_ptr: 0x0x<Ii   z!Skipping non-page aligned DTB: 0x
IntelLayerzlatin-1kernel_virtual_offsetzDTB was found at: 0xz'No suitable mac banner could be matched)3r
   VersionRequirementmatches_requiredr   SqliteCacheversionvolloginfor   r   configuration	path_join
isinstancer   Intelr)   pathjoinr   
CACHE_PATHIDENTIFIERS_FILENAMEget_identifier_dictionaryr   MultiStringScannerscandebugreprgetsymbol_spacefree_table_namer   MacKernelIntermedSymbolsappend	find_aslrlogLOGLEVEL_VVVvirtual_to_physical_address
get_symboladdressfree_layer_nameconfigIntel32ereadr   InvalidAddressExceptionLOGLEVEL_VVVVstructunpackstrMacSymbolFinderbanner_config_key)clsr   r   r   requiredlayer	new_layerr=   identifiers_pathmac_bannersxmssbanner_offsetbannerdtbisf_path
table_nametablekaslr_shiftbootpml4_addrnew_layer_namer   idlepml4_ptridlepml4_stridlepml4_addrtmp_dtbs                             U/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/mac.pystackzMacIntelStacker.stack   s_    ..??l..66
 KK=hZw|OgOgOoOoNpq  z*	''11 eU[[)77<<  )"@"@
 #..

#
#U
#
; 	 KKi ))k*GQ1*GH%*ZZS<M &0 &
 Z	!!M6 CLL.tF|n=>"vt4H$11AABST
44# $[* =#$	 $$++E2!mm#!+)#)*7&7 ,  !#JJ!..?O  # ? ?$$Z088;F! ")!?!?@Q!R";0@.QDNtK@AGTtK1BCD-- +'"E]	 .   %//
;CCkQ#(::lA#>L !'dL A! D'T>JJ!..;GB<H  ")!?!?!M";0@.QDNtK@AGJtK1BCD	* tK1R1RST "NN +'"E]		 =H	  !89S3C8<=  uZ	!v 	>?{ +Hh "99 JJ!//;L;LM s   Q	QQ;R
	R
r    r!   r"   c                    |t         j                  z   dz   }|j                  j                  |      j                  }|t         j                  z   dz   }	|j                  j                  |	      j                  }
| j                  |
      }|t         j                  z   dz   }|j                  j                  |      j                  }| j                  |      }|r|s| j                  |||      }n||fg}d}|D ]  \  }}|dd j                  d      dd D cg c]  }t        |       c}\  }}|| j                  |      z
  }|j                  |   j                  ||z   d	      }t        j                  d
|      d   }||k7  r|j                  |   j                  ||z   d	      }t        j                  d
|      d   }||k7  r|dz  dk7  r|dz  } n t        j                  t         j                  d|d       |S c c}w )zXDetermines the offset of the actual DTB in physical space and its
        symbol offset.r5   version_majorversion_minorr      N   .   r-   r/   i  l    zMac find_aslr returned: r.   )r   BANGrF   rN   rO   rM   _scan_generatorsplitintr   rS   rV   rW   r6   rK   rU   )r[   r   r    r   r!   r"   r   version_symbolversion_json_addressversion_major_symbolversion_major_json_addressversion_major_phys_offsetversion_minor_symbolversion_minor_json_addressversion_minor_phys_offsetoffset_generator
aslr_shiftoffsetrd   ra   banner_majorbanner_minortmp_aslr_shiftmajor_stringmajorminor_stringminors                              rp   rJ   zMacIntelStacker.find_aslr   s7    &	6B&33>>~NVV+inn<N%,%9%9%D%D &

' 	# %($C$C&%
!  ,inn<N%,%9%9%D%D &

' 	# %($C$C&%
! %N"22%6  "7 GH
. 	NFF:@+:K:KD:QRSTU:V)WQ#a&)W&L,#c&E&E$' N #>>*5::)N:AL MM$5a8E$">>*5::)N:AL MM$5a8E$%*'*4J7	: 	

9**.FzRTo,VW= *Xs   G=addrc                 (    |dkD  r|dz
  }|S |dz
  }|S )zSConverts a virtual mac address to a physical one (does not account
        of ASLR)l        ~ l        ~  )r[   r   s     rp   rM   z+MacIntelStacker.virtual_to_physical_address   s0     $$,,D  .(D    c              #     K   d}|j                   |   j                  t        j                  |      ||      D ]B  }|j                   |   j	                  |d      }|j                  d      }|dk7  r|d | }||f D y w)Ns=   Darwin Kernel Version \d{1,3}\.\d{1,3}\.\d{1,3}: [^\x00]+\x00)r   r   r          )r   rB   r   RegExScannerrS   find)r[   r   r   r   darwin_signaturer   rd   idxs           rp   ry   zMacIntelStacker._scan_generator   s      N 	 nnZ055))*:;/ 6 
 	!F
 ^^J/44VSAF++g&Cby&. 	!s   A=A?)N) r   N)__name__
__module____qualname__stack_orderexclusion_listclassmethodr   r   ContextInterfacerX   r   ProgressCallbackr   r   DataLayerInterfacerq   r{   rJ   rM   ry   r   r   rp   r   r      s-   K)N
 9=	E##44E E %55	E
 
*##66	7E EN  !%&8<F##44F F 	F
 F  #F %55F 
F FP s s   ! !r   r   c                   <    e Zd ZdZdZdZej                  ZdZddgZ	y)rY   z3Mac symbol loader based on uname signature strings.kernel_bannerr   z:volatility3.framework.symbols.mac.MacKernelIntermedSymbolsr   r   N)
r   r   r   __doc__rZ   r   r   rJ   symbol_classr   r   r   rp   rY   rY     s+    ='))IOL)Nr   rY   )loggingr)   rV   typingr   volatility3.frameworkr   r   r   r   volatility3.framework.automagicr   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   r   volatility3.framework.symbolsr   	getLoggerr   r6   r%   StackerLayerInterfacer   SymbolFinderrY   r   r   rp   <module>r      sd   
  	   K K G < 8 -			8	$q!j**@@ q!h*m00 *r   