
    XfT                        d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ  ej        e          Z ee!ee"         f         Z# G d	 d
          Z$ G d de$          Z% G d de$          Z& G d de$          Z' G d dej(        j)                  Z* G d de*          Z+ G d dej,        j-                  Z. G d d          Z/dS )    N)abstractmethod)Dict	GeneratorIterableListOptionalTuple)	frameworkschemas)	constants
interfaces)requirements)	resources)intermedc                   P    e Zd ZdZd Zeedee         fd                        Z	dS )IdentifierProcessorNc                     d S N selfs    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/symbol_cache.py__init__zIdentifierProcessor.__init__!   s        returnc                      t          d          )zMethod to extract the identifier from a particular operating system's JSON

        Returns:
            identifier is valid or None if not found
        z4This base class has no get_identifier method defined)NotImplementedError)clsjsons     r   get_identifierz"IdentifierProcessor.get_identifier$   s     "B
 
 	
r   )
__name__
__module____qualname__operating_systemr   classmethodr   r   bytesr    r   r   r   r   r      s^           
Xe_ 
 
 
 ^ [
 
 
r   r   c            	       f    e Zd ZdZdZedee         fd            Zede	de	de
defd            Zd	S )
WindowsIdentifierwindows|r   c                 :    |j         di                                di                                di           }|r_|                     dd          }|                     dd          }|                     dd          }|r|r|r|                     |||          S dS )z7Returns the identifier for the file if one can be foundmetadatar)   pdbGUIDNagedatabase)getgenerate)r   r   windows_metadataguidr/   r0   s         r   r    z WindowsIdentifier.get_identifier5   s     $48J3377	2FFJJ5RTUU 	9#''55D"&&ud33C'++J==H 9 9 9||HdC888tr   pdb_namer4   r/   c           	          t          | j                            ||                                t	          |          g          d          S )Nzlatin-1)r&   	separatorjoinupperstr)r   r5   r4   r/   s       r   r2   zWindowsIdentifier.generateA   s7    S]''4::<<S(JKKYWWWr   N)r!   r"   r#   r$   r7   r%   r   r&   r    r:   intr2   r   r   r   r(   r(   1   s         I	Xe_ 	 	 	 [	 X X3 XS XU X X X [X X Xr   r(   c                   :    e Zd ZdZedee         fd            ZdS )MacIdentifiermacr   c                      |j         di                                di                                dd           }|rt          j        |          S d S )Nsymbolsversionconstant_datar1   base64	b64decode)r   r   
mac_banners      r   r    zMacIdentifier.get_identifierI   sZ     DHY##''	266::?DQQ 	  	0#J///tr   Nr!   r"   r#   r$   r%   r   r&   r    r   r   r   r=   r=   F   sC        Xe_    [  r   r=   c                   :    e Zd ZdZedee         fd            ZdS )LinuxIdentifierlinuxr   c                      |j         di                                di                                dd           }|rt          j        |          S d S )Nr@   linux_bannerrB   rC   )r   r   rL   s      r   r    zLinuxIdentifier.get_identifierV   s[     DHY##'';;??QUVV 	  	2#L111tr   NrG   r   r   r   rI   rI   S   sC        Xe_    [  r   rI   c            	       F    e Zd Zdef fdZdededefdZdedee         dee         fdZde	e         fd	Z
d
 Z	 ddee         dedeeef         fdZdedee         fdZdee         dee         fdZdedeeeeeef                  fdZdedee         fdZ xZS )CacheManagerInterfacefilenamec                     t                                                       || _        i | _        t	          j        t                    D ]}|| j        |j        <   d S r   )superr   	_filename_classifiersr
   class_subclassesr   r$   )r   rO   subclazz	__class__s      r   r   zCacheManagerInterface.__init__d   sd    !!23FGG 	D 	DH;CDh788	D 	Dr   locationr$   
identifierc                     dS )zAdds an identifier to the storeNr   )r   rW   r$   rX   s       r   add_identifierz$CacheManagerInterface.add_identifierk       r   r   c                     dS )aw  Returns the location of the symbol file given the identifier

        Args:
            identifier: string that uniquely identifies a particular symbol table
            operating_system: optional string to restrict identifiers to just those for a particular operating system

        Returns:
            The location of the symbols file that matches the identifier
        Nr   )r   rX   r$   s      r   find_locationz#CacheManagerInterface.find_locationo   	     	r   c                     dS )z)Returns a list of all the local locationsNr   r   s    r   get_local_locationsz)CacheManagerInterface.get_local_locations}   r[   r   c                     dS )Locates all files under the symbol directories.  Updates the cache with additions, modifications and removals.
        This also updates remote locations based on a cache timeout.

        Nr   r   s    r   updatezCacheManagerInterface.update   s	    
 	r   NF
local_onlyc                     dS )a#  Returns a dictionary of identifiers and locations

        Args:
            operating_system: If set, limits responses to a specific operating system
            local_only: Returns only local locations

        Returns:
            A dictionary of identifiers mapped to a location
        Nr   )r   r$   rd   s      r   get_identifier_dictionaryz/CacheManagerInterface.get_identifier_dictionary   r^   r   c                     dS )z:Returns an identifier based on a specific location or NoneNr   r   rW   s     r   r    z$CacheManagerInterface.get_identifier   r[   r   c                     dS )z9Returns all identifiers for a particular operating systemNr   )r   r$   s     r   get_identifiersz%CacheManagerInterface.get_identifiers   r[   r   c                     dS )zReturns ISF statistics based on the location

        Returns:
            A tuple of base_types, types, enums, symbols, or None is location not found
        Nr   rh   s     r   get_location_statisticsz-CacheManagerInterface.get_location_statistics         r   c                     dS )z7Returns the hash of the JSON from within a location ISFNr   rh   s     r   get_hashzCacheManagerInterface.get_hash   rm   r   NF)r!   r"   r#   r:   r   rZ   r&   r   r]   r   r`   rc   boolr   rf   r    r   rj   r	   r;   rl   ro   __classcell__rV   s   @r   rN   rN   c   s       D D D D D D Ds c s    3;C=	#   Xc]       JO  (BF	eSj	   s x     $u+    	%S#s*+	,   F F# F F F F F F F Fr   rN   c            	       l    e Zd ZdZdZdef fdZdedej        fdZ	de
d	ee         dee         fd
Zdeeddf         fdZdedefdZdedee
         fdZdedeeeeeef                  fdZdedee         fdZddZ	 dd	ee         dedee
ef         fdZd	ee         dee
         fdZ xZS )SqliteCache)   r   r      r   r   rO   c                 *   t                                          |           t          j        | _        	 |                     |          | _        d S # t          j        $ r2 t          j
        |           |                     |          | _        Y d S w xY wr   )rQ   r   r   SQLITE_CACHE_PERIODcache_period_connect_storage	_databasesqlite3DatabaseErrorosunlink)r   rO   rV   s     r   r   zSqliteCache.__init__   s    """%9	=!228<<DNNN$ 	= 	= 	=Ih!228<<DNNNN	=s   A =BBpathr   c                     t          j        |          }t           j        |_        |                                                    dt          j         d           |                                                    d                                          }|s6|                                                    dt          j         d           nw|d         t          j        k    rn`t          
                    d|d                     |                                 t          j        |           |                     |          S |                                                    d           |                                 |S )NzECREATE TABLE IF NOT EXISTS database_info (schema_version INT DEFAULT )z(SELECT schema_version FROM database_infoz"INSERT INTO database_info VALUES (schema_versionz%Previous cache schema version found: a  CREATE TABLE IF NOT EXISTS cache (location TEXT UNIQUE NOT NULL, identifier TEXT, operating_system TEXT, hash TEXT,stats_base_types INT DEFAULT 0, stats_types INT DEFAULT 0, stats_enums INT DEFAULT 0, stats_symbols INT DEFAULT 0, local BOOL, cached DATETIME))r~   connectRowrow_factorycursorexecuter   CACHE_SQLITE_SCHEMA_VERSIONfetchonevolloginfocloser   r   r|   commit)r   r   r0   r   s       r   r|   zSqliteCache._connect_storage   sn   ?4((&{!!|T]Ty|||	
 	
 	
 OOW?@@XZZ 	
  	/OO%%]Y5Z]]]    ,-1VVVKKZGW8XZZ  
 NNIdOOO((...!!^	
 	
 	
 	r   rX   r$   c                     d}|f}|d}||f}| j                                                             ||                                          }d}|D ]
}|d         }|S )a  Returns the location of the symbol file given the identifier.
        If multiple locations exist for an identifier, the last found is returned

        Args:
            identifier: string that uniquely identifies a particular symbol table
            operating_system: optional string to restrict identifiers to just those for a particular operating system

        Returns:
            The location of the symbols file that matches the identifier or None
        z/SELECT location FROM cache WHERE identifier = ?NzHSELECT location FROM cache WHERE identifier = ? AND operating_system = ?rW   r}   r   r   fetchall)r   rX   r$   	statement
parametersresultsresultrows           r   r]   zSqliteCache.find_location   sz     F	 ]
'bI$&67J.''))11)ZHHQQSS 	% 	%C_FFr   Nc              #      K   | j                                                             d                                          }|D ]}|d         V  d S )Nz3SELECT DISTINCT location FROM cache WHERE local = 1rW   r   )r   r   r   s      r   r`   zSqliteCache.get_local_locations   sa      N!!##WJKKXZZ 	
  	" 	"Cj/!!!!	" 	"r   urlc                 R    t           j                            |          }|j        dv S )z)Determines whether an url is local or not)filejar)urllibparseurlparsescheme)r   r   parseds      r   is_url_localzSqliteCache.is_url_local   s$    &&s++}//r   rW   c                     | j                                                             d|f                                          }|D ]}|d         c S d S )Nz/SELECT identifier FROM cache WHERE location = ?rX   r   r   rW   r   r   s       r   r    zSqliteCache.get_identifier  sZ    N!!##WFTTXZZ 	
  	% 	%C|$$$$tr   c                     | j                                                             d|f                                          }|D ]!}|d         |d         |d         |d         fc S d S )Nz^SELECT stats_base_types, stats_types, stats_enums, stats_symbols FROM cache WHERE location = ?stats_base_typesstats_typesstats_enumsstats_symbolsr   r   s       r   rl   z#SqliteCache.get_location_statistics  s     N!!##Wp  XZZ 	  	 	C&'M"M"O$	    tr   c                     | j                                                             d|f                                          }|D ]}|d         c S d S )Nz)SELECT hash FROM cache WHERE location = ?hashr   r   s       r   ro   zSqliteCache.get_hash  sY    N!!##W@8+NNXZZ 	
  	 	Cv;tr   c                 h   t          d t          j                            d          D                       }t          |                                           }|                    |          }|                    |          }|rx| j                                                            dd	                    dgt          |          z             dd |D                        | j                                         t                      }|                    |          }|r| j                                                            d| j         d	          }|D ]}	|	d
         }
t          j                            |	d                   }|}t           j                            |
          }d}|j        dk    r$t           j                            |j                  }|j        dk    rOt           j                            |j                  }|j        dk    r |j                            d          d         }|rVt0          j                            |          r7t          j                            t1          j        |          j                  }n%t:                              t>          j         d           |	d
         |v r!||k     r|!                    |	d
                    tE          tG          j$        tJ                              }|&                    |          }t          |          }| j                                        }	 tO          |          D ]\  }}
 ||dz  |z  d| d           	 tQ          j)                    *                    |
          5 }tW          j,        |          }t[          j.        |          }d}t          |/                    di                     }t          |/                    di                     }t          |/                    di                     }t          |/                    di                     }d}|D ]"}|0                    |          }|	|j1        } n#|                    d|
|||||||| 2                    |
          f	           |,t:                              t>          j3        d|
 d|            n(t:                              t>          j         d|
            ddd           n# 1 swxY w Y   # th          $ r0}t:                              t>          j         |           Y d}~d}~ww xY w	 | j                                         n# | j                                         w xY wt>          j5        st>          j6        r |dd           | j                                        }|                    d| j         d           to          t>          j6                  }  |d d           t>          j8        D ]p}| 9                    i |!          }!|!D ]T\  }}
|:                                }|;                    d"          r
|dd#         n|}|                    d$||
|d%f           Uq |dd           | j                                         dS dS dS )&rb   c                     g | ]}|S r   r   ).0rO   s     r   
<listcomp>z&SqliteCache.update.<locals>.<listcomp>/  s(          r    z%DELETE FROM cache WHERE location IN (,?r   c                     g | ]}|S r   r   )r   xs     r   r   z&SqliteCache.update.<locals>.<listcomp>=  s    ...q...r   zMSELECT location, cached FROM cache WHERE local = 1 AND cached < date('now', 'z');rW   cachedNr   r   !r   z?File location in database classed as local but not file/jar URLd   zUpdating caches for z	 files...
base_types
user_typesenumsr@   zINSERT OR REPLACE INTO cache (location, identifier, operating_system, hash,stats_base_types, stats_types, stats_enums, stats_symbols, local, cached) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))zIdentified z as zNo identifier found for zReading remote ISF listzGSELECT cached FROM cache WHERE local = 0 and cached < datetime('now', 'z')2   )r$       zxINSERT OR REPLACE INTO cache(identifier, location, operating_system, local, cached) VALUES (?, ?, ?, ?, datetime('now'))F)<setr   IntermediateSymbolTablefile_symbol_urlr`   
differencer}   r   r   r8   lenr   intersectionr{   datetimefromisoformatr   r   r   r   requesturl2pathnamer   splitr   existsfromtimestampstatst_mtimer   logr   LOGLEVEL_VVVVaddlistr
   rT   r   union	enumerater   ResourceAccessoropenr   loadr   create_json_hashr1   r    r$   r   LOGLEVEL_VV	ExceptionOFFLINEREMOTE_ISF_URLRemoteIdentifierFormatOS_CATEGORIESprocessrstripendswith)"r   progress_callbackon_disk_locationscached_locationsnew_locationsmissing_locationscache_updatefiles_to_timestampr   r   rW   stored_timestamp	timestampr   pathname	inner_urlidextractorsfiles_to_processnumber_files_to_processr   counterfpjson_objr   rX   r   r   r   r   r$   idextractorexcpremote_identifiersidentifierss"                                     r   rc   zSqliteCache.update)  s|   
    ( @ P PQS T T  
 
 t7799::)445EFF,778IJJ  	$N!!##++c#M^I_I_A_8`8`ccc..-...   N!!###uu.;;<LMM #	6^**,,44D-1->D D D F  6 6z?#+#4#B#B3x=#Q#Q ,	  ..x88=F**%~::6;GGH=E)) & 5 5fk B BI '611#,>#7#7#<#<Q#? x 8 8  ( 1 ? ?))2! !II JJ!/Y   
O'999(944 $$S_555I67JKKLL )..|<<"%&6"7"7&&((9	$%./?%@%@ 6> 6>!!!cM$;;M+BMMM  0>"355::8DD -#'9R==&7AA%)
 ,/x||L"/M/M+N+N(&)(,,|R*H*H&I&I&)(,,w*C*C&D&D(+HLLB,G,G(H(H+/(+7 & &K)4)C)CH)M)MJ)53>3O 0 %  6 a !) * 0 $ 0 + + - $ 1 1( ; ;
	    &1"JJ ) 5 Hh H HJ H H   
 #JJ ) 7 E8 E E  U- - - - - - - - - - - - - - -\ ! > > >JJy6========>k6>p N!!####DN!!####   	$Y%= 	$a!:;;;^**,,FNNoZ^Zkooo   "8	8P!Q!Qb";<<<$-$;   088)9 9   -8  (J!+!2!2!4!4J+5+>+>w+G+GW
3B3Z  NN S#X/?G    c#<===N!!#####-	$ 	$ 	$ 	$s[   +U, /&TE&T;TT	TT	TU, 
U%U	U, 	UU, ,VFrd   c                    i }g }d}|r|                     d           |r|                     d| d           |r|dd                    |           z  }| j                                                            |          }|D ]h}|d         |v rK|d         rC|d         r;t
                              d	|d          d
|d          d||d                              |d         ||d         <   i|S )Nz&SELECT location, identifier FROM cachez	local = 1zoperating_system = ''z WHERE z AND rX   rW   zDuplicate entry for identifier z: z and )appendr8   r}   r   r   r   debug)r   r$   rd   output	additionsr   r   r   s           r   rf   z%SqliteCache.get_identifier_dictionary  s7    	<	 	*[))) 	IG4DGGGHHH 	=<7<<	#:#:<<<I.''))11)<< 	8 	8C< F**s</@*S_*|c,6G||3z?||aghklxhyaz||   ),JF3|$%%r   c                 L   |rA| j                                                             d|f                                          }n>| j                                                             d                                          }g }|D ]}|                    |d                    |S )Nz7SELECT identifier FROM cache WHERE operating_system = ?zSELECT identifier FROM cacherX   )r}   r   r   r   r   )r   r$   r   r   r   s        r   rj   zSqliteCache.get_identifiers  s     	%%''M%'   G %%''788 
  	- 	-CMM#l+,,,,r   r   rp   )r!   r"   r#   _required_framework_version_versionr:   r   r~   
Connectionr|   r&   r   r]   r   r`   rq   r   r    r	   r;   rl   ro   rc   r   rf   r   rj   rr   rs   s   @r   ru   ru      s       "+H= = = = = = =!S !W-? ! ! ! !F3;C=	#   0"YsD$%? " " " "0 0 0 0 0 0
s x    	%S#s*+	,   ( #    Y$ Y$ Y$ Y$x JO  (BF	eSj	   * $u+        r   ru   c                   j     e Zd ZdZdZ fdZddZedee	j
        j                 fd            Z xZS )	SymbolCacheMagicz;Runs through all symbol tables and caches their identifiersr   c                      t                      j        |i | t          j                            t
          j        t
          j                  }t          |          | _	        d S r   )
rQ   r   r   r   r8   r   
CACHE_PATHIDENTIFIERS_FILENAMEru   _cache)r   argskwargsidentifiers_pathrV   s       r   r   zSymbolCacheMagic.__init__  sV    $)&)))7<< )"@
 
 ""233r   Nc                 :    | j                             |           dS )z)Runs the automagic over the configurable.N)r  rc   )r   contextconfig_pathconfigurabler   s        r   __call__zSymbolCacheMagic.__call__  s    ,-----r   r   c                 <    t          j        dt          d          gS )zOReturns a list of RequirementInterface objects required by this
        object.SQLiteCacherw   )name	componentrA   )r   VersionRequirementru   )r   s    r   get_requirementsz!SymbolCacheMagic.get_requirements  s*    
 +"k9  
 	
r   r   )r!   r"   r#   __doc__priorityr   r  r%   r   r   configurationRequirementInterfacer  rr   rs   s   @r   r  r    s        EEH4 4 4 4 4. . . . 
j&>&S!T 
 
 
 [
 
 
 
 
r   r  c            	           e Zd ZdefdZdefdZdeee	e         f         de
e         deeeef         ddf         fdZde
eee	e         f                  de
e         deeeef         ddf         fd	ZdS )
r   rW   c                 
   || _         t          j                                        |          5 }t	          j        |          | _        d d d            n# 1 swxY w Y   |                                 st          d          d S )N)r   z5Unsupported version for remote identifier list format)		_locationr   r   r   r   r   _data_verify
ValueError)r   rW   r   s      r   r   zRemoteIdentifierFormat.__init__  s    !'))..8.<< 	'2DJ	' 	' 	' 	' 	' 	' 	' 	' 	' 	' 	' 	' 	' 	' 	'||~~ 	VTUUU	V 	Vs   AAAr   c           	          | j                             dd          }|dv r$t          | dt          | d|                      dS dS )NrA   r   )rx   r   	process_vTF)r  r1   setattrgetattr)r   rA   s     r   r  zRemoteIdentifierFormat._verify  sO    *..A..c>>D)WT3Hw3H3H%I%IJJJ4ur   r   r$   Nc                      t          d          )Nz$Identifier List version not verified)r  )r   r   r$   s      r   r   zRemoteIdentifierFormat.process  s     ?@@@r   c              #     K   || j         v r@| j         |         D ]2}t          j        |          }| j         |         |         D ]}||fV  	3d| j         v ri| j         d         D ][}	 t          |          }|                    ||          E d {V  /# t
          $ r  t                              d|            Y Xw xY w|S )N
additionalzRemote file not found: )r  rD   rE   r   r   IOErrorr   r   )r   r   r$   rX   binary_identifiervaluerW   subrbfs           r   
process_v1z!RemoteIdentifierFormat.process_v1!  s     
 tz))"j)9: 3 3
$*$4Z$@$@!!Z(89*E 3 3E+U2222234:%% J|4 G GG3H==F%~~k;KLLLLLLLLLL G G GLL!E8!E!EFFFFFGs   %+B'B;:B;)r!   r"   r#   r:   r   rq   r  r   r&   r   r   r   r	   r   r)  r   r   r   r   r     s       V V V V V    AtCy 01AEMc]A	5$dD0	1A A A A
d5$s)#345 #3- 
5$dD0	1	     r   r   )0rD   r   r   loggingr   r~   r   urllib.parseurllib.requestabcr   typingr   r   r   r   r   r	   volatility3r
   r   volatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.symbolsr   	getLoggerr!   r   r&   r:   BannersTyper   r(   r=   rI   r  VersionableInterfacerN   ru   	automagicAutomagicInterfacer  r   r   r   r   <module>r9     s       				                 C C C C C C C C C C C C C C C C * * * * * * * * 7 7 7 7 7 7 7 7 < < < < < < 2 2 2 2 2 2 2 2 2 2 2 2		8	$	$5$s)#$
 
 
 
 
 
 
 
&X X X X X+ X X X*
 
 
 
 
' 
 
 

 
 
 
 
) 
 
 
 EF EF EF EF EFJ4I EF EF EFPA A A A A' A A AN

 
 
 
 
z+> 
 
 
6% % % % % % % % % %r   