
    Xf7                         d dl Z d dlZd dlmZmZmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZ d dlmZ  e j        e          Z G d dej        j                  ZdS )	    N)AnyCallableIterableListOptionalTuple)	constants
interfaceslayers)symbol_cache)requirements)scannersc                       e Zd ZU dZdZdZeed<   dZe	e         ed<   dZ
e	e         ed<   dZe	e         ed<   d	ej        j        d
eddf fdZedeej        j                 fd            Zedej        fd            Z	 dd	ej        j        d
edej        j        dej        ddf
dZ	 dd	ej        j        d
edej        j        dedej        ddfdZ xZS )SymbolFinderz)Symbol loader based on signature strings.(   bannerbanner_config_keyNoperating_systemsymbol_class	find_aslrcontextconfig_pathreturnc                 h    t                                          ||           g | _        i | _        d S N)super__init___requirements_banners)selfr   r   	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/symbol_finder.pyr   zSymbolFinder.__init__   s9     	+...  	 35    c                 F    t          j        dt          j        d          gS )NSQLiteCache)   r   r   )name	componentversion)r   VersionRequirementr   SqliteCache)clss    r"   get_requirementszSymbolFinder.get_requirements$   s/     +"&2!  
 	
r#   c                     | j         sht          j                            t          j        t          j                  }t          j        |          }|	                    | j
                  | _         | j         S )zKCreates a cached copy of the results, but only it's been
        requested.)r   )r   ospathjoinr	   
CACHE_PATHIDENTIFIERS_FILENAMEr   r+   get_identifier_dictionaryr   )r    identifiers_pathcaches      r"   bannerszSymbolFinder.banners.   sn     } 	!w||$i&D    !,-=>>E!;;!%!6 <  DM }r#   requirementprogress_callbackc           	      T   | j         dS |                     |||t          j        t          j        fd          | _        | j        D ]\  }}t          j                            |          }t          |t          j                  r|
                    ||          r| j        D ]\  }}t          j                            |          }	t          |t          j                  rG|	|k    rA|j                            |d          r&|                     ||||j        |         |            ndS )zJSearches for SymbolTableRequirements and attempt to populate
        them.NF)shortcut)r   find_requirementsr   TranslationLayerRequirementSymbolTableRequirementr   r
   configurationparent_path
isinstanceunsatisfiedconfigget_banner_scan)
r    r   r   r8   r9   sub_pathr@   tl_sub_pathtl_requirementtl_parent_paths
             r"   __call__zSymbolFinder.__call__<   sb    $4!3383  4 	
 	
 &*%7 	" 	"!Hk$2>>xHHK\@  "))';??" 483E " "/K%/%=%I%I+%V%VN #*L,T " +k99">--k4@@ " -- ' + + '{ ; 1   "E/	" 	"r#   
layer_namec                    | j         sdS t          j        d | j         D                       }|j        |         }|j                            | j        d          r$dt          |j        | j                 d          fg}nOt          |t          j	        j
                  r|j        |j        d                  }|                    |||          }|D ]\  }	}
t                              dt          |
                      | j                             |
d          }|r|}t                              d|            | j        }t           j        j        }||j         |||j        d	          <   ||j         |||j        d
          <   |j        |j         |||j        d          <   |                    ||            dS t                              d|
            t                              d           dS )zAccepts a context, config_path and SymbolTableRequirement, with a
        constructed layer_name and scans the layer for banners.Nc                     g | ]}||S r    ).0xs     r"   
<listcomp>z-SymbolFinder._banner_scan.<locals>.<listcomp>}   s    *T*T*Tam1mmmr#   r   raw_unicode_escapememory_layer)r   scannerr9   zIdentified banner: zUsing symbol library: classisf_urlsymbol_maskz#Symbol library path not found for: zNo existing banners found)r7   r   MultiStringScannerr   rC   rD   r   bytesrA   intelIntelscanvollogdebugreprr   r
   r?   	path_joinr'   address_mask	construct)r    r   r   r8   rK   r9   msslayerbanner_list_r   symbol_filesisf_pathclazzr`   s                  r"   rE   zSymbolFinder._banner_scann   s    | 	4)*T*Tdl*T*T*TUUz* <D2D99 	E%,t'=>@TUUVKK %!344 Eu|N'CD**@Q %  K % 	6 	6IAvLL=tF||==>>><++FD99L M'DlDDEEE)&4>	 yyk6FPPQ  yyk6F	RRS
 & Ik;+;]KK
 %%g{;;;K6KKLLLL LL455555r#   r   ) __name__
__module____qualname____doc__priorityr   str__annotations__r   r   r   r   r   r
   r   ContextInterfacer   classmethodr   r?   RequirementInterfacer-   propertyr   BannersTyper7   r	   ProgressCallbackrJ   !ConstructableRequirementInterfacerE   __classcell__)r!   s   @r"   r   r      s        33H%s%%%&*hsm***"&L(3-&&&$(Ix!(((5!):5IL5	5 5 5 5 5 5 
j&>&S!T 
 
 
 [
 1    X$ 9=0" 0"#40" 0"  -B	0"
 %50" 
0" 0" 0" 0"p 9=<6 <6#4<6 <6  -O	<6
 <6 %5<6 
<6 <6 <6 <6 <6 <6 <6 <6r#   r   )loggingr/   typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   volatility3.framework.automagicr   #volatility3.framework.configurationr   volatility3.framework.layersr   	getLoggerrj   r]   	automagicAutomagicInterfacer   rN   r#   r"   <module>r      s   
  				 A A A A A A A A A A A A A A A A ? ? ? ? ? ? ? ? ? ? 8 8 8 8 8 8 < < < < < < 1 1 1 1 1 1		8	$	$Y6 Y6 Y6 Y6 Y6:': Y6 Y6 Y6 Y6 Y6r#   