
    Xf7                         d dl Z d dlZd dlmZmZmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZ d dlmZ  e j&                  e      Z G d dej,                  j.                        Zy)	    N)AnyCallableIterableListOptionalTuple)	constants
interfaceslayers)symbol_cache)requirements)scannersc                   "    e Zd ZU dZdZdZeed<   dZe	e   ed<   dZ
e	e   ed<   dZe	e   ed<   d	ej                  j                  d
eddf fdZedeej&                  j(                     fd       Zedej0                  fd       Z	 dd	ej                  j                  d
edej&                  j(                  dej6                  ddf
dZ	 dd	ej                  j                  d
edej&                  j:                  dedej6                  ddfdZ xZS )SymbolFinderz)Symbol loader based on signature strings.(   bannerbanner_config_keyNoperating_systemsymbol_class	find_aslrcontextconfig_pathreturnc                 B    t         |   ||       g | _        i | _        y N)super__init___requirements_banners)selfr   r   	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/automagic/symbol_finder.pyr   zSymbolFinder.__init__   s*     	+.  	 35    c                 P    t        j                  dt        j                  d      gS )NSQLiteCache)   r   r   )name	componentversion)r   VersionRequirementr   SqliteCache)clss    r"   get_requirementszSymbolFinder.get_requirements$   s+     ++"&22!
 	
r#   c                    | j                   srt        j                  j                  t        j
                  t        j                        }t        j                  |      }|j                  | j                        | _         | j                   S )zKCreates a cached copy of the results, but only it's been
        requested.)r   )r   ospathjoinr	   
CACHE_PATHIDENTIFIERS_FILENAMEr   r+   get_identifier_dictionaryr   )r    identifiers_pathcaches      r"   bannerszSymbolFinder.banners.   sn     }}!ww||$$i&D&D  !,,-=>E!;;!%!6!6 < DM }}r#   requirementprogress_callbackc           	      z   | j                   y| j                  |||t        j                  t        j                  fd      | _        | j
                  D ]  \  }}t        j                  j                  |      }t        |t        j                        s@|j                  ||      sS| j
                  D ]  \  }}t        j                  j                  |      }	t        |t        j                        s@|	|k(  sF|j                  j                  |d      sc| j                  ||||j                  |   |          y)zJSearches for SymbolTableRequirements and attempt to populate
        them.NF)shortcut)r   find_requirementsr   TranslationLayerRequirementSymbolTableRequirementr   r
   configurationparent_path
isinstanceunsatisfiedconfigget_banner_scan)
r    r   r   r8   r9   sub_pathr@   tl_sub_pathtl_requirementtl_parent_paths
             r"   __call__zSymbolFinder.__call__<   s3    $!338833  4 	
 &*%7%7 	"!Hk$22>>xHK\@@))';?373E3E "/K%/%=%=%I%I+%VN #*L,T,T +k9">>--k4@ -- ' + + '{ ; 1 "#"	"r#   
layer_namec                 Z   | j                   syt        j                  | j                   D cg c]  }||	 c}      }|j                  |   }|j                  j                  | j                  d      r'dt        |j                  | j                     d      fg}	nTt        |t        j                  j                        r|j                  |j                  d      }|j                  |||      }	|	D ]  \  }
}t        j                  dt        |              | j                   j                  |d      }|r|}t        j                  d|        | j                  }t         j"                  j$                  }||j                   |||j&                  d      <   ||j                   |||j&                  d	      <   |j(                  |j                   |||j&                  d
      <   |j+                  ||        yt        j                  d|        ! t        j                  d       yc c}w )zAccepts a context, config_path and SymbolTableRequirement, with a
        constructed layer_name and scans the layer for banners.Nr   raw_unicode_escapememory_layer)r   scannerr9   zIdentified banner: zUsing symbol library: classisf_urlsymbol_maskz#Symbol library path not found for: zNo existing banners found)r7   r   MultiStringScannerr   rC   rD   r   bytesrA   intelIntelscanvollogdebugreprr   r
   r?   	path_joinr'   address_mask	construct)r    r   r   r8   rK   r9   xmsslayerbanner_list_r   symbol_filesisf_pathclazzr[   s                   r"   rE   zSymbolFinder._banner_scann   s    ||))dll*Tam1*TUz* <<D22D9E%,,t'='=>@TUVK %!3!34u||N'CD**@Q % K % 	6IAvLL.tF|n=><<++FD9L'5l^DE))&44>>	 yk6F6FPQ  yk6F6F	RS
 && k;+;+;]K
 %%g{;B6(KL/	64 LL45[ +Us
   H(H(r   ) __name__
__module____qualname____doc__priorityr   str__annotations__r   r   r   r   r   r
   r   ContextInterfacer   classmethodr   r?   RequirementInterfacer-   propertyr   BannersTyper7   r	   ProgressCallbackrJ   !ConstructableRequirementInterfacerE   __classcell__)r!   s   @r"   r   r      ss   3H%s%&*hsm*"&L(3-&$(Ix!(5!))::5IL5	5 
j&>&>&S&S!T 
 
 11  $ 9=0"##440" 0"  --BB	0"
 %550" 
0"p 9=<6##44<6 <6  --OO	<6
 <6 %55<6 
<6r#   r   )loggingr/   typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   volatility3.framework.automagicr   #volatility3.framework.configurationr   volatility3.framework.layersr   	getLoggerrf   rX   	automagicAutomagicInterfacer    r#   r"   <module>r      sN   
  	 A A ? ? 8 < 1			8	$Y6:'':: Y6r#   