X fGxdZddlZddlZddlZddlmZmZmZmZm Z m Z m Z ddl m Z mZmZmZddlmZejeZGddejjZded efd ZGd d ejjZGd deZGddejjZGddeej j!Z"dS)aA `Context` maintains the accumulated state required for various plugins and framework functions. This has been made an object to allow quick swapping and changing of contexts, to allow a plugin to act on multiple different contexts without them interfering with each other. N)CallableIterableListOptionalSetTupleUnion) constants interfacessymbols exceptions) templatesc eZdZdZdfd ZedejjfdZ e j dejjddfdZ edej j fdZ edejjfd Zedejjfd Zd ejjddfd Z dd eeejjfdededeedejjf dZ ddedededeedeedej jf dZxZS)ContextaMaintains the context within which to construct objects. The context object is the main method of carrying around state that's been constructed for the purposes of investigating memory. It contains a symbol_space of all the symbols that can be accessed by plugins using the context. It also contains the memory made up of data and translation layers, and it contains a factory method for creating new objects. Other context objects can be constructed as long as they support the :class:`~volatility3.framework.interfaces.context.ContextInterface`. This is the primary context object to be used in the volatility framework. It maintains the returnNc*ttj|_t |_tj |_ tj |_ dS)zInitializes the context.N)super__init__r SymbolSpace _symbol_spaceModuleCollection _module_spacer layersLayerContainer_memory configurationHierarchicalDict_config)self __class__s Y/home/panchajanya/Development/work/volatility3/volatility3/framework/contexts/__init__.pyrzContext.__init__#sh $022-//!(7799 !/@@BB c|jS)znReturns a mutable copy of the configuration, but does not allow the whole configuration to be altered.)rrs r!configzContext.config- |r"valuecpt|tjjst d||_dS)Nz'Config must be of type HierarchicalDict) isinstancer rr TypeErrorr)rr's r!r%zContext.config3s5%!9!JKK GEFF F r"c|jS)z.A container for modules loaded in this context)rr$s r!moduleszContext.modules9s !!r"c|jS)zJThe space of all symbols that can be accessed within this context.)rr$s r! symbol_spacezContext.symbol_space>s !!r"c|jS)z{A LayerContainer object, allowing access to all data and translation layers currently available within the context.)rr$s r!rzContext.layersDr&r"layerc:|j|dS)aAdds a named translation layer to the context. Args: layer: The layer to be added to the memory Raises: volatility3.framework.exceptions.LayerException: if the layer is already present, or has unmet dependencies N)r add_layerrr0s r!r2zContext.add_layerLs  u%%%%%r" object_type layer_nameoffsetnative_layer_namec 2t|tjjsK |j|}n#t j$r|j|}Yn^wxYwt|tj r$|j|j j }|}| |j |}|jdi|||tj||||jS)aObject factory, takes a context, symbol, offset and optional layername. Looks up the layername in the context, finds the object template based on the symbol, and constructs an object using the object template on the layer at the offset. Args: object_type: The name (or template) of the symbol type on which to construct the object. If this is a name, it should contain an explicit table name. layer_name: The name of the layer on which to construct the object offset: The offset within the layer at which the data used to create the object lives native_layer_name: The name of the layer the object references (for pointers) if different to layer_name Returns: A fully constructed object )r5r6r7size)context object_info)r)r objectsTemplaterget_typer SymbolErrorget_enumerationrReferenceTemplatevol type_nameupdateclone update_volObjectInformationr9)rr4r5r6r7 argumentsobject_templates r!objectzContext.objectZs5.+z'9'BCC 2 R"&"4"="=k"J"J) R R R"&"4"D"D["Q"Q R+y'BCC U"099+/:STT )O   _0 1 1 1)//11""//Y///"*<<%"3$) =    s<)A('A( module_namer9c|r t||||||St|||||S)aConstructs a new os-independent module. Args: module_name: The name of the module layer_name: The layer within the context in which the module exists offset: The offset at which the module exists in the layer native_layer_name: The default native layer for objects constructed by the module size: The size, in bytes, that the module occupies from offset location within the layer named layer_name )rLr5r6r9r7)rLr5r6r7) SizedModulecreateModule)rrLr5r6r7r9s r!modulezContext.modulesg"  %%'%"3 & }} #!/    r")rNN)NN) __name__ __module__ __qualname____doc__rpropertyr rrr%setterr:ModuleContainerr,r SymbolSpaceInterfacer.rrDataLayerInterfacer2r strr=r>intrObjectInterfacerKModuleInterfacerQ __classcell__r s@r!rrs1  CCCCCC 0AX  ]J4E$] "+;"""X""j0E"""X"  )8X &z0C & & & & &&,0 - - 3 2 ;;<- -  - $C= -    +- - - - h,0"         $C=  sm     +         r"rmethodrc dtdtffd }dD]P}ttjj}t ||rt||t||Q|S)z;Returns a symbol using the symbol_table_name of the Module.namerc tj|vr|jtjz|z}n:||jtjzrnt dt |jj|S)Nz-Cannot reference another module when calling )r BANGsymbol_table_name startswith ValueErrorgetattr_contextr.)rrdrbs r!wrapperz#get_module_wrapper..wrappers~ > % %)IN:TADD __T3inD E E W UVUUVV V:wt}16::4@@@r")__annotations__rVrTrSrU)r\rrjr r:r_hasattrsetattr)rbrlentryproxy_interfaces` r!get_module_wrapperrrsACAHAAAAAA E E"*"4"DfMM ?E * * E GUGOU$C$C D D D Nr"c eZdZedejjdedededdf dZ dd eded e ed e dd f d Z dded e ed e d e e ed fdd f dZddededeefdZedZedZedZedZedZedZedZdS)rPr:rLr5r6rc tjj}|j|}|dd}| |dd|}||j||d<||j||d<d|vr||d<|D]*} || d|j||| <+||||} || | j|j|<| S)N config_path temporaryr,r5r6rg) r r path_joinr,free_module_namegetr% add_modulerd) clsr:rLr5r6kwargspathjoinrxruarg return_vals r!rOz Module.creates+5"?;;KHHjj55  "(; ;KLLK>Hxx \::;:@xx X667 f , ,*5F& ' O OC9?C9N9NGN88K55 6 6S+/?@@ :&&&&0o{#r"NFr4r7absolutez"interfaces.objects.ObjectInterfacec tj|vr|jtjz|z}ntd|t d|s ||jz }d|vr|d=|jjd||j||p|j d|S)aReturns an object created using the symbol_table_name and layer_name of the Module. Args: object_type: Name of the type/enumeration (within the module) to construct offset: The location of the object, ignored when symbol_type is SYMBOL native_layer_name: Name of the layer in which constructed objects are made (for pointers) absolute: whether the type's offset is absolute within memory or relative to the module ;Cannot reference another module when constructing an objectNz.Offset must not be None for non-symbol objectsr5r4r5r6r7r<) r rfrgrir*_offsetrkrK _layer_name_native_layer_name)rr4r6r7rr|s r!rKz Module.objects" > , ,09>AKOKKM  >LMM M # dl "F 6 ! !|$#t}# #'/J43J       r" symbol_namec ttj|vr|jtjz|z}ntd|jj|}|j}|s ||jz }|&|j td|j d|j }d|vr|d=|jj d||j ||p|jd|S)aReturns an object based on a specific symbol (containing type and offset information) and the layer_name of the Module. This will throw a ValueError if the symbol does not contain an associated type, or if the symbol name is invalid. It will throw a SymbolError if the symbol cannot be found. Args: symbol_name: Name of the symbol (within the module) to construct native_layer_name: Name of the layer in which constructed objects are made (for pointers) absolute: whether the symbol's address is absolute or relative to the module object_type: Override for the type from the symobl to use (or if the symbol type is missing) rNzSymbol z4 has no associated type and no object_type specifiedr5rr<)r rfrgrirkr. get_symboladdressrtyper*rdrKrr)rrr7rr4r| symbol_valr6s r!object_from_symbolzModule.object_from_symbols( > , ,09>AKOKKM  ]/::;GG # # dl "F  &cjoccc)o  6 ! !|$$t}# #'/J43J       r"rr9c|dkrtdt|jj||jz ||jS)cReturns the symbols within this module that live at the specified absolute offset provided.r"Size must be strictly non-negative)r6r9 table_name)rilistrkr.get_symbols_by_locationrrg)rr6r9s r! get_symbols_by_absolute_locationz'Module.get_symbols_by_absolute_locationEs^ !88ABB B M & > > ,1 ?     r"c:|jj|jjSrR)r:r.rgr r$s r!r zModule.symbolsRs|()?@HHr"rr?rA has_symbolhas_typehas_enumeration)NNF)NFNr)rSrTrU classmethodr r:ContextInterfacer\r]rOrboolrKr rrrrWr rrrr?rArrrr<r"r!rPrPs#4    [@+/ ' ' ' ' $C= '  '  .' ' ' ' X,0RV 5 5 5 $C=5  5 eC)M$MNO 5  .5 5 5 5 n   s  #  dSVi     IIXI$#L11J!!*--H(():;;O##L11J!!*--H(():;;OOOr"rPceZdZedefdZeejdefdZ ddedede effd Z xZ S) rNrc@|jdd}|pdS)z3Returns the size of the module (0 for unknown size)r9r)r%ry)rr9s r!r9zSizedModule.size_s#{vq))yqr"c h|jj|j}t|tjjst dtjttt| |j |jddS)zHashes the module for equality checks. The mapping should be sorted and should be quicker than reading the data We turn it into JSON to make a common string and use a quick hash, because collisions are unlikely z7Hashing modules on non-TranslationLayers is not allowedT) ignore_errorszutf-8)rkrr5r)r TranslationLayerInterfacer*hashlibmd5bytesr\rmappingr6r9 hexdigestr3s r!hashzSizedModule.hashes $T_5%!2!LMM WUVV V{ Dt{DITRRSSTT    )++  r"rr6r9cr||j|jzkrgSt||S)r)rr9rr)rr6r9r s r!rz,SizedModule.get_symbols_by_absolute_locationxs8 DL49, , ,Iww77EEEr"r) rSrTrUrWr]r9 functools lru_cacher\rrrr`ras@r!rNrN^s cX YcX"FFsF#FdSViFFFFFFFFFFr"rNc eZdZdZ ddeeejjddffd Z ddZ dde de fd Z e dd Z dd ed edeee ee ffdZxZS)rzRClass to contain a collection of SizedModules and reason about their contents.Nr,rcXi|_t|dSrR) _prefix_countrr)rr,r s r!rzModuleCollection.__init__s+  !!!!!r"cg}t}|jD]E}|j|vs |jdkr/||||jFt |S)zReturns a new deduplicated ModuleCollection featuring no repeated modules (based on data hash) All 0 sized modules will have identical hashes and are therefore included in the deduplicated version r)set_modulesrr9appendaddr)r new_modulesseenmods r! deduplicatezModuleCollection.deduplicatesq = # #Cxt##sx1}}""3'''""" ,,,r"rQprefixc||jvr d|j|<|S|j|}|t|z|vr|dz }|t|z|v||j|<|t|zS)zReturns an unused module name)rr\)rrcounts r!rxz!ModuleCollection.free_module_names + + +)*D v &M"6*s5zz!T)) QJEs5zz!T))%*6"E ""r"c:td|S)zPA name indexed dictionary of modules using that name in this collection.z_This method has been deprecated in favour of the ModuleCollection acting as a dictionary itself)vollogwarningr$s r!r,zModuleCollection.moduless$  m    r"rr6r9c# K|dkrtd|jD]d}|j|}t|tr@||j|jzkr-||z|jkr|j|||fVedS)zReturns a tuple of (module_name, list_of_symbol_names) for each module, where symbols live at the absolute offset in memory provided.rrN)rirr)rNr6r9rdr)rr6r9rLrQs r!'get_module_symbols_by_absolute_locationz8ModuleCollection.get_module_symbols_by_absolute_locations !88ABB B=  K];/F&+.. fmfk999TMV]22 ??MM  r"rR)rr)rQr)rSrTrUrVrrr r:r_rrr\rxrWr,r]rrrr`ras@r!rrsMQ""Z%7%G HI" """""" - - - - # #s ## # # # #X()!$ %T#Y' (r"rc:eZdZdejjdededdfdZdS)ConfigurableModuler:rurdrNc ,tjj||||jd}|jd}|jd}tjj|||t |||||||dS)Nr5r6rg)r rConfigurableInterfacerr%rP)rr:rurdr5r6rgs r!rzConfigurableModule.__init__s  6?? ';   [. X& K(;< 6?? ';     '4V5F      r")rSrTrUr r:rr\rr<r"r!rrsN !): IL TW       r"r)#rVrrloggingtypingrrrrrrr volatility3.frameworkr r r r volatility3.framework.objectsr getLoggerrSrr:rrr\rrr_rPrNrYrrrrr<r"r!rsHHHHHHHHHHHHHHHHHHLLLLLLLLLLLL333333  8 $ $S S S S S j 1S S S lsx4U<U<U<U<U>>>>z)9>>>B     !9!O     r"