X f}TdZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z mZmZmZmZmZmZmZmZmZmZddlmZmZddlmZmZdZ eje Z!e"e#e$e%fZ&ee"e#e$e%fZ'eee'ee'fZ(de%fd Z)d e%de%fd Z*d e%de%fd Z+d"de%de"de%fdZ,Gddej j-Z.Gdde Z/Gdde/Z0Gdde/Z1Gdde/Z2Gdde/Z3Gdde Z4Gd d!Z5dS)#aThe configuration module contains classes and functions for interacting with the configuration and requirement trees. Volatility plugins can specify a list of requirements (which may have subrequirements, thus forming a requirement tree). These requirement trees can contain values, which are contained in a complementary configuration tree. These two trees act as a protocol between the plugins and users. The plugins provide requirements that must be fulfilled, and the users provide configurations values that fulfill those requirements. Where the user does not provide sufficient configuration values, automagic modules may extend the configuration tree themselves. N)ABCMetaabstractmethod) AnyClassVarDict GeneratorIteratorListOptionalTypeUnionTupleSet) classproperty framework) constants interfaces.returnchtd|D}t|S)z#Joins configuration paths together.cg|]}||Sr).0args `/home/panchajanya/Development/work/volatility3/volatility3/framework/interfaces/configuration.py zpath_join..8s---#-#---)tupleCONFIG_SEPARATORjoin)argss r path_joinr"5s4 ----- . .D   & &&rvaluecvt|tddS)z@Returns the parent configuration path from a configuration path.N)rr splitr#s r parent_pathr(<s,  -=!>!>ss!C D DDrcB|tdS)z(Return the top of the configuration pathr%)r&rr's r path_headr*As ;;' ( ( ,,rpathdepthc`t|td|S)zReturns the `path` up to a certain depth. Note that `depth` can be negative (such as `-x`) and will return all elements except for the last `x` components N)r"r&r)r,r-s r path_depthr/Fs( TZZ 011&5&9 : ::rc eZdZdZdefdeedfdeddfdZdZe defd Z e defd Z d edefd Z d edefd Z deefdZdeeddffdZd edefdZd ededdfdZd!d edededdfdZdedefdZd eddfdZd edefdZdefdZd eddfdZd eddddfdZ d"d edddeddfdZd#dZ defd Z!dS)$HierarchicalDictz|The core of configuration data, it is a mapping class that stores keys within itself, and also stores lower hierarchies.N initial_dictSimpleTypeRequirement separatorrct|trt|dkstd|||_i|_i|_t|trtj|}t|tr!| D] \}}|||< dS|td|dS)z Args: initial_dict: A dictionary to populate the HierarchicalDict with initially separator: A custom hierarchy separator (defaults to CONFIG_SEPARATOR) r+z*Separator must be a one character string: NzJInitial_dict must be a dictionary or JSON string containing a dictionary: ) isinstancestrlen TypeError _separator_data_subdictjsonloadsdictitems)selfr2r4kvs r__init__zHierarchicalDict.__init__Ss9c** Vs9~~/B/BTTTUU U#24 79 lC ( ( 4:l33L lD ) ) $**,,  1Q    %k]ikk & %rcBt|t|kS)z)Define equality between HierarchicalDicts)r?)rAothers r__eq__zHierarchicalDict.__eq__lsDzzT%[[((rc|jS)z?Specifies the hierarchy separator in use in this HierarchyDict.)r:rAs rr4zHierarchicalDict.separatorps rc4|jS)zQReturns just the data-containing mappings on this level of the Hierarchy.)r;copyrIs rdatazHierarchicalDict.datausz   rkeyc\|j|vr"|d||jS|S)zyReturns the first division of a key based on the dict separator, or the full key if the separator is not present.Nr4indexrArMs r _key_headzHierarchicalDict._key_head{s5 >S 24>2223 3Jrcb|j|vr%|||jdzdSdS)z|Returns all but the first division of a key based on the dict separator, or None if the separator is not in the key.r+NrOrQs r _key_tailzHierarchicalDict._key_tails: >S syy0014667 7rrc*|S)z?Returns an iterator object that supports the iterator protocol.) generatorrIs r__iter__zHierarchicalDict.__iter__s~~rc#xK|jD]}|V|jD]!}|j|D]}||jz|zV"dS)zA generator for the data in this level and lower levels of this mapping. Returns: Returns each item in the top level data, and then all subkeys in a depth first order N)r;r<r4)rArM subdict_keys rrWzHierarchicalDict.generatorsu:  CIIII= 9 9K}[1 9 9!DN2S88888 9 9 9rc |j|vr;|j||}|||S|j|S#t $rt |wxYw)zJGets an item, traversing down the trees to get to the final value.r4r<rRrUr;KeyErrorrArMsubdicts r __getitem__zHierarchicalDict.__getitem__sv ~$$-s(;(;<t~~c2233z#&   3--  sAA AA-r#c2|||dS)z@Sets an item or creates a subdict and sets the item within that.N)_setitemrArMr#s r __setitem__zHierarchicalDict.__setitem__s c5!!!!!rTis_datac |j|vr|j||t |j}|||||||j||<dS|r|||j|<dSt|ts/td t|||j|<dS)z9Set an item or appends a whole subtree at a key location.r4zMHierarchicalDicts can only store HierarchicalDicts within their structure: {}N) r4r<getrRr1rbrU_sanitize_valuer;r6r9formattype)rArMr#rer_s rrbzHierarchicalDict._setitems >S m''s##%5%O%O%OG   T^^C00% A A A18DM$..-- . . . +"&"6"6u"="= 3!%)9::#gnn KK &+ c"""rcDt|trt|St|trt|St|trt|St|trt |St|t rYg}|D]R}||}t|t rtd|||S|S|dStdt|)zgMethod to ensure all values are standard values and not volatility objects containing contexts.z2Configuration list types cannot contain list typesNz&Invalid type stored in configuration: ) r6boolintr7byteslistrir9appendrk)rAr#new_listelement element_values rriz HierarchicalDict._sanitize_values( eT " " T;;  s # # Tu::  s # # Tu::  u % % T<<  t $ $ TH  3 3 $ 4 4W = = mT22#L!,OOM222O ]4RT%[[RRSS Src |j|vr8|j||}|||=dS|j||=dS#t $rt |wxYw)z+Deletes an item from the hierarchical dict.Nr\r^s r __delitem__zHierarchicalDict.__delitem__s ~$$-s(;(;<DNN3//000Jt~~c22333   3--  s?A A A:c|j|vrI |j||}|||vS#t$rYdSwxYw||jvS)z7Determines whether the key is present in the hierarchy.F)r4r<rRrUr]r;r^s r __contains__zHierarchicalDict.__contains__st >S  -s(;(;<~~c**g55   uu $*$ $s6A AAcht|jtd|jDzS)z Returns the length of all items.c,g|]}t|Sr)r8)rr_s rrz,HierarchicalDict.__len__..s%P%P%Pwc'll%P%P%Pr)r8r;sumr<rIs r__len__zHierarchicalDict.__len__s.4:%P%P$-%P%P%P!Q!QQQrcN |j|vrF|j||||S|j|S#t $r.||t|jdYnwxYwtS)aReturns the HierarchicalDict housed under the key. This differs from the data property, in that it is directed by the `key`, and all layers under that key are returned, not just those in that level. Higher layers are not prefixed with the location of earlier layers, so branching a hierarchy containing `a.b.c.d` on `a.b` would return a hierarchy containing `c.d`, not `a.b.c.d`. Args: key: The location within the hierarchy to return higher layers. Returns: The HierarchicalDict underneath the specified key (not just the data at that key location in the tree) rgF)rMr#re)r4r<rRbranchrUr]rbr1rQs rr~zHierarchicalDict.branchs ~$$}T^^C%8%89@@PSATATUUU}S))    MM/$.IIISX        !!!sAA A5BBct|trt|tstd|||ddS)zSplices an existing HierarchicalDictionary under a specific key. This can be thought of as an inverse of :func:`branch`, although `branch` does not remove the requested hierarchy, it simply returns it. 7Splice requires a string key and HierarchicalDict valueFN)r6r7r1r9rbrcs rsplicezHierarchicalDict.splicesU#s## W:e=M+N+N WUVV V c5%(((((rF overwritec<t|trt|tstdt |D]R}|||jz|zd|r|||||jz|z<<|||||jz|z<SdS)aActs similarly to splice, but maintains previous values. If overwrite is true, then entries in the new value are used over those that exist within key already Args: key: The location within the hierarchy at which to merge the `value` value: HierarchicalDict to be merged under the key node overwrite: A boolean defining whether the value will be overwritten if it already exists rN)r6r7r1r9r?rhr:)rArMr#ritems rmergezHierarchicalDict.merges#s## W:e=M+N+N WUVV VKK A ADxxdo-4d;;GE9>tDt.565:4[S4?*T122  A Arc*tj|S)zDuplicates the configuration, allowing changes without affecting the original. Returns: A duplicate HierarchicalDict of this object )rKdeepcopyrIs rclonezHierarchicalDict.clone.s}T"""rc tjtfdtDdS)z9Turns the Hierarchical dict into a string representation.c$g|] }||f Srr)rrMrAs rrz,HierarchicalDict.__str__..:s"GGGs3S "GGGr)indent)r=dumpsr?sortedrWrIs`r__str__zHierarchicalDict.__str__7sQz GGGGfT^^5E5E.F.FGGG H HQR    r)T)F)rr1)"__name__ __module__ __qualname____doc__rrr7rDrGpropertyr4rLrRrUr rrXrrWConfigSimpleTyper`rdrmrbrirvrxrnr|r~rrrrrrrr1r1Os 99 <@)3 778  2)))3X!d!!!X! SSSS (3-     99S$_5 9 9 9 9  s  '7     "s"3"4""""++C++d+d++++(TST-=TTTT6  s  t      % % % % % %RRRRR"#""4""""4 )# )&8 )T ) ) ) )FKAAA1A>BA AAAA*####       rr1c eZdZdZ ddededededdf fd Zdefd Zd Z e defd Z e defd Z e defdZ e defdZejddZ ddddededefdZe deedffdZddZddZdddedeedffdZedddedeedffdZxZS)RequirementInterfaceaClass that defines a requirement. A requirement is a means for plugins and other framework components to request specific configuration data. Requirements can either be simple types (such as :class:`~volatility3.framework.configuration.requirements.SimpleTypeRequirement`, :class:`~volatility3.framework.configuration.requirements.IntRequirement`, :class:`~volatility3.framework.configuration.requirements.BytesRequirement` and :class:`~volatility3.framework.configuration.requirements.StringRequirement`) or complex types (such as :class:`TranslationLayerRequirement`, :class:`SymbolTableRequirement` and :class:`ClassRequirement` NFname descriptiondefaultoptionalrctt|vrtdtd||_|pd|_||_||_i|_dS)a( Args: name: The name of the requirement description: A short textual description of the requirement default: The default value for the requirement if no value is provided optional: Whether the requirement must be satisfied or not z2Name cannot contain the config-hierarchy divider ()rTN) superrDr ValueError_name _description_default _optional _requirements)rArrrr __class__s rrDzRequirementInterface.__init__Jsy  t # #XEUXXX  '-2 !>@rc<d|jjzdz|jzdzS)N)rrrrIs r__repr__zRequirementInterface.__repr__ds#T^,,t3di?#EErct||jsdS|jD]/}|j|d|j|krdS0dS)NFT)r6r__dict__rh)rArFrs rrGzRequirementInterface.__eq__gsb%00 5M  D~!!$--t1DDDuuEtrc|jS)zThe name of the Requirement. Names cannot contain CONFIG_SEPARATOR ('.' by default) since this is used within the configuration hierarchy. )rrIs rrzRequirementInterface.nameos zrc|jS)zUA short description of what the Requirement is designed to affect or achieve.)rrIs rrz RequirementInterface.descriptionxs   rc|jS)z(Returns the default value if one is set.)rrIs rrzRequirementInterface.default~s }rc|jS)z+Whether the Requirement is optional or not.)rrIs rrzRequirementInterface.optionals ~rc.t||_dS)z*Sets the optional value for a requirement.N)rmrrAr#s rrzRequirementInterface.optionalsercontext#interfaces.context.ContextInterface config_pathc8|j||S)aqReturns the value for this Requirement from its config path. Args: context: the configuration store to find the value for this requirement config_path: the configuration path of the instance of the requirement to be recovered default: a default value to provide if the requirement's configuration value is not found )configrh)rArrrs r config_valuez!RequirementInterface.config_values~!!+w777rc4|jS)zLReturns a dictionary of all the child requirements, indexed by name.)rrKrIs r requirementsz!RequirementInterface.requirementss!&&(((r requirementc$||j|j<dS)zAdds a child to the list of requirements. Args: requirement: The requirement to add as a child-requirement NrrrArs radd_requirementz$RequirementInterface.add_requirements 0;;+,,,rc |j|j=dS)zRemoves a child from the list of requirements. Args: requirement: The requirement to remove as a child-requirement Nrrs rremove_requirementz'RequirementInterface.remove_requirements  {/ 0 0 0rci}|jD]G}|js>||t ||j}||H|S)acMethod that will validate all child requirements. Args: context: the context containing the configuration data for this requirement config_path: the configuration path of this instance of the requirement Returns: A dictionary of full configuration paths for each unsatisfied child-requirement )rvaluesr unsatisfiedr"rupdate)rArrresultr subresults runsatisfied_childrenz)RequirementInterface.unsatisfied_childrensr,3355 ) )K' )'33Y{DJ??  i((( rcdS)a Method to validate the value stored at config_path for the configuration object against a context. Returns a list containing its own name (or multiple unsatisfied requirement names) when invalid Args: context: The context object containing the configuration for this requirement config_path: The configuration path for this requirement to test satisfaction Returns: A dictionary of configuration-paths to requirements that could not be satisfied NrrArrs rrz RequirementInterface.unsatisfiedr)NNFrNN)rrrN)rrrrr7rrmrDrrGrrrrrsetterrrrrrrrr __classcell__rs@rrr>s   $( AAAA" A  A  AAAAAA4F#FFFFcX!S!!!X! )X$X_%%%_%%) 8 86 8 8" 8  8 8 8 8 )d3(>#>?)))X) ;;;;1111<KN c)) *, < KN c)) *   ^     rr) metaclasscjeZdZUdZeZeeed<de fdZ de fdZ ddde d e e e ffd Zd S) r3zjClass to represent a single simple type (such as a boolean, a string, an integer or a series of bytes) instance_typerc tdzPAlways raises a TypeError as instance requirements cannot have children.z1Instance Requirements cannot have subrequirementsr9rs rrz%SimpleTypeRequirement.add_requirementKLLLrc tdrrrs rrz(SimpleTypeRequirement.remove_requirementrrrrrrc <t||j}|||d}t||jsZt tjd |j|jj t|||iSiS)zJValidates the instance requirement based upon its `instance_type`.Nz3TypeError - {} requirements only accept {} type: {}) r"rrr6rvolloglogr LOGLEVEL_VrjrreprrArrr#s rrz!SimpleTypeRequirement.unsatisfieds  TY77 !!';==%!344 ' JJ$ELLIt1:DKK     & & rN)rrrrrmrrr __annotations__rrrr7rrrrrr3r3s%%%)M8D>(((M+?MMMM M.BMMMM <KN c'' (rr3czeZdZdZd fd ZfdZedeefdZ ddd e de e e ffd Z xZS) ClassRequirementzRequires a specific class. This is used as means to serialize specific classes for :class:`TranslationLayerRequirement` and :class:`SymbolTableRequirement` classes. rNcHtj|i|d|_dSr)rrD_clsrAr!kwargsrs rrDzClassRequirement.__init__s*$)&))) rcFt|SrrrGrArFrs rrGzClassRequirement.__eq__ ww~~e$$$rc|jS)zWContains the actual chosen class based on the configuration value's class name.)rrIs rclszClassRequirement.clss yrrrrc t||j}|||d}d|_|t |t rd|vrt j|d| dd}|| ddzd}t||rt|||_n)|tvrt||_|j||iSiS)z*Checks to see if a class can be recovered.Nrr+) r"rrrr6r7sysmodulesrhrindexhasattrgetattrglobals)rArrr#module class_names rrzClassRequirement.unsatisfieds TY77 !!';==  E3!7!7 e||/Bc1B1B/B)CTJJ"5<<#4#4q#8#:#:; 6:..< ' ; ;DIGII%% ' % 0DI 9 & & rr)rrrrrDrGrr r rr7rrrrrs@rrrs%%%%% Xd^X <KN c'' (rrc eZdZdZdfd ZfdZedddeddfd Zdddeddfd Z dddded e ee fde d fd Z xZS)!ConstructableRequirementInterfaceaDefines a Requirement that can be constructed based on their own requirements. This effectively offers a means for serializing specific python types, to be reconstructed based on simple configuration data. Each constructable records a `class` requirement, which indicates the object that will be constructed. That class may have its own requirements (which is why validation of a ConstructableRequirement must happen after the class configuration value has been provided). These values are then provided to the object's constructor by name as arguments (as well as the standard `context` and `config_path` arguments). rNctj|i||tddt |_dS)Nclassz&Class of the constructable requirement)rrDrrset_current_class_requirementsrs rrDz*ConstructableRequirementInterface.__init__;sY$)&)))  W&N O O   69UU(((rcFt|Srrrs rrGz(ConstructableRequirementInterface.__eq__BrrrrrcdS)a6Method for constructing within the context any required elements from subrequirements. Args: context: The context object containing the configuration data for the constructable config_path: The configuration path for the specific instance of this constructable Nrrs r constructz+ConstructableRequirementInterface.constructGrrc|jd}t||j}|||st |t rt |jtr|j D]$}|j |=|j |%|j D]<}|j |j||7dSdSdSdS)a|Method to check if the class Requirement is valid and if so populate the other requirements (but no need to validate, since we're invalid already) Args: context: The context object containing the configuration data for the constructable config_path: The configuration path for the specific instance of this constructable rN)rr"rrr6r issubclassrConfigurableInterfacerrKrremoveget_requirementsaddr)rArr class_reqsubreq_config_pathold_reqrs r_validate_classz1ConstructableRequirementInterface._validate_classSs'%g. &{DI>>$$W.@AA 6j 'G G 6)-)>?? 6#?DDFFEEG*734;;GDDDD#,=#A#A#C#C66K4889IJJJ((5555 6 6 6 6 6 6 66rrequirement_dictz"interfaces.objects.ObjectInterfacec|jd||rdSt|jdtsdS|jdj}|dS|i}|di|}|j|j|<|S)z\Constructs the class, handing args and the subrequirements as parameters to __init__rNr)rrr6rrrr)rArrrrobjs r_construct_classz2ConstructableRequirementInterface._construct_classns  W % 1 1'; G G 4$+G46FGG 4(, ;4  #! c%%$%%&)h{# rrr)rrrrrDrGrr7rrrobjectr r rrs@rrr,s  ;;;;;;%%%%%   <  KN      ^  6<6KN6 6666>/3  6  sF{+  6 7        rrc*eZdZdZdddededefdZdS) ConfigurableRequirementInterfacez7Simple Abstract class to provide build_required_config.rrrr#rcdS)z0Proxies to a ConfigurableInterface if necessary.Nrrs rbuild_configurationz4ConfigurableRequirementInterface.build_configurationrrN)rrrrr7rr1rrrrr r sTAA?6?? ?  ??????rr c 6eZdZdZdddeddffd ZeddZedefd Zej d eddfd Zede fd Z de fd Z e deefdZe dddedeeeffdZe dddedefdZxZS)rziClass to allow objects to have requirements and read configuration data from the context config tree.rrrrNcrt||_||_d|_dS)zXBasic initializer that allows configurables to access their own config settings.N)rrD_context _config_path _config_cache)rArrrs rrDzConfigurableInterface.__init__s8  '9=rc|jS)zXThe context object that this configurable belongs to/configuration is stored in.)rrIs rrzConfigurableInterface.contexts }rc|jS)8The configuration path on which this configurable lives.)rrIs rrz!ConfigurableInterface.config_paths   rr#c"||_d|_dS)rN)rrrs rrz!ConfigurableInterface.config_paths"!rct|dr|j)|jj|j|_|jS)zOThe Hierarchical configuration Dictionary for this Configurable object.r)rrrrr~rrIs rrzConfigurableInterface.configsFt_-- P1C1K!%!5!NPUVV rcgS)zOReturns a list of RequirementInterface objects required by this object.rrs rrz&ConfigurableInterface.get_requirementss  rci}|D]4}|js+|||}||5|S)arReturns a list of the names of all unsatisfied requirements. Since a satisfied set of requirements will return [], it can be used in tests as follows: .. code-block:: python unmet = configurable.unsatisfied(context, config_path) if unmet: raise RuntimeError("Unsatisfied requirements: {}".format(unmet) )rrrr)rrrrrrs rrz!ConfigurableInterface.unsatisfieds\//11 ) )K' )'33G[II  i((( rbase_config_pathc \ddtdD}t||}|D]Z\}}t |t t tttfstd||j t||<[|S)aConvenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs. Args: context: The context in which to store the new configuration base_config_path: The base configuration path on which to build the new configuration kwargs: Keyword arguments that are used to populate the new configuration path Returns: str: The newly generated full configuration path rTc3K|]A}tjtjtjzVBdSr)random SystemRandomchoicestringascii_uppercasedigits)r_s r z7ConfigurableInterface.make_subconfig.. sW% %    ! ! ( ()?&-)O P P% % % % % % rz?Config values passed to make_subconfig can only be simple types) r ranger"r@r6rnr7rmfloatror9r)rrrrrandom_config_dictnew_config_pathrBrCs rmake_subconfigz$ConfigurableInterface.make_subconfigs$ WW% % 1XX% % %   $$46HII LLNN > >DAqa#sD%!?@@ U=>GN9_a88 9 9r)rr)rrrrr7rDrrrrr1rr classmethodr rrrrr/rrs@rrrs%%><>KN> >>>>>>X !S!!!X!"""""" "("""X"%52&:!;[ ;JM c'' ([("6"" """["""""rrceZdZUdZdZeeeefed<dZeeeefed<fdZ e deeeeffdZ xZ S)VersionableInterfaceaA class that allows version checking so that plugins can request specific versions of components they made need This currently includes other Plugins and scanners, but may be extended in the future All version number should use semantic versioning )rrr_version_required_framework_versionc`tj|jtj|i|dSr)rrequire_interface_versionr4rrDrs rrDzVersionableInterface.__init__)s6+T-MNN$)&)))))rrc|jS)aThe version of the current interface (classmethods available on the component). It is strongly recommended that Semantic Versioning be used (and the default version verification is defined that way): MAJOR version when you make incompatible API changes. MINOR version when you add functionality in a backwards compatible manner. PATCH version when you make backwards compatible bug fixes. )r3rs rversionzVersionableInterface.version-s |r) rrrrr3rrnrr4rDrr8rrs@rr2r2s&/HeCcM"...8AsC}!5AAA***** c3m,   ]     rr2)r+)6rcollections.abc collectionsrKr=loggingr"r%rabcrrtypingrrrrr r r r r rr volatility3rrvolatility3.frameworkrrr getLoggerrrrnrmror7 BasicTypes SimpleTypesrr"r(r*r/Mappingr1rr3rrr rr2rrrrDs    ''''''''                          1000000077777777D  8 $ $4 $ Cuc)* E+tK/@"@AB'''''EsEsEEEE -S-S---- ;;S;;S;;;;l l l l l {.l l l ^Z Z Z Z Z WZ Z Z Z z     0   F+++++++++\bbbbb(<bbbJ ? ? ? ? ?'; ? ? ?~~~~~g~~~~Br