*1f{3dZddlZddlZddlmZmZddlmZmZm Z m Z m Z ddl m Z mZGddeZGd d e jjZGd d ejjZdS) aDefines an interface for contexts, which hold the core components that a plugin will operate upon when running. These include a `memory` container which holds a series of forest of layers, and a `symbol_space` which contains tables of symbols that can be used to interpret data in a layer. The context also provides some convenience functions, most notably the object constructor function, `object`, which will construct a symbol on a layer at a particular offset. N)ABCMetaabstractmethod)OptionalUnionDictListIterable) interfaces exceptionsc PeZdZdZddZeed dZeed!dZeed"d Z d#d Z eed$dZ d%dZ e d&de edfdedededdf dZd'dZ d(dedededeedeeddf dZdS))ContextInterfacezAll context-like objects must adhere to the following interface. This interface is present to avoid import dependency cycles. returnNcdS)z,Initializes the context with a symbol_space.Nselfs Z/home/panchajanya/Development/work/volatility3/volatility3/framework/interfaces/context.py__init__zContextInterface.__init__)interfaces.configuration.HierarchicalDictcdS)z2Returns the configuration object for this context.Nrrs rconfigzContextInterface.config!rr'interfaces.symbols.SymbolSpaceInterfacecdS)zReturns the symbol_space for the context. This object must support the :class:`~volatility3.framework.interfaces.symbols.SymbolSpaceInterface` Nrrs r symbol_spacezContextInterface.symbol_space&rrModuleContainerc td)*Returns the memory object for the context.z)ModuleContainer has not been implemented.NotImplementedErrorrs rmoduleszContextInterface.modules0s""MNNNrmodule"interfaces.context.ModuleInterfacec:|j|dS)a%Adds a named module to the context. Args: module: The module to be added to the module object collection Raises: volatility3.framework.exceptions.VolatilityException: if the module is already present, or has unmet dependencies N)r" add_modulerr#s rr&zContextInterface.add_module6s  '''''r interfaces.layers.LayerContainerc td)rz(LayerContainer has not been implemented.r rs rlayerszContextInterface.layersBs""LMMMrlayer$interfaces.layers.DataLayerInterfacec:|j|dS)zAdds a named translation layer to the context memory. Args: layer: Layer object to be added to the context memory N)r* add_layer)rr+s rr.zContextInterface.add_layerHs e$$$$$r object_typeinterfaces.objects.Template layer_nameoffsetnative_layer_name"interfaces.objects.ObjectInterfacec dS)aObject factory, takes a context, symbol, offset and optional layer_name. Looks up the layer_name in the context, finds the object template based on the symbol, and constructs an object using the object template on the layer at the offset. Args: object_type: Either a string name of the type, or a Template of the type to be constructed layer_name: The name of the layer on which to construct the object offset: The address within the layer at which to construct the object native_layer_name: The layer this object references (should it be a pointer or similar) Returns: A fully constructed object Nr)rr/r1r2r3 argumentss robjectzContextInterface.objectRrrc*tj|S)a'Produce a clone of the context (and configuration), allowing modifications to be made without affecting any mutable objects in the original. Memory constraints may become an issue for this function depending on how much is actually stored in the context )copydeepcopyrs rclonezContextInterface.cloneks}T"""r module_namesizeModuleInterfacecdS)aACreate a module object. A module object is associated with a symbol table, and acts like a context, but offsets locations by a known value and looks up symbols, by default within the associated symbol table. It can also be sized should that information be available. Args: module_name: The name of the module layer_name: The layer the module is associated with (which layer the module lives within) offset: The initial/base offset of the module (used as the offset for relative symbols) native_layer_name: The default native_layer_name to use when the module constructs objects size: The size, in bytes, that the module occupies from offset location within the layer named layer_name Returns: A module object Nr)rr<r1r2r3r=s rr#zContextInterface.moduleurr)rNrr)rr)rr)r#r$)rr()r+r,N)rr )NN)__name__ __module__ __qualname____doc__rpropertyrrrr"r&r*r.rstrintr7r;rr#rrrr r s ;;;; AAA^XA   ^X OOO^XO ( ( ( (NNN^XN%%%% "&   3 ==>       .   ^ 0####,0"       $C=  sm         rr ) metaclassc veZdZdZdedededdffd ZedefdZede fd Z edefd Z edefd Z d)fd Z edefdZede fdZedefdZedefdZedefdZe d*dede deededdf dZe d+dedeededeeedfddf dZdede fdZdeddfdZdeddfd Zdeddfd!Zdedefd"Zdedefd#Zdedefd$Zde fd%Z!d,de d'e de efd(Z"xZ#S)-r>ziMaintains state concerning a particular loaded module in memory. This object is OS-independent. context config_pathnamerNcZt||||_dS)zConstructs a new os-independent module. Args: context: The context within which this module will exist config_path: The path within the context's configuration tree name: The name of the module N)superr _module_name)rrKrLrM __class__s rrzModuleInterface.__init__s- +... rc|jdS)Nr1rrs r _layer_namezModuleInterface._layer_names{<((rc|jdS)Nr2rSrs r_offsetzModuleInterface._offsets{8$$rcB|jd|jS)Nr3)rgetrTrs r_native_layer_namez"ModuleInterface._native_layer_names{2D4DEEErcB|jd|jS)Nsymbol_table_name)rrXrPrs r_symbol_table_namez"ModuleInterface._symbol_table_names{2D4EFFFrrct}|jd|d<|jj|j|jj|jd}|j|jkr,|jj|j|d<|D]<}||D]1}||||tj ||<2=|S)zRRTT    ?d5 5 5.2l.A'/!!## * +$  I!),  MWNNz/99)SIIJJ   rc|jS)z#The name of the constructed module.)rPrs rrMzModuleInterface.names   rc|jS)zRReturns the offset that the module resides within the layer of layer_name.)rVrs rr2zModuleInterface.offsets |rc|jS)z'Layer name in which the Module resides.)rTrs rr1zModuleInterface.layer_names rc|jS)zContext that the module uses.)_contextrs rrKzModuleInterface.contexts }rc|jS)z8The name of the symbol table associated with this module)r\rs rr[z!ModuleInterface.symbol_table_names &&rFr/r2r3absoluter4c dS)avReturns an object created using the symbol_table_name and layer_name of the Module. Args: object_type: The name of object type to construct (using the module's symbol_table) offset: the offset (unless absolute is set) from the start of the module native_layer_name: The native layer for objects that reference a different layer (if not the default provided during module construction) absolute: A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module Returns: The constructed object Nr)rr/r2r3rjkwargss rr7zModuleInterface.objectrr symbol_namec dS)aReturns an object created using the symbol_table_name and layer_name of the Module. Args: symbol_name: The name of a symbol (that must be present in the module's symbol table). The symbol's associated type will be used to construct an object at the symbol's offset. native_layer_name: The native layer for objects that reference a different layer (if not the default provided during module construction) absolute: A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module object_type: Override for the type from the symobl to use (or if the symbol type is missing) Returns: The constructed object Nr)rrmr3rjr/rls robject_from_symbolz"ModuleInterface.object_from_symbolrrcJ||}|j|jzS)z=Returns the absolute address of the symbol within this module) get_symbolr2address)rrMsymbols rget_absolute_symbol_addressz+ModuleInterface.get_absolute_symbol_addresss"&&{V^++rr0cdS)z.Returns a type from the module's symbol table.NrrrMs rget_typezModuleInterface.get_typerrz"interfaces.symbols.SymbolInterfacecdS)z7Returns a symbol object from the module's symbol table.Nrrvs rrqzModuleInterface.get_symbolrrcdS)z6Returns an enumeration from the module's symbol table.Nrrvs rget_enumerationzModuleInterface.get_enumerationrrcdS)zBDetermines whether a type is present in the module's symbol table.Nrrvs rhas_typezModuleInterface.has_typerrcdS)zDDetermines whether a symbol is present in the module's symbol table.Nrrvs r has_symbolzModuleInterface.has_symbol!rrcdS)zJDetermines whether an enumeration is present in the module's symbol table.Nrrvs rhas_enumerationzModuleInterface.has_enumeration$rrcdS)z?Lists the symbols contained in the symbol table for this moduleNrrs rsymbolszModuleInterface.symbols'rrrr=cdS)zReturns the symbols within table_name (or this module if not specified) that live at the specified absolute offset provided.Nr)rr2r=s r get_symbols_by_absolute_locationz0ModuleInterface.get_symbols_by_absolute_location*rrr@)NNF)NFN)r)$rBrCrDrEr rGrrFrTrHrVrYr\r^rMr2r1rKr[rrboolr7rrortrwrqrzr|r~rrrr __classcell__)rQs@rr>r>s' ! 0 !s !# !RV ! ! ! ! ! !)S)))X)%%%%X%FCFFFXFGCGGGXG4!c!!!X!X  C   X )X'3'''X'+/     $C=     .   ^ *,0RV    $C=   eC)M$MNO   .   ^ *,,,,,, =S=%B====FsF'KFFFFECE,IEEEEQSQTQQQQSsStSSSSYCYDYYYYNNNNN%%s%#%dSVi%%%%%%%%rr>ceZdZdZddeeeddfdZdZdeddfdZ d e ddfd Z d e defd Z de fd Zd Zdde de fdZde dee fdZdS)rz&Container for multiple layers of data.Nr"rcPi|_||D]}||dSdSrA)_modulesr&)rr"r#s rrzModuleContainer.__init__2sE46  ! ( (''''   ( (rcBt|t|kSrA)dict)rothers r__eq__zModuleContainer.__eq__8sDzzT%[[((rr#cx|j|jvrtjd|j||j|j<dS)zAdds a module to the module collection This will throw an exception if the required dependencies are not met Args: module: the module to add to the list of modules (based on module.name) zModule already exists: N)rMrr VolatilityExceptionr's rr&zModuleContainer.add_module;sK ;$- ' '07&+77 &, fk"""rrMc|j|=dS)z%Removes a module from the module listNrrvs r __delitem__zModuleContainer.__delitem__Is M$   rc|j|S)z$Returns the layer of specified name.rrvs r __getitem__zModuleContainer.__getitem__Ms}T""rc*t|jSrA)lenrrs r__len__zModuleContainer.__len__Qs4=!!!rc*t|jSrA)iterrrs r__iter__zModuleContainer.__iter__TsDM"""rprefixcdS)zaReturns an unused table name to ensure no collision occurs when inserting a symbol table.Nr)rrs rfree_module_namez ModuleContainer.free_module_nameWrr symbol_tablec#VK|jD]}|j|}|j|kr|VdS)z=Returns the modules which use the specified symbol table nameN)rr[)rrr<r#s rget_modules_by_symbol_tablesz,ModuleContainer.get_modules_by_symbol_tables[sH= " "K];/F'<77!!!! " "rrA)r#)rBrCrDrErrr>rrr&rGrrrHrrrr rrrrrr/s700((o)> ?(4(((( ))) , ,T , , , ,      ######"""""###%%s%#%%%%""#""""""rr)rE collectionsr9abcrrtypingrrrrr volatility3.frameworkr r r r_ConfigurableInterfacer>Mappingrrrrrs+   ''''''''8888888888888888888888v v v v v v v v v r]%]%]%]%]%j.D]%]%]%@1"1"1"1"1"ko-1"1"1"1"1"r