X f; dZddlZddlZddlZddlZddlZddlmZmZm Z m Z m Z ddl m Z mZejeZGddejj ZGddeZGd d ej ZGd d ZdS)zkObjects are the core of volatility, and provide pythonic access to interpreted values of data from a layer.N)AnyDictListMappingOptional) constants interfacescteZdZdZdeeefddfdZdedeffd Zdedefd Z d Z de fd Z d Z xZS) ReadOnlyMappingzA read-only mapping of various values that offer attribute access as well. This ensures that the data stored in the mapping should not be modified, making an immutable mapping. dictionaryreturnNc||_dSN_dict)selfr s Z/home/panchajanya/Development/work/volatility3/volatility3/framework/interfaces/objects.py__init__zReadOnlyMapping.__init__s  attrc|dkr!t|S||jvr |j|Std|jjd|)z!Returns the item as an attribute.rzObject has no attribute: .)super__getattribute__rAttributeError __class____name__)rrrs r __getattr__zReadOnlyMapping.__getattr__sh 7??77++D11 1 4:  :d# # H(? H H$ H H   rnamec|j|S)zReturns the item requested.r)rrs r __getitem__zReadOnlyMapping.__getitem__'sz$rc4|jS)z,Returns an iterator of the dictionary items.)r__iter__rs rr#zReadOnlyMapping.__iter__+sz""$$$rc*t|jS)z.Returns the length of the internal dictionary.)lenrr$s r__len__zReadOnlyMapping.__len__/s4:rcBt|t|kSr)dict)rothers r__eq__zReadOnlyMapping.__eq__3sDzzT%[[((r)r __module__ __qualname____doc__rstrrrrr!r#intr'r+ __classcell__rs@rr r s 738#4                   %%%)))))))rr cveZdZdZ d dededeededdeed eef fd ZxZS) ObjectInformationaContains common information useful/pertinent only to an individual object (like an instance) This typically contains information such as the layer the object belongs to, the offset where it was constructed, and if it is a subordinate object, its parent. This is primarily used to reduce the number of parameters passed to object constructors and keep them all together in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. N layer_nameoffset member_nameparentObjectInterfacenative_layer_namesizec \t|||||p||ddS)aConstructs a container for basic information about an object. Args: layer_name: Layer from which the data for the object will be read offset: Offset within the layer at which the data for the object will be read member_name: If the object was accessed as a member of a parent object, this was the name used to access it parent: If the object was accessed as a member of a parent object, this is the parent object native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in size: The size that the whole structure consumes in bytes r5r6r7r8r:r;N)rr)rr5r6r7r8r:r;rs rrzObjectInformation.__init__BsL& ( * %6%D*    r)NNNN) rr,r-r.r/r0rrr1r2s@rr4r47s&*.2+/"    c]  *+  $C=  sm          rr4ceZdZdZdddeddddfd Zd edefd Zede fd Z e j d efdZ defdZdeddfdZdedefdZdedefdZdeedefdZGdde jZdS)r9zQA base object required to be the ancestor of every object used in volatility.context#interfaces.context.ContextInterface type_name object_infor4r Nc |j|jj}|j|z}||d}t ji||||_||_dS)a:Constructs an Object adhering to the ObjectInterface. Args: context: The context associated with the object type_name: The name of the type structure for the object object_info: Basic information relevant to the object (layer, offset, member_name, parent, etc) )rAr6N)layersr5 address_maskr6 collectionsChainMap_vol_context)rr?rArBkwargsmasknormalized_offset vol_info_dicts rrzObjectInterface.__init__esU4~k45B'.5&/;LMM (]KPP  rrct)z7Method for ensuring volatility members can be returned.)rrrs rrzObjectInterface.__getattr__src*t|jS)z3Returns the volatility specific object information.r rHr$s rvolzObjectInterface.volsty)))rvaluecdS)z[Writes the new value into the format at the offset the object currently resides at.N)rrSs rwritezObjectInterface.writerc8tj|jjvrt d|jj|jjd|jjtj}||jjvrtd|jj|S)zReturns the symbol table name for this particular object. Raises: ValueError: If the object's symbol does not contain an explicit table KeyError: If the table_name is not valid within the object's context z&Unable to determine table for symbol: Nz=Symbol table not found in context's symbol_space for symbol: ) rBANGrRrA ValueErrorindexrI symbol_spaceKeyError)r table_names rget_symbol_table_namez%ObjectInterface.get_symbol_table_names >!3 3 3M9KMM X'(R$(*<*B*B9>*R*R(RS T]7 7 7dPTPXPbdd r new_type_namec tj|vr&|}|tjz|z}|jj|}|}|jdi|t|j j |j j |j j |j j |j j|j}||j|S)zReturns a new object at the offset and from the layer that the current object inhabits. .. note:: If new type name does not include a symbol table, the symbol table for the current object is used r=)r?rBrU)rrYr_rIr\get_typeclone update_volr4rRr5r6r7r8r:r;)rr` additional symbol_tableobject_templaterBs rcastzObjectInterface.casts > . .5577L(9>9MIM-4==mLL)//11""00Z000'x*8?,8?"h8 %    t}+NNNNrr7cdS)zReturns whether the object would contain a member called member_name. Args: member_name: Name to test whether a member exists within the type structure FrUrr7s r has_memberzObjectInterface.has_members urc||rCtjt5t ||} ddddS#1swxYwYdS)zReturns whether the dereferenced type has a valid member. Args: member_name: Name of the member to test access to determine if the member is valid or not NTF)rk contextlibsuppress Exceptiongetattr)rr7_s rhas_valid_memberz ObjectInterface.has_valid_members ??; ' ' $Y//  D+..                usAAA member_namesc:tfd|DS)zReturns whether the object has all of the members listed in member_names Args: member_names: List of names to test as to members with those names validity c:g|]}|SrU)rr).0r7rs r z5ObjectInterface.has_valid_members..s'WWW;D))+66WWWr)all)rrss` rhas_valid_membersz!ObjectInterface.has_valid_memberss( WWWW,WWWXXXrceZdZUdZgZeeed<ee j ddde fdZ ee j dddedfdZ ee j dd Zee j ddd ede fd Zee j ddd eddfdZee j dddedefdZd S) ObjectInterface.VolTemplateProxyaA container for proxied methods that the ObjectTemplate of this object will call. This is primarily to keep methods together for easy organization/management, there is no significant need for it to be a separate class. The methods of this class *must* be class methods rather than standard methods, to allow for code reuse. Each method also takes a template since the templates may contain the necessary data about the yet-to-be-constructed object. It allows objects to control how their templates respond without needing to write new templates for each and every potential object type. _methodstemplateTemplater cdS)z(Returns the size of the template object.NrUclsr}s rr;z%ObjectInterface.VolTemplateProxy.sizerWrcgS)z%Returns the children of the template.rUrs rchildrenz)ObjectInterface.VolTemplateProxy.childrens Ir old_child new_childNc:td|jj)z,Substitutes the old_child for the new_child.z3Template does not contain any children to replace: r]rRrA)rr}rrs r replace_childz.ObjectInterface.VolTemplateProxy.replace_childs& ^hlF\^^ rchildc:td|jj)z]Returns the relative offset from the head of the parent data to the child member.(Template does not contain any children: rrr}rs rrelative_child_offsetz6ObjectInterface.VolTemplateProxy.relative_child_offsets& S8<;QSS rinterfaces.objects.Templatec:td|jj)z9Returns the template of the child member from the parent.rrrs rchild_templatez/ObjectInterface.VolTemplateProxy.child_template s& S8<;QSS rr7cdS)zQReturns whether the object would contain a member called member_name.FrU)rr}r7s rrkz+ObjectInterface.VolTemplateProxy.has_members 5r)r}r~rr~rr~r N)rr,r-r.r|rr/__annotations__ classmethodabcabstractmethodr0r;rrrrboolrkrUrrVolTemplateProxyr{s !$s)     ;  ;s ; ; ;    ;   J 4 3C          % 2< IS             C C          % .1  *          j s t         rr metaclass)rr,r-r.r/rrrpropertyr rRrrrVr_rhrrkrrrryABCMetarrUrrr9r9as 6  )       B*_***X*  !3!!!!s$O#O8IOOOO0cd C D    Yd3iYDYYYY=====S[======rr9rczeZdZdZdeddffd ZedefdZede dfdZ ee j de fdZe j d ede fd Ze j d edd fd Ze j ddZe j dedefdZddZddZdedefdZdddedefdZxZS)r~aClass for all Factories that take offsets, and data layers and produce objects. This is effectively a class for currying object calls. It creates a callable that can be called with the following parameters: Args: context: The context containing the memory layers and symbols required to construct the object object_info: Basic information about the object, see the ObjectInformation class for more information Returns: The constructed object The keyword arguments handed to the constructor, along with the type_name are stored for later retrieval. These will be access as `object.vol.` or `template.vol.` for each object and should contain as least the basic information that each object will require before it is instantiated (so `offset` and `parent` are explicitly not recorded here). This dictionary can be updated after construction, but any changes made after that point will *not* be cloned. This is so that templates such as those for string objects may contain different length limits, without affecting all other strings using the same template from a SymbolTable, constructed at resolution time and then cached. rAr Nc ti}tj||d|i|_dS)z7Stores the keyword arguments for later object creation.rAN)rrrFrGrH)rrA arguments empty_dictrs rrzTemplate.__init__4sD %' (  K#;   rc*t|jS)zReturns a volatility information object, much like the :class:`~volatility3.framework.interfaces.objects.ObjectInformation` provides.rQr$s rrRz Template.vol=s ty)))rcgS)zThe children of this template (such as member types, sub-types and base-types where they are relevant). Used to traverse the template tree. rUr$s rrzTemplate.childrenDs  rcdS)z!Returns the size of the template.NrUr$s rr;z Template.sizeMrWrrcdS)zQReturns the relative offset of the `child` member from its parent offset.NrUrrs rrzTemplate.relative_child_offsetRrWrrcdS)z4Returns the `child` member template from its parent.NrUrs rrzTemplate.child_templateWrWrrrcdS)z>Replaces `old_child` with `new_child` in the list of children.NrU)rrrs rrzTemplate.replace_child[rWrr7cdS)zNReturns whether the object would contain a member called `member_name`NrUrjs rrkzTemplate.has_member_rWrcX|jdi|jj}|S)zpReturns a copy of the original Template as constructed (without `update_vol` additions having been made)rU)rrHparentsr)rrcs rrczTemplate.cloneds1??!2!!>?? rc :|j|dS)z`Updates the keyword arguments with values that will **not** be carried across to clones.N)rHupdate)r new_argumentss rrdzTemplate.update_voljs  '''''rrcv|dkr||jvr |j|St|jjd|)zaExposes any other values stored in ._vol as attributes (for example, enumeration choices)rHz object has no attribute )rHrrrrOs rrzTemplate.__getattr__osN 6>>ty  y&~& G G G G   rr?r@rBcdS)zConstructs the object.NrU)rr?rBs r__call__zTemplate.__call__yrWr)rr~rr~r N)r r~)r N)rr,r-r.r/rrr rRrrrrr0r;rrrrrkrcrdrrr4r9rr1r2s@rr~r~s, # t      *_***X* $z*X0c000X0 33 CCC,ICCCC MMMM cd ((((       %6%'%  %%%%%%%%rr~)r.rrFcollections.abcrmloggingtypingrrrrrvolatility3.frameworkrr getLoggerrvollogr r4rr9r~rUrrrsk,, 5555555555555577777777  8 $ $")")")")")ko-")")")J' ' ' ' ' ' ' ' Tyyyyy yyyyxa%a%a%a%a%a%a%a%a%a%r