X f9TdZddlZddlZddlmZmZddlmZm Z m Z m Z m Z m Z mZmZddlmZmZmZddlmZddlmZmZddlmZGd d ZGd d ZGd dejj ZGddeejeZGddeZ Gdde!Z"dS)zTZ ' '[).[[[    +c|jS)zReturns the name of the symbol.)rr$s r%rzSymbolInterface.name. zr'c8|jdS|jjdS)z8Returns the name of the type that the symbol represents.N type_name)rvolr)s r%r,zSymbolInterface.type_name3s  9 4y}[))r'c|jS)z,Returns the type that the symbol represents.)r"r)s r%rzSymbolInterface.type;r*r'c|jS)zOReturns the relative address of the symbol within the compilation unit.)r!r)s r%rzSymbolInterface.address@s }r'c|jS)z5Returns any constant data associated with the symbol.)r#r)s r%rzSymbolInterface.constant_dataFs ""r'NN)__name__ __module__ __qualname____doc__strintr rTemplatebytesr&propertyrr,rrrr'r%rrsJLL ,0)- ,,,,w'( ,   ,  ,,,,6cX*8C=***X*hw/0XX #x###X###r'rc TeZdZdZ ddedddeeeefdeeeee j fddf d Z dede fd Z edeefd Zedeefd Zdede jfd ZedeefdZed dZejd!dZdedee j ddfdZdedee j defdZdedee j fdZdeddfdZdedee jfdZdedeefdZd"dededeefdZ d#dZ!dS)$BaseSymbolTableInterfaceaThe base interface, inherited by both NativeTables and SymbolTables. native_types is a NativeTableInterface used for native types for the particular loaded symbol table table_mapping allows tables referenced by symbols to be remapped to a different table name if necessary Note: table_mapping is a rarely used feature (since symbol tables are typically self-contained) Nr native_typesNativeTableInterface table_mapping class_typesrc||_|i}||_||_g|_|r!|D] }||||dSdS)a Args: name: Name of the symbol table native_types: The native symbol table used to resolve any base/native types table_mapping: A dictionary mapping names of tables (which when present within the table will be changed to the mapped table) class_types: A dictionary of types and classes that should be instantiated instead of Struct to construct them N)rr@ _native_types _sort_symbolsset_type_class)r$rr>r@rA class_types r%r&z!BaseSymbolTableInterface.__init__Us  M*)46  I) I I ##J J0GHHHH I I I Ir'c td)z{Resolves a symbol name into a symbol object. If the symbol isn't found, it raises a SymbolError exception z9Abstract property get_symbol not implemented by subclass.NotImplementedErrorr$rs r% get_symbolz#BaseSymbolTableInterface.get_symbolrs " G   r'c td)z(Returns an iterator of the Symbol names.z6Abstract property symbols not implemented by subclass.rHr)s r%symbolsz BaseSymbolTableInterface.symbols{s" D   r'c td)z-Returns an iterator of the Symbol type names.z4Abstract property types not implemented by subclass.rHr)s r%typeszBaseSymbolTableInterface.typess" B   r'c td)z}Resolves a symbol name into an object template. If the symbol isn't found it raises a SymbolError exception z5Abstract method get_type not implemented by subclass.rHrJs r%get_typez!BaseSymbolTableInterface.get_types " C   r'c td)z-Returns an iterator of the Enumeration names.z;Abstract property enumerations not implemented by subclass.rHr)s r% enumerationsz%BaseSymbolTableInterface.enumerationss" I   r'c|jS)zOReturns None or a NativeTable for handling space specific native types.rCr)s r%nativesz BaseSymbolTableInterface.nativess !!r'valuec||_dS)zChecks the natives value and then applies it internally. WARNING: This allows changing the underlying size of all the other types referenced in the SymbolTable NrUr$rWs r%rVz BaseSymbolTableInterface.nativess #r'clazzc td)aOverrides the object class for a specific Symbol type. Name *must* be present in self.types Args: name: The name of the type to override the class for clazz: The actual class to override for the provided type name z3Abstract method set_type_class not implemented yet.rHr$rrZs r%rEz'BaseSymbolTableInterface.set_type_classs""WXXXr'cV |||dS#t$rYdSwxYw)a$Calls the set_type_class function but does not throw an exception. Returns whether setting the type class was successful. Args: name: The name of the type to override the class for clazz: The actual class to override for the provided type name TF)rErr\s r%optional_set_type_classz0BaseSymbolTableInterface.optional_set_type_classsD    e , , ,4   55 s  ((c td)z0Returns the class associated with a Symbol type.z3Abstract method get_type_class not implemented yet.rHrJs r%get_type_classz'BaseSymbolTableInterface.get_type_class!"WXXXr'c td)zARemoves the associated class override for a specific Symbol type.z3Abstract method del_type_class not implemented yet.rHrJs r%del_type_classz'BaseSymbolTableInterface.del_type_classrar'ch||j}|dS||S)zQResolves a symbol name into a symbol and then resolves the symbol's type.N)rKr,rQ)r$rr,s r%get_symbol_typez(BaseSymbolTableInterface.get_symbol_types5OOD))3  4}}Y'''r'r,c#K|jD]Y}||}|j;|j|ks'|jtj|zr |jVZdS)zXReturns the name of all symbols in this table that have type matching type_name.N)rMrKr,endswithr rr)r$r, symbol_namesymbols r%get_symbols_by_typez,BaseSymbolTableInterface.get_symbols_by_types~ < " "K__[11F+ I--$--iny.HII.k!!! " "r'roffsetsizec#K|dkrtdjs%tfdjD_j}t j||df}|t |krx||d|krj||d||zkrW||dV|dz }|t |kr+||d|kr||d||zkOdSdSdSdSdSdS)zWReturns the name of all symbols in this table that live at a particular offset.rz"Size must be strictly non-negativecHg|]}|j|fSr;)rKr).0snr$s r% zDBaseSymbolTableInterface.get_symbols_by_location..s-JJJr$//"%%-r2JJJr'N)rrDsortedrMbisect bisect_leftlen)r$rkrl sort_symbolsresults` r%get_symbols_by_locationz0BaseSymbolTableInterface.get_symbols_by_locationsB !88ABB B! !'JJJJT\JJJ""D ) #L62,??s<((((   #v - -V$Q'6D=88v&q) ) ) ) aKF s<((((   #v - -V$Q'6D=8888)((( - -88 . -r'cdS)z-Clears the symbol cache of this symbol table.Nr;r)s r%clear_symbol_cachez+BaseSymbolTableInterface.clear_symbol_caches r'r1)rr?)rWr?rN)r)rN)"r2r3r4r5r6r rr r rObjectInterfacer&rrKr:rrMrOr8rQrrSrVsetterrEboolr^r`rcrerjr7rzr|r;r'r%r=r=Ls37MQ III-I S#X/ I gc40G+H&HIJ I  IIII: s      #   X  x}   X  S W%5     hsm   X """X"  ^###^# Y3 YtG4K/L YQU Y Y Y Y $W%< =  Y3Y40G+HYYYYY3Y4YYYY (C(HW5E,F(((( "S "Xc] " " " "cXc]$      r'r=c eZdZdZddedefdZededdfdZed edeefd Z e dd e d e de edeefdZ ed ede jfdZededefdZedede jfdZededefdZededefdZededefdZededdfdZdS)SymbolSpaceInterfacezhAn interface for the container that holds all the symbol-containing tables for use within a context.layerprefixrcdS)zaReturns an unused table name to ensure no collision occurs when inserting a symbol table.Nr;)r$rs r%free_table_namez$SymbolSpaceInterface.free_table_namer' table_nameNcdS)zClears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.Nr;)r$rs r%r|z'SymbolSpaceInterface.clear_symbol_cacherr'r,cdS)z4Returns all symbols based on the type of the symbol.Nr;r$r,s r%rjz(SymbolSpaceInterface.get_symbols_by_type rr'rrkrlcdS)z>Returns all symbols that exist at a specific relative address.Nr;)r$rkrlrs r%rzz,SymbolSpaceInterface.get_symbols_by_locationrr'cdS)z;Look-up a type name across all the contained symbol tables.Nr;rs r%rQzSymbolSpaceInterface.get_typerr'rhcdS)z=Look-up a symbol name across all the contained symbol tables.Nr;)r$rhs r%rKzSymbolSpaceInterface.get_symbolrr' enum_namecdS)z>Look-up an enumeration across all the contained symbol tables.Nr;)r$rs r%get_enumerationz$SymbolSpaceInterface.get_enumerationrr'rcdS)z@Determines whether a type exists in the contained symbol tables.Nr;rJs r%has_typezSymbolSpaceInterface.has_type#rr'cdS)zJDetermines whether a symbol exists in the contained symbol tables.Nr;rJs r% has_symbolzSymbolSpaceInterface.has_symbol'rr'cdS)zWDetermines whether an enumeration choice exists in the contained symbol tables.Nr;rJs r%has_enumerationz$SymbolSpaceInterface.has_enumeration,rr'rWcdS)z+Adds a symbol_list to the end of the space.Nr;rYs r%appendzSymbolSpaceInterface.append1rr')r)rN)r2r3r4r5r6rrr|rrjr7r rzrr8rQrrKrrrrrr=rr;r'r%rrsk((%%c%%%%%KSKTKKK^KCSCXc]CCC^CFJMMM!$M6>smM #MMM^M J#J'*:JJJ^JLcLoLLL^LMM1AMMM^MOSOTOOO^Ost^CD^:4::::^:::r'rceZdZdZ ddddededdd eeeefd eeeee j fd dfd Z dfd Z e d eeffd ZxZS)SymbolTableInterfacezHandles a table of symbols.Ncontextz#interfaces.context.ContextInterface config_pathrr>r?r@rArctj|||t|||||dS)aInstantiates an SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. Args: context: The volatility context for the symbol table config_path: The configuration path for the symbol table name: The name for the symbol table (this is used in symbols e.g. table!symbol ) isf_url: The URL pointing to the ISF file location native_types: The NativeSymbolTable that contains the native types for this symbol table table_mapping: A dictionary linking names referenced in the file with symbol tables in the context class_types: A dictionary of type names and classes that override StructType when they are instantiated )rAN)rConfigurableInterfacer&r=)r$rrrr>r@rAs r%r&zSymbolTableInterface.__init__<sQ* +44T7KPPP )) $ m *     r'configuration.HierarchicalDictct}|jjdz|jjz|d<|S)N.class)superbuild_configuration __class__r3r2)r$configrs r%rz(SymbolTableInterface.build_configurationVs<,,...3c9DNInterface for accessing metadata stored within a symbol table. json_datarNc||_dS)z#Constructor that accepts json_data.N) _json_data)r$rs r%r&zMetadataInterface.__init__s #r')r2r3r4r5rr&r;r'r%rr}s<HH$$$4$$$$$$r'r)#r5rucollections.abc collectionsabcrrtypingrrrrr r r r volatility3.frameworkr rr#volatility3.framework.configurationr volatility3.framework.interfacesrr.volatility3.framework.interfaces.configurationrrr=rrrr?objectrr;r'r%rsCB ########LLLLLLLLLLLLLLLLLLLLCCCCCCCCCC<<<<<<CCCCCCCCOOOOOO9#9#9#9#9#9#9#9#xq q q q q q q q h3:3:3:3:3:;?23:3:3:l0 0 0 0 0 mA30 0 0 f3($$$$$$$$$$r'