X f9LdZddlZddlZddlmZmZddlmZm Z m Z m Z m Z m Z mZmZddlmZmZmZddlmZddlmZmZddlmZGd d ZGd d ZGd dejjZGddeej<eZGddeZ Gdde!Z"y)z>TZZ 'I)..IYYZ[    +c|jS)zReturns the name of the symbol.)rr$s r%rzSymbolInterface.name.zzr'cN|jy|jjdS)z8Returns the name of the type that the symbol represents.N type_name)rvolr)s r%r,zSymbolInterface.type_name3s$ 99 yy}}[))r'c|jS)z,Returns the type that the symbol represents.)r"r)s r%rzSymbolInterface.type;r*r'c|jS)zOReturns the relative address of the symbol within the compilation unit.)r!r)s r%rzSymbolInterface.address@s}}r'c|jS)z5Returns any constant data associated with the symbol.)r#r)s r%rzSymbolInterface.constant_dataFs"""r'NN)__name__ __module__ __qualname____doc__strintr rTemplatebytesr&propertyrr,rrrr'r%rrsL ,0)- ,,,w''( ,   ,  ,6c*8C=**hw//0 #x##r'rc &eZdZdZ ddedddeeeefdeeeee jfddf d Z dede fd Z edeefd Zedeefd Zdede j$fd ZedeefdZeddZej.ddZdedee jddfdZdedee jdefdZdedee jfdZdeddfdZdedee j$fdZdedeefdZd dededeefdZ d!dZ!y)"BaseSymbolTableInterfaceaThe base interface, inherited by both NativeTables and SymbolTables. native_types is a NativeTableInterface used for native types for the particular loaded symbol table table_mapping allows tables referenced by symbols to be remapped to a different table name if necessary Note: table_mapping is a rarely used feature (since symbol tables are typically self-contained) Nr native_typesNativeTableInterface table_mapping class_typesrc||_|i}||_||_g|_|r|D]}|j |||yy)a Args: name: Name of the symbol table native_types: The native symbol table used to resolve any base/native types table_mapping: A dictionary mapping names of tables (which when present within the table will be changed to the mapped table) class_types: A dictionary of types and classes that should be instantiated instead of Struct to construct them N)rr@ _native_types _sort_symbolsset_type_class)r$rr>r@rA class_types r%r&z!BaseSymbolTableInterface.__init__Us^  M*)46 ) I ##J J0GH I r'ctd)z{Resolves a symbol name into a symbol object. If the symbol isn't found, it raises a SymbolError exception z9Abstract property get_symbol not implemented by subclass.NotImplementedErrorr$rs r% get_symbolz#BaseSymbolTableInterface.get_symbolrs " G  r'ctd)z(Returns an iterator of the Symbol names.z6Abstract property symbols not implemented by subclass.rHr)s r%symbolsz BaseSymbolTableInterface.symbols{s" D  r'ctd)z-Returns an iterator of the Symbol type names.z4Abstract property types not implemented by subclass.rHr)s r%typeszBaseSymbolTableInterface.typess" B  r'ctd)z}Resolves a symbol name into an object template. If the symbol isn't found it raises a SymbolError exception z5Abstract method get_type not implemented by subclass.rHrJs r%get_typez!BaseSymbolTableInterface.get_types " C  r'ctd)z-Returns an iterator of the Enumeration names.z;Abstract property enumerations not implemented by subclass.rHr)s r% enumerationsz%BaseSymbolTableInterface.enumerationss" I  r'c|jS)zOReturns None or a NativeTable for handling space specific native types.rCr)s r%nativesz BaseSymbolTableInterface.nativess!!!r'c||_y)zChecks the natives value and then applies it internally. WARNING: This allows changing the underlying size of all the other types referenced in the SymbolTable NrUr$values r%rVz BaseSymbolTableInterface.nativess #r'clazzctd)aOverrides the object class for a specific Symbol type. Name *must* be present in self.types Args: name: The name of the type to override the class for clazz: The actual class to override for the provided type name z3Abstract method set_type_class not implemented yet.rHr$rrZs r%rEz'BaseSymbolTableInterface.set_type_classs""WXXr'cH |j||y#t$rYywxYw)a$Calls the set_type_class function but does not throw an exception. Returns whether setting the type class was successful. Args: name: The name of the type to override the class for clazz: The actual class to override for the provided type name TF)rErr\s r%optional_set_type_classz0BaseSymbolTableInterface.optional_set_type_classs,    e ,  s  !!ctd)z0Returns the class associated with a Symbol type.z3Abstract method get_type_class not implemented yet.rHrJs r%get_type_classz'BaseSymbolTableInterface.get_type_class!"WXXr'ctd)zARemoves the associated class override for a specific Symbol type.z3Abstract method del_type_class not implemented yet.rHrJs r%del_type_classz'BaseSymbolTableInterface.del_type_classrar'c`|j|j}|y|j|S)zQResolves a symbol name into a symbol and then resolves the symbol's type.N)rKr,rQ)r$rr,s r%get_symbol_typez(BaseSymbolTableInterface.get_symbol_types0OOD)33  }}Y''r'r,c#K|jD]j}|j|}|j!|j|k(s-|jjtj |zs]|j lyw)zXReturns the name of all symbols in this table that have type matching type_name.N)rMrKr,endswithr rr)r$r, symbol_namesymbols r%get_symbols_by_typez,BaseSymbolTableInterface.get_symbols_by_typesl << "K__[1F+  I-$$--inny.HIkk! "s-A=;A=,A=offsetsizec#K|dkr td|jsCt|jDcgc]}|j |j |f!c}|_|j}t j||df}|t|krU||d|k\rI||d||zkr:||d|dz }|t|kr||d|k\r||d||zkr7yyyyyycc}ww)zWReturns the name of all symbols in this table that live at a particular offset.rz"Size must be strictly non-negativeN) rrDsortedrMrKrbisect bisect_leftlen)r$rkrlsn sort_symbolsresults r%get_symbols_by_locationz0BaseSymbolTableInterface.get_symbols_by_locations !8AB B!!!'=A\\Jr$//"%--r2J"D )) ##L62,?s<((   #v -V$Q'6D=8v&q) ) aKF s<((   #v -V$Q'6D=8 .)8 .) Ks0C/$C*B C/$ C/cy)z-Clears the symbol cache of this symbol table.Nr;r)s r%clear_symbol_cachez+BaseSymbolTableInterface.clear_symbol_caches r'r1)rr?)rYr?rN)r)rN)"r2r3r4r5r6r rr r rObjectInterfacer&rrKr:rrMrOr8rQrrSrVsetterrEboolr^r`rcrerjr7rwryr;r'r%r=r=Ls37MQ II-I S#X/ I gc40G0G+H&HIJ I  I: s   #   x}   S W%5%5  hsm  ""  ^^## Y3 YtG4K4K/L YQU Y $W%<%< =  Y3Y40G0G+HYY3Y4Y (C(HW5E5E,F( "S "Xc] "cXc]$ r'r=c leZdZdZddedefdZededdfdZededeefd Z e dd e d e de edeefd Z edede jfd ZededefdZedede jfdZededefdZededefdZededefdZededdfdZy)SymbolSpaceInterfacezhAn interface for the container that holds all the symbol-containing tables for use within a context.prefixrcy)zaReturns an unused table name to ensure no collision occurs when inserting a symbol table.Nr;)r$rs r%free_table_namez$SymbolSpaceInterface.free_table_namer' table_nameNcy)zClears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.Nr;)r$rs r%ryz'SymbolSpaceInterface.clear_symbol_cacherr'r,cy)z4Returns all symbols based on the type of the symbol.Nr;r$r,s r%rjz(SymbolSpaceInterface.get_symbols_by_type rr'rkrlcy)z>Returns all symbols that exist at a specific relative address.Nr;)r$rkrlrs r%rwz,SymbolSpaceInterface.get_symbols_by_locationrr'cy)z;Look-up a type name across all the contained symbol tables.Nr;rs r%rQzSymbolSpaceInterface.get_typerr'rhcy)z=Look-up a symbol name across all the contained symbol tables.Nr;)r$rhs r%rKzSymbolSpaceInterface.get_symbolrr' enum_namecy)z>Look-up an enumeration across all the contained symbol tables.Nr;)r$rs r%get_enumerationz$SymbolSpaceInterface.get_enumerationrr'rcy)z@Determines whether a type exists in the contained symbol tables.Nr;rJs r%has_typezSymbolSpaceInterface.has_type#rr'cy)zJDetermines whether a symbol exists in the contained symbol tables.Nr;rJs r% has_symbolzSymbolSpaceInterface.has_symbol'rr'cy)zWDetermines whether an enumeration choice exists in the contained symbol tables.Nr;rJs r%has_enumerationz$SymbolSpaceInterface.has_enumeration,rr'rYcy)z+Adds a symbol_list to the end of the space.Nr;rXs r%appendzSymbolSpaceInterface.append1rr')layer)rN)r2r3r4r5r6rrryrrjr7r rwrr8rQrrKrr|rrrr=rr;r'r%r~r~s(%c%%KSKTKKCSCXc]CCFJMM!$M6>smM #MM J#J'*:*:JJLcLoLLMM1A1AMMOSOTOOstCD:4:::r'r~ceZdZdZ ddddededdd eeeefd eeeee jfd dfd Z dfd Z e d eeffd ZxZS)SymbolTableInterfacezHandles a table of symbols.Ncontextz#interfaces.context.ContextInterface config_pathrr>r?r@rArcztjj|||tj|||||y)aInstantiates an SymbolTable based on an IntermediateSymbolFormat JSON file. This is validated against the appropriate schema. Args: context: The volatility context for the symbol table config_path: The configuration path for the symbol table name: The name for the symbol table (this is used in symbols e.g. table!symbol ) isf_url: The URL pointing to the ISF file location native_types: The NativeSymbolTable that contains the native types for this symbol table table_mapping: A dictionary linking names referenced in the file with symbol tables in the context class_types: A dictionary of type names and classes that override StructType when they are instantiated )rAN)rConfigurableInterfacer&r=)r$rrrr>r@rAs r%r&zSymbolTableInterface.__init__<s:* ++44T7KP )) $ m * r'ct|}|jjdz|jjz|d<|S)N.class)superbuild_configuration __class__r3r2)r$configrs r%rz(SymbolTableInterface.build_configurationVs>,...33c9DNNInterface for accessing metadata stored within a symbol table. json_datarNc||_y)z#Constructor that accepts json_data.N) _json_data)r$rs r%r&zMetadataInterface.__init__s #r')r2r3r4r5rr&r;r'r%rr}sH$$$4$r'r)#r5rqcollections.abc collectionsabcrrtypingrrrrr r r r volatility3.frameworkr rr#volatility3.framework.configurationr volatility3.framework.interfacesrr.volatility3.framework.interfaces.configurationrrr=r~rrr?objectrr;r'r%rsC #LLLCC<CO9#9#xq q h3:;??223:l0 mAA30 f3($$r'