*1fb]ddlZddlZddlZddlmZmZmZmZmZm Z ddl m Z ddl m Z mZddlmZddlmZejeZ GddejZGd d ejZdS) N)OptionalDictAnyListIterableTuple) classproperty) interfaces exceptions) requirements)linearceZdZdS)AArch64ExceptionN)__name__ __module__ __qualname__R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/arm.pyrrsDrrceZdZdZejddiddiejjj Z dZ e dzZ dZ e Z gdgdgd d Z d8d ejjd ededeeeefdd f fd Zd9dZededededeefdZedededeeefdZdedeeeeffdZdedeeeeffdZ d:dededede eeeeeeffd Z! d:dededede eeeeeeffd!Z"deefd"Z#d;dededefd$Z$dedefd%Z%e&d&edefd'Z'e(e)j*defd(Z+e(e)j*defd)Z,e(e)j*defd*Z-e.e)j*defd+Z/e.e)j*defd,Z0e.e)j*defd-Z1d.edefd/Z2d.edefd0Z3e& d8d1ed2ed3ed4eedef d5Z4e(deefd6Z5edeej6j7fd7Z8xZ9S)<AArch64zTranslation Layer for the Arm AArch64 memory mapping. This layer can be instantiated in two contexts : Low space (user land), High space (kernel land). architecturemappedT@))30)/')&)) ))rr).$)#)))r*))r"))r/rNcontext config_pathnamemetadatareturncTt|||||jd|_|jdd|_|jdd|_|jd|_|jd|_|jd|_ |jd |jd g|_ |jd |jd g|_ t|j|jdk|_ d |j |j z |_|j |j |_ |j |j dkrdnd|_||j|j|_||j|j|j|_||j |_|d|jzdz |j|j|_|jr|dSdS)N)r1r2r3r4kernel_endianness layer_debugFtranslation_debug memory_layerpage_map_offsetpage_map_offset_kernel tcr_el1_t0sz tcr_el1_t1szpage_size_user_spacepage_size_kernel_spacerr/T)super__init__config_kernel_endiannessget _layer_debug_translation_debug _base_layer_page_map_offset_page_map_offset_kernel _ttbs_tnsz_ttbs_granulesint_virtual_addr_space _ttb_bitsize _ttb_granule _is_52bits_determine_ttb_lookup_indexes_ttb_lookup_indexes_determine_ttb_descriptor_bits_ttb_descriptor_bits_get_virtual_addr_range_virtual_addr_range_mask_bits_per_register_canonical_prefix_print_layer_debug_informations)selfr1r2r3r4 __class__s rrCzAArch64.__init__=s) 4(    #'+.A"B KOOM5AA"&+//2Eu"M"M;~6 $ ,= >'+{3K'L$;~6 N8ST K. / K0 1  $'  !T[1I%J J$ $  1I!JJ /0HI OD$<=BBDD $(#E#E  t0$ $  %)$G$G  t7% % !$(#?#?#A#A  $$  "& $) )Q .  #  " "    3  0 0 2 2 2 2 2 3 3rcrtd|jtd|jrdndtdt d|Dtd|jtd|jd |j|jtd t|j td |j dS) Nz Base layer : zVirtual address space : kerneluserz Virtual addresses space range : c,g|]}t|Sr)hex).0xs r z;AArch64._print_layer_debug_informations..{s5e5e5ec!ff5e5e5erz Page size : TzSZ : zPage map offset : zTranslation mappings : ) vollogdebugrIrOtuplerWrQrLrcrJrTr]s rr\z'AArch64._print_layer_debug_informationsus5 7T%577888 Y43K'WxxQW Y Y     hu5e5edFbFbFdFd5e5e5e/f/f h h     7D$577888 Z( Z Ztt?W/X Z Z     F#d.C*D*DFFGGG It/GIIJJJtr ttb_granulettb_lookup_indexes is_52bitsc2|dvr|rdnd|ddfS)zReturns the descriptor bits to extract from a descriptor (high and low) Example with granule = 4 kB without 52 bits : (47,12) Example with granule = 16 kB and 52 bits : (49,14) r0r/1rrAr)clsrlrmrns rrUz&AArch64._determine_ttb_descriptor_bitss1((Y(BBB r "1 %  r ttb_bitsizecffd|j|D}dz |ddf|d<|S)aReturns the bits to extract from a translation address (highs and lows) Example with bitsize = 47 and granule = 4 kB : indexes = [(51, 48), (47, 39), (38, 30), (29, 21), (20, 12)] result = [(46, 39), (38, 30), (29, 21), (20, 12)] c,g|]}|dk|SrAr)rdindexrts rrfz9AArch64._determine_ttb_lookup_indexes..s2   U1X%% %%%rrAr)_granules_indexes)rsrlrtindexess ` rrSz%AArch64._determine_ttb_lookup_indexessT    .{;    "Aowqz!}5 rvirtual_offsetc||\}}}|||dz d}||z}|d|z|jfS)zTranslates a specific offset based on paging tables. Returns the translated offset, the contiguous pagesize that the translated address lives in and the layer_name that the address lives in rAr)_translate_entryrYrI)r]r{ table_addressposition_offset_within_pagephysical_offsets r _translatezAArch64._translatesW&*%:%:>%J%J" x!ZZ1 aHH'*<<8 T-===rc|jj|j}||dd}||jkrt j|j||jr|j dvrd}n |j dkrd}|j }t|j dz }t|j D]\}\}} |||| } t||| |jzz|j|j} d }|jr=|| |d |d} | d | z z}|| dd } ||krF| d kr@||| |jd |jd|jdzz}||kr0| dkr*||| |jd | | zz}ni||krF| d kr@||| |jd |jd|jdzz}nt j|j|| | |jrrt.d t3|dt3|dt3||| dz d dt3| || | fS)zTranslates a virtual offset to a physical one within this segment Returns the translated address, the maximum offset within the block and the page the translated address lives in 7 layer_nameinvalid_addressrp) rr)r%rA) byteorderr4)rr invalid_bitsentryzVirtual z lives in page frame z at offset z with descriptor )r1layersrIrYrOr InvalidAddressExceptionr3rRrQrJlenrT enumeraterN from_bytesread_register_sizerE bit_lengthrVPagedInvalidAddressExceptionrHrhrirc)r]r{ base_layer ttb_selector ta_51_x_bitsr max_levellevelhigh_bitlow_bitrx descriptorta_51_xdescriptor_types rr~zAArch64._translate_entrys \()9: zz."b99  43 3 349 .  ? ( G++% "b((' - 011A5 *3D4L*M*M; ;  &E&HgJJ~xAAE!UT-@%@A4CV1 (J M G** O O !(B1C1C1E1E,E F #jjQ::Oy  _%<%<JJ"1!41!4 03 4 ""$'>'>JJ"1!4   )##4(?(?JJ"1!41!4 03 4 !=#y$2!($   "  LLv3~..vvSEWEWvvdghlhrhrtBDKLMDMOPiQiQeReRvvehisetetvv   gz11rFoffsetlength ignore_errorsc# Kdx}x}x}x}}||||D]B\}} } } } |||z|ks||z| ks|| kr| |||||fV|}| }| }| }| }8|| z }|| z }C||||||||||fVdSdSdSdSdSdS)Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer) mappings. This allows translation layers to provide maps of contiguous regions in one layer N)_mapping) r]rrrstashed_offsetstashed_mapped_offset stashed_sizestashed_mapped_sizestashed_map_layersize mapped_offset mapped_size map_layers rmappingzAArch64.mappingsL   .  @S CG== FMD D  3 3 ?FD-i&"\1V;;),??=PP%22"-(,8MObduuuuu!'(5%# &1#$-!!$ #{2##  &%1(#/!- ,0EGZ\mm m m m m m ' &11((//--rc#DK|dkrz ||\}}}|jj||st j||n#tj$r|sYdSwxYw|||||fVdS|dkr ||\}}}t |||zz |} |jj||| st j|| || || |fV|| z}|| z }n#tjtjf$rm} |st| tjrd| j zdz } n"d|j dz zdz } | dz|| zz } || z}|| z }Yd} ~ nd} ~ wwxYw|dkdSdS)rrrNrA) r_contextris_validr rminr isinstancerrQr) r]rrrrrr chunk_offset page_size chunk_sizeexcpmask length_diffs rrzAArch64._mappingBsS Q;; /3v/F/F, q*}+J7@@OO$<#-}5   $tt &-C C C C4qjj & %6:oof6M6M3 i lY.F!GPP }+J7@@ *%<#-|0j, JNNNN*$*$'72 & & &%dJ$KLLK!22a7DD$"3">">"@"@1"DEJD"Qh&4-8 +%+%! &;qjjjjjjs,AAA54A5 A+D F'A#FFc~|jdkrd}d|jdz z}||dz z}nd}d|jdz z}||dz z }||fS)zVReturns the virtual address space range for the current context (user or kernel space)rrAl)rOrP)r] ttb_startttb_sizettb_ends rrWzAArch64._get_virtual_addr_rangesi  #q ( (IT.23H8a<0GGGT.23H8a<0I7##rrAc tfd||DS#tj$rYdSwxYw)zPReturns whether the address offset can be translated to a valid address.cfg|]-\}}}}}jj||.Sr)rrr)rdrrlayerr]s rrfz$AArch64.is_valid..sK51mQM(/88GGrF)allrr r)r]rrs` rrzAArch64.is_validsu 9=ff9U9U  1   55 s.2AAc^|||dS)z2Returns whether the page at offset is marked dirtyr})_page_is_dirtyr~)r]rs ris_dirtyzAArch64.is_dirtys)""4#8#8#@#@#CDDDrrc&t|dzS)aReturns whether a particular page is dirty based on its entry. The bit indicates that its associated block of memory has been modified and has not been saved to storage yet Hardware management (only > Armv8.1-A) : https://developer.arm.com/documentation/102376/0200/Access-Flag/Dirty-state + [1], see D8.4.6, page 5877 and [1], see D8-16, page 5857 l)bool)rs rrzAArch64._page_is_dirtysEW%&&&rc:|jdz S)zlPage shift for this layer, which is the page size bit length. - Typical values : 12, 14, 16 rA)rrrks r page_shiftzAArch64.page_shifts ~((**Q..rc|jdzS)zYPage size of this layer, in bytes. - Typical values : 4096, 16384, 65536 i)rQrks rrzAArch64.page_sizes  4''rc|jdz S)zPage mask for this layer.rA)rrss r page_maskzAArch64.page_masks"##rc|jS)z[Returns the bits_per_register to determine the range of an AArch64TranslationLayer.)rZrs rbits_per_registerzAArch64.bits_per_registers %%rcdS)Nrrrs rminimum_addresszAArch64.minimum_addresss qrcd|jzdz S)NrA) _maxvirtaddrrs rmaximum_addresszAArch64.maximum_addresssS%%**raddrc|j|jkr ||jzS|d|jdz zkr|S|||jd|jzS)z[Canonicalizes an address by performing an appropiate sign extension on the higher addressesrAr)rZrP address_maskrYr[r]rs r canonicalizezAArch64.canonicalizes_  "d&7 7 7$++ + Q$+a// 0 0Kzz$ 11558NNNrc<|d|jdz zkr|S||jz S)zRemoves canonicalization to ensure an adress fits within the correct range if it has been canonicalized This will produce an address outside the range if the canonicalization is incorrect rA)rPr[rs rdecanonicalizezAArch64.decanonicalizes/ 1)A-- . .Kd,,,rvaluerrshiftcJ||}d|dzzdz }d|zdz }||z }||z|z S)zAReturns the bits of a value between highbit and lowbit inclusive.NrAr)rrrr high_masklow_maskrs rrYz AArch64._masksH =E8a<(A- LA%8# &&rc|jgS)zRReturns a list of the lower layer names that this layer is dependent upon.)rIrks r dependencieszAArch64.dependenciess !!rctjddtjdddtjdddtjd dd tjd dd tjd ddtjdddtjddgdddtjddddtjddddtjdddtjdddg S) Nr:F)r3optionalr;zJDTB of the target context (either "kernel space" or "user space process").)r3r descriptionr<zDTB of the kernel space, it is primarily used to determine the target context of the layer (page_map_offset == page_map_offset_kernel). Conveniently calculated by LinuxStacker.r=zeThe size offset of the memory region addressed by TTBR0_EL1. Conveniently calculated by LinuxStacker.r>zeThe size offset of the memory region addressed by TTBR1_EL1. Conveniently calculated by LinuxStacker.r?zRPage size used by the user address space. Conveniently calculated by LinuxStacker.r@zTPage size used by the kernel address space. Conveniently calculated by LinuxStacker.littlebigr7z!Kernel endianness (little or big))choicesr3rrr8TzLSpecify if debugging informations about the layer should be printed to user.)r3rrdefaultr9zHSpecify if translation debugging informations should be printed to user.kernel_virtual_offsetz ASLR offset kernel_bannerz\Kernel unique identifier, including compiler name and version, kernel version, compile time.)r TranslationLayerRequirementIntRequirementChoiceRequirementBooleanRequirementStringRequirementrs rget_requirementszAArch64.get_requirementss  4#e     '&h     '-O     '#D     '#D     '+p     '-r     *!5)(?      +"j      +(f      ',t     *$z   o< < r)N)r5N)Frw):rrr__doc__ collectionsChainMapr rTranslationLayerInterface_direct_metadatarZr _maxphyaddrrryr1ContextInterfacestrrrrrCr\ classmethodrNrrrUrrSrr~rrrrWrr staticmethodrproperty functools lru_cacherrrr rrrrrrYr configurationRequirementInterfacer __classcell__)r^s@rrr"s ,{+ # 43D '1,NKL > = = 4 4 4 * * *.2 6363#46363 63 4S>* 63  636363636363p"  36 CG s   [ ",/ eCj [$ > >sC}1E > > > >\2s\2uS#s]7K\2\2\2\2~?D*n*n*n#&*n7;*n %S#sC/0 1*n*n*n*nZ?DG%G%G%#&G%7;G% %S#sC/0 1G%G%G%G%R$ s$$$$"  s C     EsEtEEEE 'c 'd ' ' '\ 'Y/C///X/ Y(3(((X( Y$#$$$X$Y&#&&&]& Y]Y++++]+OOOOOO-3-3----HL ' ' '! ',/ '8@  '  ' ' '\ '"d3i"""X" = j&>&S!T= = = [= = = = = rr)loggingrrtypingrrrrrr volatility3r volatility3.frameworkr r #volatility3.framework.configurationr volatility3.framework.layersr getLoggerrrhLayerExceptionrLinearlyMappedLayerrrrrrs+ ================%%%%%%88888888<<<<<<//////  8 $ $      z0   a a a a a f(a a a a a r