
    Xf!                     p   d Z ddlZddlZddlZddlmZmZmZ ddlm	Z	m
Z
mZ ddlmZ  ej        e          Z	 	 ej                            d          Zn# e$ r dZY nw xY w	 esej                            d          Zn# e$ r dZY nw xY w	 esej                            d          Zn# e$ r dZY nw xY wesej                            d	          Zej        Zej        Zd
Zn# eef$ r dZY nw xY w G d de	j                  Zd Z G d dej                  Z G d de
j         j!                  Z"dS )zFunctions that read AVML files.

The user of the file doesn't have to worry about the compression,
but random access is not allowed.    N)TupleListOptional)
exceptions
interfaces	constants)	segmentedzlibsnappy.so.1zlibsnappy.1.dylibsnappy64snappy32TFc                       e Zd ZdS )SnappyExceptionN)__name__
__module____qualname__     S/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/avml.pyr   r   5   s        Dr   r   c                    t          j        d          }t          | t          |           t          j        |                    }|dk    rt          d|           t          j        |j                  }t          | t          |           |t          j        |                    }|dk    rt          d|           |j	        S )z&Uncompress a snappy compressed string.r   z%Error in snappy_uncompressed_length: zError in snappy_uncompress: )
ctypesc_int__snappy_uncompressed_lengthlenbyrefr   create_string_buffervalue__snappy_uncompressraw)sulencresultubufs       r   
uncompressr"   9   s    <??D*1c!fffl46H6HIIG!||OgOOPPP&tz22D!!SVVT6<3E3EFFG!||FWFFGGG8Or   c                        e Zd ZdZ fdZedej        j        fd            Z	ddZ
ded	edeeeeeeeef                  ef         fd
Zdededededef
dZ xZS )	AVMLLayerzA Lime format TranslationLayer.

    Lime is generally used to store physical memory images where there
    are large holes in the physical layer
    c                 H    i | _          t                      j        |i | d S N)_compressedsuper__init__)selfargskwargs	__class__s      r   r)   zAVMLLayer.__init__M   s-    $)&)))))r   layerc           	      6   d}t          j        ||                    |j        t          j        |                              \  }}|dvs|dk    rt          j        d          t          s.t          	                    d           t          j        d          d S )Nz<IIiAVML   zFile not in AVML formatzAVML file detected, but snappy library could not be found
Please install the snappy from your distribution or https://google.github.io/snappy/.z/AVML format dependencies not satisfied (snappy))
structunpackreadminimum_addresscalcsizer   LayerException
HAS_SNAPPYvollogwarning)clsr.   header_structuremagicversions        r   _check_headerzAVMLLayer._check_headerQ   s     JJu,fo>N.O.OPP
 
w $$1+,EFFF 	NNh   +A  	 	r   returnNc           	         | j         j        | j                 }|j        }|dz   |j        k     rd}t          j        |          }|                    ||          }t          j        ||          \  }}}}	}
|dvs|dk    rt          j
        d          |                    ||z   t          |	|z
  |j        ||z   z
                      }|                     ||	|z
            \  }}|D ]?\  }}}}}| j                            ||z   ||z   |z   ||f           || j        ||z   |z   <   @|||z   dz   z  }|dz   |j        k     d S d S )N   z<IIQQQr0   r1   z"File not completely in AVML format   )contextlayers_base_layerr5   maximum_addressr2   r6   r4   r3   r   r7   min_read_snappy_frames	_segmentsappendr'   )r*   
base_layeroffsetavml_header_structureavml_header_sizeavml_header_datar=   r>   startendpadding
chunk_datasegmentsconsumedthingmapped_offsetsizemapped_size
compresseds                      r   _load_segmentszAVMLLayer._load_segmentsc   s   \()9:
+qj:555$,!%/DEE)v7GHH28-%'73 3/E7E3 L((GqLL /0TUUU#))%K.&;K2KL  J "&!9!9*cEk!R!RHhGO 	Y 	YC}dK%%.1AA#	   OY -!7:J!JKK &1A55F? qj:5555555r   dataexpected_lengthc                    g }d}d}d}d}t          j        |          }||k    r&||z   t          |          k     r||||z            }	t          j        d|	          d         }
|
dz  |
dz	  }}|dk    r*|||z   ||z   |z            dk    rt	          d|           n|dv rn||z   }|||z   ||z            }|dk    rt          |          }|                    |||z   t          |          ||z
  |dk    f           |t          |          z  }n,|t          d	d
          v rt          j	        d| d|           |||z   z  }||k    &||fS )ae  
        Reads a framed-format snappy stream

        Args:
            data: The stream to read
            expected_length: How big the decompressed stream is expected to be (termination limit)

        Returns:
            (offset, mapped_offset, length, mapped_length, compressed) relative to the data chunk (ie, not relative to the file start)
        r   rB   z<L   rC   s   sNaPpYz!Snappy header missing at offset: )r      r1      zUnskippable chunk of type z found: )
r2   r6   r   r3   
ValueErrorr"   rK   ranger   r7   )r*   r]   r^   rU   decompressed_lenrM   crc_lenframe_header_structframe_header_lenframe_headerframe_header_val
frame_type
frame_sizemapped_start
frame_datas                  r   rI   zAVMLLayer._read_snappy_frames   s    "!?+>??/11((3t9944#FV6F-F$FG#)=|#D#DQ#G )9D)@BRVWBWJ
%%"./17.2/(2)) %% % ))UV)U)UVVV%  <//#),<#<L!%$w.
1JJ"J "T))%/
%;%;
OO,(72
OO&0&$.   %J7$$5d#3#333$3QZQQQQ   *Z77U /11V r   rX   rM   output_lengthc                     |                      |          \  }}}}| j        |         rt          |          }n|}|||z
  d          }|d |         }|S r&   )_find_segmentr'   r"   )r*   r]   rX   rM   ro   start_offset_decoded_datas           r   _decode_datazAVMLLayer._decode_data   sm     !% 2 26 : :aAM* 	 %d++LLL#F\$9$;$;<#N]N3r   )r@   N)r   r   r   __doc__r)   classmethodr   rE   DataLayerInterfacer?   r\   bytesintr   r   boolrI   ru   __classcell__)r-   s   @r   r$   r$   F   s        * * * * * *"3"F    [""6 "6 "6 "6H> > ,/> 	tE#sCd234c9	:>  >  >  > @

*-
7:
KN
	
 
 
 
 
 
 
 
r   r$   c                   |    e Zd ZdZe	 ddej        j        dede	j
        deej        j                 fd            ZdS )	AVMLStacker
   NrD   
layer_nameprogress_callbackr@   c                 "   	 t                               |j        |                    n# t          j        $ r Y d S w xY w|j                            d          }||j        t          j        	                    |d          <   t          |||          S )Nr$   rL   )
r$   r?   rE   r   r7   free_layer_nameconfigr   configuration	path_join)r;   rD   r   r   new_names        r   stackzAVMLStacker.stack   s    	##GN:$>????( 	 	 	44	>11+>> 	z/99(LQQR (H555s   %( ;;r&   )r   r   r   stack_orderrw   r   rD   ContextInterfacestrr   ProgressCallbackr   rE   rx   r   r   r   r   r~   r~      s{        K
 9=	6 6#46 6 %5	6
 
*#6	76 6 6 [6 6 6r   r~   )#rv   r   loggingr2   typingr   r   r   volatility3.frameworkr   r   r   volatility3.framework.layersr	   	getLoggerr   r9   cdllLoadLibrary
lib_snappyOSErrorsnappy_uncompressr   snappy_uncompressed_lengthr   r8   AttributeErrorVolatilityExceptionr   r"   NonLinearlySegmentedLayerr$   	automagicStackerLayerInterfacer~   r   r   r   <module>r      so  
% %    ( ( ( ( ( ( ( ( ( ( C C C C C C C C C C 2 2 2 2 2 2		8	$	$[,,-=>>

   


 	F001DEEJ   


 	=00<<J   


  9[,,Z88
$6#-#H JJ    JJJ	 	 	 	 	j4 	 	 	
 
 
K K K K K	3 K K K\6 6 6 6 6*&< 6 6 6 6 6sw   A C& A C& A  C& $B  C& BC& 
BC& B, +C& ,B63C& 5B66/C& &	C21C2