
    Xf!                        d Z ddlZddlZddlZddlmZmZmZ ddlm	Z	m
Z
mZ ddlmZ  ej                  e      Z	 	 ej"                  j%                  d      Z	 esej"                  j%                  d      Z	 esej"                  j%                  d      Zesej"                  j%                  d	      Zej*                  Zej.                  Zd
Z G d de	j6                        Zd Z G d dej<                        Z G d de
j@                  jB                        Z"y# e$ r dZY w xY w# e$ r dZY w xY w# e$ r dZY w xY w# eef$ r dZY w xY w)zFunctions that read AVML files.

The user of the file doesn't have to worry about the compression,
but random access is not allowed.    N)TupleListOptional)
exceptions
interfaces	constants)	segmentedzlibsnappy.so.1zlibsnappy.1.dylibsnappy64snappy32TFc                       e Zd Zy)SnappyExceptionN)__name__
__module____qualname__     S/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/avml.pyr   r   5   s    r   r   c                 t   t        j                  d      }t        | t        |       t        j                  |            }|dk7  rt        d|       t        j                  |j                        }t        | t        |       |t        j                  |            }|dk7  rt        d|       |j                  S )z&Uncompress a snappy compressed string.r   z%Error in snappy_uncompressed_length: zError in snappy_uncompress: )
ctypesc_int__snappy_uncompressed_lengthlenbyrefr   create_string_buffervalue__snappy_uncompressraw)sulencresultubufs       r   
uncompressr"   9   s    <<?D*1c!ffll46HIG!| EgYOPP&&tzz2D!!SVT6<<3EFG!| <WIFGG88Or   c                        e Zd ZdZ fdZedej                  j                  fd       Z	ddZ
dededeeeeeeeef      ef   fd	Zded
edededef
dZ xZS )	AVMLLayerzA Lime format TranslationLayer.

    Lime is generally used to store physical memory images where there
    are large holes in the physical layer
    c                 2    i | _         t        |   |i | y N)_compressedsuper__init__)selfargskwargs	__class__s      r   r)   zAVMLLayer.__init__M   s    $)&)r   layerc           	      0   d}t        j                  ||j                  |j                  t        j                  |                  \  }}|dvs|dk7  rt        j                  d      t        s*t        j                  d       t        j                  d      y )Nz<IIiAVML   zFile not in AVML formatzAVML file detected, but snappy library could not be found
Please install the snappy from your distribution or https://google.github.io/snappy/.z/AVML format dependencies not satisfied (snappy))
structunpackreadminimum_addresscalcsizer   LayerException
HAS_SNAPPYvollogwarning)clsr.   header_structuremagicversions        r   _check_headerzAVMLLayer._check_headerQ   s     JJu,,foo>N.OP
w $1++,EFFNNh ++A  r   returnc           	         | j                   j                  | j                     }|j                  }|dz   |j                  k  rd}t        j                  |      }|j                  ||      }t        j                  ||      \  }}}}	}
|dvs|dk7  rt        j                  d      |j                  ||z   t        |	|z
  |j                  ||z   z
              }| j                  ||	|z
        \  }}|D ]E  \  }}}}}| j                  j                  ||z   ||z   |z   ||f       || j                  ||z   |z   <   G |||z   dz   z  }|dz   |j                  k  ry y )N   z<IIQQQr0   r1   z"File not completely in AVML format   )contextlayers_base_layerr5   maximum_addressr2   r6   r4   r3   r   r7   min_read_snappy_frames	_segmentsappendr'   )r*   
base_layeroffsetavml_header_structureavml_header_sizeavml_header_datar=   r>   startendpadding
chunk_datasegmentsconsumedthingmapped_offsetsizemapped_size
compresseds                      r   _load_segmentszAVMLLayer._load_segmentsc   s   \\(()9)9:
++qj:555$,!%/DE)v7GH28--%'73/E7E3 L(GqL //0TUU#))%K..&;K2KLJ "&!9!9*cEk!RHhGO 	YC}dK%%.1AA#	 OY  -!7:J!JK	Y &1A55F? qj:555r   dataexpected_lengthc                 6   g }d}d}d}d}t        j                  |      }||k  r||z   t        |      k  r||||z    }	t        j                  d|	      d   }
|
dz  |
dz	  }}|dk(  r|||z   ||z   |z    dk7  rt	        d|       |dv rW||z   }|||z   ||z    }|dk(  rt        |      }|j                  |||z   t        |      ||z
  |dk(  f       |t        |      z  }n)|t        d	d
      v rt        j                  d| d|       |||z   z  }||k  r||fS )ae  
        Reads a framed-format snappy stream

        Args:
            data: The stream to read
            expected_length: How big the decompressed stream is expected to be (termination limit)

        Returns:
            (offset, mapped_offset, length, mapped_length, compressed) relative to the data chunk (ie, not relative to the file start)
        r   rB   z<L   rC   s   sNaPpYz!Snappy header missing at offset: )r      r1      zUnskippable chunk of type z found: )
r2   r6   r   r3   
ValueErrorr"   rK   ranger   r7   )r*   r]   r^   rU   decompressed_lenrM   crc_lenframe_header_structframe_header_lenframe_headerframe_header_val
frame_type
frame_sizemapped_start
frame_datas                  r   rI   zAVMLLayer._read_snappy_frames   s    "!??+>?/1((3t94#FV6F-FG#)==|#DQ#G )9D)@BRVWBWJ
%"./17.2/(2) %% )+LVH)UVV</#),<#<L!%$w.
1J"J "T)%/
%;
OO,(72
O&0&$. %J7$5d#33$334ZLQ  *Z77U /1V r   rX   rM   output_lengthc                     | j                  |      \  }}}}| j                  |   rt        |      }n|}|||z
  d  }|d | }|S r&   )_find_segmentr'   r"   )r*   r]   rX   rM   ro   start_offset_decoded_datas           r   _decode_datazAVMLLayer._decode_data   s^     !% 2 26 :aAM*%d+LL#F\$9$;<#N]3r   )r@   N)r   r   r   __doc__r)   classmethodr   rE   DataLayerInterfacer?   r\   bytesintr   r   boolrI   ru   __classcell__)r-   s   @r   r$   r$   F   s    * *"3"3"F"F  ""6H> > ,/> 	tE#sCd234c9	:> @

*-
7:
KN
	
r   r$   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	AVMLStacker
   NrD   
layer_nameprogress_callbackr@   c                 $   	 t         j                  |j                  |          |j                  j                  d      }||j                  t        j                  j                  |d      <   t        |||      S # t        j                  $ r Y y w xY w)Nr$   rL   )
r$   r?   rE   r   r7   free_layer_nameconfigr   configuration	path_join)r;   rD   r   r   new_names        r   stackzAVMLStacker.stack   s    	##GNN:$>? >>11+> 	z//99(LQR (H55 (( 		s   "A9 9BBr&   )r   r   r   stack_orderrw   r   rD   ContextInterfacestrr   ProgressCallbackr   rE   rx   r   r   r   r   r~   r~      sg    K
 9=	6##446 6 %55	6
 
*##66	76 6r   r~   )#rv   r   loggingr2   typingr   r   r   volatility3.frameworkr   r   r   volatility3.framework.layersr	   	getLoggerr   r9   cdllLoadLibrary
lib_snappyOSErrorsnappy_uncompressr   snappy_uncompressed_lengthr   r8   AttributeErrorVolatilityExceptionr   r"   NonLinearlySegmentedLayerr$   	automagicStackerLayerInterfacer~   r   r   r   <module>r      sc  
%    ( ( C C 2			8	$[[,,-=>
001DEJ00<J [[,,Z8
$66#-#H#H J
	j44 	
K	33 K\6*&&<< 6y  
  
  
 	  Jsk   D D% 7D2 7D? D"D? !D""D? %D/,D? .D//D? 2D<9D? ;D<<D? ?	E
E