
    *1f)                        d dl Z d dlZd dlZd dlmZmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ  ej        e          Z G d dej                  Z G d	 d
ej                  Z G d de          Z G d de	j        j                  ZdS )    N)TupleOptional)	constants
exceptions
interfaces)	segmented)intermed)crashc                       e Zd ZdZdS )WindowsCrashDumpFormatExceptionzBThrown when an error occurs with the underlying Crash file format.N)__name__
__module____qualname____doc__     T/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/crash.pyr   r      s        LLLLr   r   c            
            e Zd ZdZddiZdZdZdZddgZd	Z	 e
j        d
          ZdZdej        j        dededdf fdZdej        j        fdZdej        j        fdZddZe	 ddej        j        dedeeef         fd            Z xZS )WindowsCrashDump32LayerA Windows crash format TranslationLayer.
    This TranslationLayer supports Microsoft complete memory dump files.
    It currently does not support kernel or small memory dump files.
    typephysicaliPAGEiDUMPr
         _DUMP_HEADERz<IIcontextconfig_pathnamereturnNc                    || _         || _        d| _        | j        d         | _        t
          j                            || j        d| j                  | _	        t
          j                            || j        ddt          j                  | _        | j         j        | j                 }d}|                     ||           |                                 }t!          |j                  | _        t!          |j                  | _        |j        | j        vrGt,                              t0          j        d|j        d           t5          |d|j        d          t7                                          |||           d S )	N   
base_layerwindowscrash_common)class_typesr   unsupported dump format 0xx)_context_config_path
_page_sizeconfig_base_layerr	   IntermediateSymbolTablecreatecrashdump_json_crash_table_namer
   r%   _crash_common_table_namelayerscheck_header
get_headerintDirectoryTableBasedtbDumpType	dump_typesupported_dumptypesvolloglogr   LOGLEVEL_VVVVr   super__init__)selfr   r   r   	hdr_layer
hdr_offsetheader	__class__s          r   r?   z WindowsCrashDump32Layer.__init__'   s|     ' ;|4 "*!A!H!HT&	43F"
 "

 )1(H(O(O) )P )
 )
% M()9:	
)Z000 "" v011V_-- ?$":::JJ'@V_@@@   2F6?FFF  
 	+t44444r   c                 z    | j                             | j        t          j        z   | j        z   d| j                  S )Nr   offset
layer_name)r   objectr0   r   BANGdump_header_namer,   r@   s    r   r4   z"WindowsCrashDump32Layer.get_headerY   s?    |"""Y^3d6KK' # 
 
 	
r   c                     | j                             | j        t          j        z   dz   d| j        z  | j                  S )N_SUMMARY_DUMPr!   rF   )r   rI   r1   r   rJ   headerpagesr,   rL   s    r   get_summary_headerz*WindowsCrashDump32Layer.get_summary_header`   sD    |"")IN:_LD,,' # 
 
 	
r   c           
         g }| j         dk    r| j                            | j        t          j        z   | j        z   d| j                  }| j        }|j	        j
        |j	        j        _        |j	        j        D ]@}|                    |j        dz  |dz  |j        dz  |j        dz  f           ||j        z  }An| j         dk    r`|                                 }d}d}d}|j        }|                                }	|                                }
t)          d|j        dz   dz            D ]}|
|         dk    r7|4|dz
  dz  dz   }||z
  dz   dz  }|                    |dz  |||f           d}n|
|         d	k    r||}|dz  }|d
z   }nit)          dd          D ]X}|dz  |z   }|	|dz	           |dz  z	  dz  r||}|}|dz   }*|,|dz
  |z
  dz   dz  }|                    |dz  |||f           d}Y|dz  dz   }|'||z
  dz   dz  }|                    |dz  |||f           nLt,                              t          j        d| j         d           t3          | j        d| j         d          t7          |          dk    rt3          | j        d| j                   t9          |          D ]E\  }\  }}}}t,                              t          j        d                    ||||                     F|| _        dS )z*Loads up the segments from the meta_layer.r   r   rF   r!   r   N       l    i         r&   r'   zNo Crash segments defined in z4Segment {}: Position {:#x} Offset {:#x} Length {:#x})r9   r   rI   r0   r   rJ   rK   r,   rO   PhysicalMemoryBlockBufferNumberOfRunsRuncountappendBasePage	PageCountrP   
HeaderSizeget_buffer_charget_buffer_longrange
BitmapSizer;   r<   r=   r   r   len	enumerateformat	_segments)r@   segmentsrC   rG   runsummary_header	first_bitfirst_offsetlast_bit_seenbuffer_charbuffer_longouter_indexlast_bitsegment_lengthinner_indexbit_addridxstart_positionmapped_offsetlength_s                        r   _load_segmentsz&WindowsCrashDump32Layer._load_segmentsg   s
    >S  \((&7$:OO+ )  F %F0= ,06 7; 	( 	(v-..	   #-'	( ^t##!4466NILM#.F(88::K(88::K$Q.*Cb*HR)OQQ )8 )8{+q00 ,%01_$:b#@*2Y*>*Bf)L  )F 2 , . .	   %)	 -;; ('-$/"$4	#{3FF',Q|| 1 1#.#3k#A'A68c>JaO 1(0/5,4	%+f_FF(4%-\Y$>$B$*2+ !)(1F(:(4(6(6	%&!" !" !" -1	!,r!1R 7$"/)";a"?6!I'~~V   JJ')Xdn)X)X)X   2	JJJJ   x==A1	M4;KMM   DMXCVCV  ??nmVQ

+JQQ^]F     "r   r   r"   rG   c                 ~   	 |                     || j        j                  }n+# t          j        $ r t          |j        d|           w xY w| j                            |          \  }}|| j        k    rt          |j        d|dd|d          || j	        k    rt          |j        d|dd|d          ||fS )Nz%Crashdump header not found at offset zBad signature 0xr'   z at file offset 0xzInvalid dump 0x)
read_magic_structsizer   InvalidAddressExceptionr   r   unpack	SIGNATURE	VALIDDUMP)clsr"   rG   header_data	signature	validdumps         r   r3   z$WindowsCrashDump32Layer.check_header   s   	$//&#2C2HIIKK1 	 	 	1!Q!Q!Q  	 "%!2!9!9+!F!FI%%1L9LLL&LLL   %%1K)KKKKKK  
 )##s	    # (A)r   N)r   )r   r   r   r   providesr   r   r/   r:   rK   structStructr{   rO   r   r   ContextInterfacestrr?   objectsObjectInterfacer4   rP   rx   classmethodr2   DataLayerInterfacer5   r   r3   __classcell__)rD   s   @r   r   r      sX        
 
#HIIN,%!FM%((MK05!):05IL05TW05	05 05 05 05 05 05d
J.> 
 
 
 

J$6$F 
 
 
 
k" k" k" k"Z MN$ $#*=$GJ$	sCx$ $ $ [$ $ $ $ $r   r   c                   *    e Zd ZdZdZdZdZddgZdZdS )	WindowsCrashDump64Layerr   iDU64crash64_DUMP_HEADER64r   r      N)	r   r   r   r   r   r/   rK   r:   rO   r   r   r   r   r      s9         
 IN'+KKKr   r   c                   |    e Zd ZdZe	 ddej        j        dede	j
        deej        j                 fd            ZdS )	WindowsCrashDumpStacker   Nr   rH   progress_callbackr   c                    t           t          fD ]}	 |                    |j        |                    |j                            |j                  }||j        t          j        	                    |d          <    ||||          c S # t          $ r2}t                              t          j        d|            Y d }~d }~ww xY wd S )Nr"   zException reading crashdump: )r   r   r3   r2   free_layer_namer   r+   r   configuration	path_joinr   r;   r<   r   r=   )r   r   rH   r   layernew_nameexcps          r   stackzWindowsCrashDumpStacker.stack   s     ./FG 	 	E
""7>*#=>>>">99%.II  ,66xNN uWh999992   

+-ST-S-S        ts   A3B
C(B??C)N)r   r   r   stack_orderr   r   r   r   r   r   ProgressCallbackr   r2   r   r   r   r   r   r   r      s{        K
 9=	 #4  %5	
 
*#6	7   [  r   r   )
contextlibloggingr   typingr   r   volatility3.frameworkr   r   r   volatility3.framework.layersr   volatility3.framework.symbolsr	   0volatility3.framework.symbols.windows.extensionsr
   	getLoggerr   r;   LayerExceptionr   SegmentedLayerr   r   	automagicStackerLayerInterfacer   r   r   r   <module>r      ss         " " " " " " " " C C C C C C C C C C 2 2 2 2 2 2 2 2 2 2 2 2 B B B B B B		8	$	$M M M M Mj&? M M MX$ X$ X$ X$ X$i6 X$ X$ X$v
 
 
 
 
5 
 
 
    j2H     r   