
    vf-                     0   d dl Z d dlZd dlZd dlmZmZ d dlmZmZm	Z	 d dl
mZ d dlmZ d dlmZ  ej                   e      Z G d dej&                        Z G d	 d
ej*                        Z G d de      Z G d de	j0                  j2                        Zy)    N)TupleOptional)	constants
exceptions
interfaces)	segmented)intermed)crashc                       e Zd ZdZy)WindowsCrashDumpFormatExceptionzBThrown when an error occurs with the underlying Crash file format.N)__name__
__module____qualname____doc__     T/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/crash.pyr   r      s    Lr   r   c            
       h    e Zd ZdZddiZdZdZdZddgZd	Z	 e
j                  d
      ZdZdej                  j                   dededdf fdZdej&                  j(                  fdZdej&                  j(                  fdZddZe	 ddej2                  j4                  dedeeef   fd       Z xZS )WindowsCrashDump32LayerA Windows crash format TranslationLayer.
    This TranslationLayer supports Microsoft complete memory dump files.
    It currently does not support kernel or small memory dump files.
    typephysicaliPAGEiDUMPr
         _DUMP_HEADERz<IIcontextconfig_pathnamereturnNc                 0   || _         || _        d| _        | j                  d   | _        t
        j                  j                  || j                  d| j                        | _	        t
        j                  j                  || j                  ddt        j                        | _        | j                   j                  | j                     }d}| j                  ||       | j                         }t!        |j"                        | _        t!        |j&                        | _        |j&                  | j*                  vrLt,        j/                  t0        j2                  d|j&                  d       t5        |d|j&                  d      t6        | q  |||       y )	Ni   
base_layerwindowscrash_common)class_typesr   unsupported dump format 0xx)_context_config_path
_page_sizeconfig_base_layerr	   IntermediateSymbolTablecreatecrashdump_json_crash_table_namer
   r$   _crash_common_table_namelayerscheck_header
get_headerintDirectoryTableBasedtbDumpType	dump_typesupported_dumptypesvolloglogr   LOGLEVEL_VVVVr   super__init__)selfr   r   r   	hdr_layer
hdr_offsetheader	__class__s          r   r>   z WindowsCrashDump32Layer.__init__'   sk     ' ;;|4 "*!A!A!H!HT&&	43F3F"

 )1(H(H(O(O)) )P )
% MM(()9)9:	
)Z0 " v001V__- ??$":"::JJ'',V__Q,?@ 226??12EF 
 	+t4r   c                     | j                   j                  | j                  t        j                  z   | j
                  z   d| j                        S )Nr   offset
layer_name)r   objectr/   r   BANGdump_header_namer+   r?   s    r   r3   z"WindowsCrashDump32Layer.get_headerY   sG    ||""""Y^^3d6K6KK'' # 
 	
r   c                     | j                   j                  | j                  t        j                  z   dz   | j
                  | j                  z  | j                        S )N_SUMMARY_DUMPrE   )r   rH   r0   r   rI   r)   headerpagesr+   rK   s    r   get_summary_headerz*WindowsCrashDump32Layer.get_summary_header`   sP    ||""))INN:_L??T%5%55'' # 
 	
r   c           
      >   g }| j                   dk(  r| j                  j                  | j                  t        j
                  z   | j                  z   d| j                        }| j                  }|j                  j                  |j                  j                  _        |j                  j                  D ]x  }|j                  |j                  | j                  z  || j                  z  |j                   | j                  z  |j                   | j                  z  f       ||j                   z  }z n| j                   dk(  r| j#                         }d}d}|j$                  }|j'                         }t)        d|j*                  j                        D ]  }	||	   }
|
dk(  r||}|	dz  }|d| j                  z  z  }n|
dk(  rG||	dz
  dz  dz   }||z
  dz   | j                  z  }|j                  || j                  z  |||f       d}nxt)        dd      D ]i  }|	dz  |z   }|
d|z  z  }|r||}|}|| j                  z  }+|.|dz
  |z
  dz   | j                  z  }|j                  || j                  z  |||f       d}k |	dz  dz   } ||z
  dz   | j                  z  }|j                  || j                  z  |||f       nVt,        j/                  t        j0                  d	| j                   d
       t3        | j4                  d	| j                   d
      t7        |      dk(  r#t3        | j4                  d| j                         t9        |      D ]@  \  }\  }}}}t,        j/                  t        j0                  dj;                  ||||             B || _        y)zaLoads up the segments from the meta_layer.
        A segment is a set of contiguous memory pages.r   r   rE   r   Nl           r%   r&   zNo Crash segments defined in z4Segment {}: Position {:#x} Offset {:#x} Length {:#x})r8   r   rH   r/   r   rI   rJ   r+   rN   PhysicalMemoryBlockBufferNumberOfRunsRuncountappendBasePager)   	PageCountrO   
HeaderSizeget_buffer_longrangevolr:   r;   r<   r   r   len	enumerateformat	_segments)r?   segmentsrB   rF   runsummary_headerseg_first_bitseg_first_offsetulong_bitmap_arrayouter_indexulong_bitmaplast_bitsegment_lengthinner_bit_positioncurrent_bitpage_mappedlast_bit_seenidxstart_positionmapped_offsetlength_s                         r   _load_segmentsz&WindowsCrashDump32Layer._load_segmentsg   s    >>S \\((&&7$:O:OO++ ) F %%F00== ,,006 77;; 	(t6077	 #--'	( ^^t#!446N M ))  "0!?!?!A  %Q(:(>(>(D(DE 461+>:-$,+1((3b(8b4??22F!Q&$0$/!Or#9B#>$}4q8 OO*, ! - ? 0 . .	 )- /4Arl 5*&1B&69K&K&2a;M6M&N&,439 00;"doo5F  -8$/!Om$Ca$G$(OO24 !)(5(G(8(6(6	%&!" 15/50 !,b 02 5i46l ("/-"?!"Ct!V%7(&&	 JJ''+EdnnUVEW)X 2		7q7IJ  x=A1		:4;K;K:LM  DMXCV ??nmVQ

++JQQ^]F "r   r!   rF   c                    	 |j                  || j                  j                        }| j                  j                  |      \  }}|| j                  k7  rt        |j                  d|dd|d      || j                  k7  rt        |j                  d|dd|d      ||fS # t        j                  $ r t        |j                  d|       w xY w)Nz%Crashdump header not found at offset zBad signature 0xr&   z at file offset 0xzInvalid dump 0x)
read_magic_structsizer   InvalidAddressExceptionr   r   unpack	SIGNATURE	VALIDDUMP)clsr!   rF   header_data	signature	validdumps         r   r2   z$WindowsCrashDump32Layer.check_header   s    	$//&#2C2C2H2HIK
 "%!2!2!9!9+!FI%1"9Q-/A&L  %1!)A.@
K 
 )### 11 	1#H!Q 	s   &B$ $-C)r   N)r   )r   r   r   r   providesr|   r}   r.   r9   rJ   structStructrx   rN   r   r   ContextInterfacestrr>   objectsObjectInterfacer3   rO   ru   classmethodr1   DataLayerInterfacer4   r   r2   __classcell__)rC   s   @r   r   r      s    
 
#HIIN,%!FMM%(MK05!))::05IL05TW05	05d
J..>> 

J$6$6$F$F 
}"~ MN$#**==$GJ$	sCx$ $r   r   c                   (    e Zd ZdZdZdZdZddgZdZy)	WindowsCrashDump64Layerr   iDU64crash64_DUMP_HEADER64r   r      N)	r   r   r   r   r}   r.   rJ   r9   rN   r   r   r   r   r     s(    
 IN'+Kr   r   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	WindowsCrashDumpStacker   Nr   rG   progress_callbackr   c                    t         t        fD ]~  }	 |j                  |j                  |          |j                  j	                  |j
                        }||j                  t        j                  j                  |d      <    ||||      c S  y # t        $ r1}t        j                  t        j                  d|        Y d }~d }~ww xY w)Nr!   zException reading crashdump: )r   r   r2   r1   free_layer_namer   r*   r   configuration	path_joinr   r:   r;   r   r<   )r~   r   rG   r   layernew_nameexcps          r   stackzWindowsCrashDumpStacker.stack  s     ./FG 	E
""7>>*#=>">>99%..I  ,,66xN Wh99	 	 3 

++/LTF-S s   A9B	C	'CC	)N)r   r   r   stack_orderr   r   r   r   r   r   ProgressCallbackr   r1   r   r   r   r   r   r   r     sg    K
 9=	##44  %55	
 
*##66	7 r   r   )
contextlibloggingr   typingr   r   volatility3.frameworkr   r   r   volatility3.framework.layersr   volatility3.framework.symbolsr	   0volatility3.framework.symbols.windows.extensionsr
   	getLoggerr   r:   LayerExceptionr   SegmentedLayerr   r   	automagicStackerLayerInterfacer   r   r   r   <module>r      s       " C C 2 2 B			8	$Mj&?&? Mj$i66 j$Z
5 
j22HH r   