
    *1f7                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j        e          Z G d dej                  Z G d	 d
ej                  Z G d dej        j                  ZdS )    N)Optional)
exceptions
interfaces	constants)	ELF_CLASS)	segmented)intermedc                       e Zd ZdZdS )ElfFormatExceptionz@Thrown when an error occurs with the underlying ELF file format.N)__name__
__module____qualname____doc__     R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/elf.pyr   r      s        JJJJr   r   c                        e Zd ZdZ ej        d          ZdZej	        Zde
j        j        dededdf fd	Zdd
Ze	 dde
j        j        dedefd            Z xZS )
Elf64LayerzlA layer that supports the Elf64 format as documented at: http://ftp.openwatcom.org/devel/docs/elf-64-gen.pdfz<IBBBiELFcontextconfig_pathnamereturnNc                     t           j                            ||dd          | _        t	                                          |||           d S )Nlinuxelf)r	   IntermediateSymbolTablecreate_elf_table_namesuper__init__)selfr   r   r   	__class__s       r   r    zElf64Layer.__init__   sM      (?FF['5 
  
 	+t44444r   c           	      @   | j                             | j        t          j        z   dz   | j        d          }g }t          |j                  D ]}| j                             | j        t          j        z   dz   | j        |j        ||j	        z  z             }	 |j
        j        }n=# t          $ r0 t                              t          j        d|j
                    Y w xY w|dk    r||j        |j        k    rl|j        dk    ra|                    t'          |j                  t'          |j                  t'          |j                  t'          |j                  f           t-          |          dk    rt/          | j        d| j                   || _        dS )	zHLoad the segments from based on the PT_LOAD segments of the Elf64 format
Elf64_Ehdrr   )
layer_nameoffset
Elf64_Phdrz*Skipping unknown ELF program header type: PT_LOADzNo ELF segments defined in N)r   objectr   r   BANG_base_layerrangee_phnume_phoffe_phentsizep_typedescription
ValueErrorvolloglogLOGLEVEL_VVVVp_fileszp_memszappendintp_paddrp_offsetlenr   r   	_segments)r!   ehdrsegmentspindexphdrptypes         r   _load_segmentszElf64Layer._load_segments&   s   |"" 9>1L@' # 
 
 DL)) 	 	F<&&$y~5D+|v0@'@A '  D/   

+NNN    ""MT\11MA%% DL))DM**DL))DL))	   x==A$	K9IKK   "s   B&&7C C r   
base_layerr&   c                 z   	 |                     || j        j                  }n-# t          j        $ r t          |j        d|dd          w xY w| j                            |          \  }}}}|| j        k    rt          |j        d|dd|d          || j	        k    rt          |j        d|d          d	S )
Nz	Offset 0x0xz% does not exist within the base layerzBad magic 0xxz at file offset 0xzELF class is not 64-bit (2): dT)
read_header_structsizer   InvalidAddressExceptionr   r   unpackMAGICr   )clsrD   r&   header_datamagic	elf_clasself_data_encodingelf_versions           r   _check_headerzElf64Layer._check_headerV   s
   	$//&#2D2IJJKK1 	 	 	$LFLLLL  	
 >A=O=V=V>
 >
:	,k CI$!U!U!U!U6!U!U!U   %%$!N!N!N!N   ts	    # *A)r   N)r   )r   r   r   r   structStructrJ   rN   r   
ELFCLASS64r   r   ContextInterfacestrr    rC   classmethodlayersDataLayerInterfacer9   boolrU   __classcell__)r"   s   @r   r   r      s        vv"V]7++NE$I5!):5IL5TW5	5 5 5 5 5 5." ." ." ."` MN #*=GJ	   [    r   r   c                   |    e Zd ZdZe	 ddej        j        dede	j
        deej        j                 fd            ZdS )	Elf64Stacker
   Nr   r%   progress_callbackr   c                    	 t                               |j        |                   sd S n@# t          $ r3}t                              t          j        d|            Y d }~d S d }~ww xY w|j                            d          }||j	        t          j                            |d          <   	 t          |||          S # t          $ r3}t                              t          j        d|            Y d }~d S d }~ww xY w)NzException: r   rD   )r   rU   r\   r   r3   r4   r   r5   free_layer_nameconfigr   configuration	path_join)rO   r   r%   rc   excpnew_names         r   stackzElf64Stacker.stacks   s   	++GN:,FGG t! 	 	 	JJy.0Dd0D0DEEE44444	 >11,?? 	z/99(LQQR	gx:::! 	 	 	JJy.0Dd0D0DEEE44444	s,   %* 
A'(A""A'-B> >
C;(C66C;)N)r   r   r   stack_orderr[   r   r   rY   rZ   r   ProgressCallbackr   r\   r]   rk   r   r   r   ra   ra   p   s{        K
 9=	 #4  %5	
 
*#6	7   [  r   ra   )loggingrV   typingr   volatility3.frameworkr   r   r   %volatility3.framework.constants.linuxr   volatility3.framework.layersr   volatility3.framework.symbolsr	   	getLoggerr   r3   LayerExceptionr   SegmentedLayerr   	automagicStackerLayerInterfacera   r   r   r   <module>ry      s8           C C C C C C C C C C ; ; ; ; ; ; 2 2 2 2 2 2 2 2 2 2 2 2 
	8	$	$K K K K K2 K K KX X X X X) X X Xv    :'=     r   