
    *1f7                        d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j                  e      Z G d dej"                        Z G d	 d
ej&                        Z G d dej*                  j,                        Zy)    N)Optional)
exceptions
interfaces	constants)	ELF_CLASS)	segmented)intermedc                       e Zd ZdZy)ElfFormatExceptionz@Thrown when an error occurs with the underlying ELF file format.N)__name__
__module____qualname____doc__     R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/elf.pyr   r      s    Jr   r   c                        e Zd ZdZ ej
                  d      ZdZej                  Zde
j                  j                  dededdf fd	Zdd
Ze	 dde
j"                  j$                  dedefd       Z xZS )
Elf64LayerzlA layer that supports the Elf64 format as documented at: http://ftp.openwatcom.org/devel/docs/elf-64-gen.pdfz<IBBBiELFcontextconfig_pathnamereturnNc                 v    t         j                  j                  ||dd      | _        t        |   |||       y )Nlinuxelf)r	   IntermediateSymbolTablecreate_elf_table_namesuper__init__)selfr   r   r   	__class__s       r   r    zElf64Layer.__init__   s:      (??FF['5 
 	+t4r   c           	         | j                   j                  | j                  t        j                  z   dz   | j
                  d      }g }t        |j                        D ]  }| j                   j                  | j                  t        j                  z   dz   | j
                  |j                  ||j                  z  z         }	 |j                  j                  }|dk(  s|j                   |j"                  k(  s|j                   dkD  s|j%                  t'        |j(                        t'        |j*                        t'        |j"                        t'        |j"                        f        t-        |      dk(  r#t/        | j0                  d| j
                         || _        y# t        $ r5 t        j                  t        j                  d|j                          Y w xY w)	zHLoad the segments from based on the PT_LOAD segments of the Elf64 format
Elf64_Ehdrr   )
layer_nameoffset
Elf64_Phdrz*Skipping unknown ELF program header type: PT_LOADzNo ELF segments defined in N)r   objectr   r   BANG_base_layerrangee_phnume_phoffe_phentsizep_typedescription
ValueErrorvolloglogLOGLEVEL_VVVVp_fileszp_memszappendintp_paddrp_offsetlenr   r   	_segments)r!   ehdrsegmentspindexphdrptypes         r   _load_segmentszElf64Layer._load_segments&   s   ||""  9>>1L@'' # 
 DLL) 	F<<&&$$y~~5D++||v0@0@'@A ' D// "MMT\\1MMA% DLL)DMM*DLL)DLL)	-	> x=A$		89I9I8JK  "7  

++@N s   F&&:G$#G$
base_layerr&   c                    	 |j                  || j                  j                        }| j                  j                  |      \  }}}}|| j                  k7  rt        |j                  d|dd|d      || j                  k7  rt        |j                  d|d      y	# t        j                  $ r t        |j                  d|dd      w xY w)
Nz	Offset 0x0xz% does not exist within the base layerzBad magic 0xxz at file offset 0xzELF class is not 64-bit (2): dT)
read_header_structsizer   InvalidAddressExceptionr   r   unpackMAGICr   )clsrD   r&   header_datamagic	elf_clasself_data_encodingelf_versions           r   _check_headerzElf64Layer._check_headerV   s    	$//&#2D2D2I2IJK >A=O=O=V=V>
:	,k CII$<ay8J6RS*!U  %$#@1!N  # 11 	$F2;&KL 	s   &B /C)r   N)r   )r   r   r   r   structStructrJ   rN   r   
ELFCLASS64r   r   ContextInterfacestrr    rC   classmethodlayersDataLayerInterfacer9   boolrU   __classcell__)r"   s   @r   r   r      s    v"V]]7+NE$$I5!))::5IL5TW5	5."` MN#**==GJ	 r   r   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	Elf64Stacker
   Nr   r%   progress_callbackr   c                    	 t         j                  |j                  |         sy 	 |j                  j                  d      }||j                  t        j                  j                  |d      <   	 t        |||      S # t        $ r1}t        j                  t        j                  d|        Y d }~y d }~ww xY w# t        $ r1}t        j                  t        j                  d|        Y d }~y d }~ww xY w)NzException: r   rD   )r   rU   r\   r   r3   r4   r   r5   free_layer_nameconfigr   configuration	path_join)rO   r   r%   rc   excpnew_names         r   stackzElf64Stacker.stacks   s    	++GNN:,FG H
 >>11,? 	z//99(LQR	gx:: " 	JJy..+dV0DE	 " 	JJy..+dV0DE	s/   "A< /B9 <	B6'B11B69	C3'C..C3)N)r   r   r   stack_orderr[   r   r   rY   rZ   r   ProgressCallbackr   r\   r]   rk   r   r   r   ra   ra   p   sg    K
 9=	##44  %55	
 
*##66	7 r   ra   )loggingrV   typingr   volatility3.frameworkr   r   r   %volatility3.framework.constants.linuxr   volatility3.framework.layersr   volatility3.framework.symbolsr	   	getLoggerr   r3   LayerExceptionr   SegmentedLayerr   	automagicStackerLayerInterfacera   r   r   r   <module>ry      st       C C ; 2 2 
		8	$K22 KX)) Xv:''== r   