
    *1fJ                     ~   d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	m
Z
mZ d dlmZ d dlmZmZmZ d dlmZ d dlmZ  ej        e          ZdZ G d d	ej                  Z G d
 de          Z G d de          Z G d de          Z G d dee          Z G d dee          Z  G d dee          Z!dS )    N)AnyDictIterableListOptionalTuple)classproperty)
exceptions
interfaces	constants)requirements)linearFc                       e Zd ZdZdZdZdZdZeZddgZ	 e
j        ddid	d
iej        j        j                  Z	 d3dej        j        dededeeeef                  ddf
 fdZe ej                    defd                        Ze ej                    defd                        Ze ej                    defd                        Ze ej                    defd                        Ze ej                    defd                        Ze ej                    defd                        Z ede!e"eee#f                  fd            Z$e%dedededefd            Z&e%dede#fd            Z'e%dede#fd            Z(d edefd!Z)d edefd"Z*d#ede"eeef         fd$Z+d#ede"eef         fd%Z, ej        d&          d'edee-         fd(            Z.d4d#ed*ede#fd+Z/d#ede#fd,Z0	 d5d#ed*ed.e#de1e"eeeeef                  fd/Z2	 d5d#ed*ed.e#de1e"eeeeef                  fd0Z3e4de!e         fd1            Z5e6de!ej7        j8                 fd2            Z9 xZ:S )6Intelz4Translation Layer for the Intel IA32 memory mapping.z<I       )page directory
   F)
page tabler   TarchitectureIntel32mappedTNcontextconfig_pathnamemetadatareturnc           	         t                                          ||||           | j        d         | _        g | _        | j        d         | _        t          | j        | j                  dz
  | _	        | 
                    | j        | j	        d          dz  | _        t          j        | j                  | _        | j        | j        z  | _        | 
                    d| j        z  dz
  | j        | j                  | _        t'          t)          j        t)          j        t          j        | j                                                | _        d S )N)r   r   r   r   memory_layerpage_map_offset   r   )super__init__config_base_layer_swap_layers_page_map_offsetmin_maxvirtaddr_bits_per_register_initial_position_mask_initial_entrystructcalcsize_entry_format_entry_size	page_size_entry_number_canonical_prefixintmathceillog2_index_shift)selfr   r   r   r   	__class__s        T/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/intel.pyr#   zIntel.__init__&   s7    	4( 	 	
 	
 	
  ;~6') $,= > "%T%68O!P!PST!TJJt,d.DaHH3N 	 "?4+=>>!^t/??!%$))Q.#"
 "
  Idi0B C CDDEE
 
    c                     | j         S )z'Page shift for the intel memory layers._page_size_in_bitsclss    r<   
page_shiftzIntel.page_shiftF   s     %%r=   c                     d| j         z  S )zaPage size for the intel memory layers.

        All Intel layers work on 4096 byte pages
        r!   r?   rA   s    r<   r2   zIntel.page_sizeL   s     C***r=   c                     | j         dz
   S )z&Page mask for the intel memory layers.r!   )r2   rA   s    r<   	page_maskzIntel.page_maskU   s     "##r=   c                     | j         S )zYReturns the bits_per_register to determine the range of an
        IntelTranslationLayer.)r*   rA   s    r<   bits_per_registerzIntel.bits_per_register[   s    
 %%r=   c                     dS )Nr    rA   s    r<   minimum_addresszIntel.minimum_addressb   s	     qr=   c                     d| j         z  dz
  S )Nr!   )r)   rA   s    r<   maximum_addresszIntel.maximum_addressg   s     S%%**r=   c                     | j         S N)
_structurerA   s    r<   	structurezIntel.structurel   s
    ~r=   valuehigh_bitlow_bitc                 <    d|dz   z  dz
  }d|z  dz
  }||z  }| |z  S )zAReturns the bits of a value between highbit and lowbit inclusive.r!   rJ   )rR   rS   rT   	high_masklow_maskmasks         r<   r,   zIntel._maskp   s9     8a<(A-	LA%8#t|r=   entryc                 &    t          | dz            S )z>Returns whether a particular page is valid based on its entry.r!   boolrY   s    r<   _page_is_validzIntel._page_is_validy   s     EAIr=   c                 &    t          | dz            S )z>Returns whether a particular page is dirty based on its entry.@   r[   r]   s    r<   _page_is_dirtyzIntel._page_is_dirty~   s     EV$%%%r=   addrc                     | j         | j        k    r
|| j        z  S |d| j        dz
  z  k     r|S |                     || j        d          | j        z   S )z[Canonicalizes an address by performing an appropiate sign extension on the higher addressesr!   r   )r*   r)   address_maskr,   r4   r:   rb   s     r<   canonicalizezIntel.canonicalize   s_    "d&777$+++Q$+a//00Kzz$ 11558NNNr=   c                 <    |d| j         dz
  z  k     r|S || j        z  S )zRemoves canonicalization to ensure an adress fits within the correct range if it has been canonicalized

        This will produce an address outside the range if the canonicalization is incorrect
        r!   )r)   r4   re   s     r<   decanonicalizezIntel.decanonicalize   s/    
 1)A--..Kd,,,r=   offsetc           
      R   |                      |          \  }}|                     |          s1t          j        | j        ||dz   |dt          |           d          |                     || j        dz
  |dz             |                     ||d          z  }|d|dz   z  | j        fS )zTranslates a specific offset based on paging tables.

        Returns the translated offset, the contiguous pagesize that the
        translated address lives in and the layer_name that the address
        lives in
        r!   Page Fault at entry z in page entryr   )	_translate_entryr^   r
   PagedInvalidAddressExceptionr   hexr,   _maxphyaddrr%   )r:   ri   rY   positionpages        r<   
_translatezIntel._translate   s     //77x ""5)) 	9	1As5zzAAA   zz%!1A!5x!|DDtzzHaH
 H
 
 Q8a<($*:::r=   c                 X   | j         }| j        }| j        |cxk    r| j        k    r3n n0t	          j        | j        ||dz   |dt          |          z             | j        D ]\  }}}| 	                    |          s6t	          j        | j        ||dz   |dt          |          z   dz   |z             |r|dz  r|dz  r|dz  } nb|}||z  }| 
                    |||dz             |dz   z	  }| 
                    || j        dz
  || j        z             }	|                     |	          }
|
6t	          j        | j        ||dz   |dt          |          z   dz   |z             |
|| j        z  || j        z  | j        z            }t          rt                               t$          j        d                    t          |          t          |          t          t+          j        | j        |          d	                   |                     t+          j        | j        |          \  }||fS )
ziTranslates a specific offset based on paging tables.

        Returns the translated entry value
        r!   z%Entry outside virtual address range: rk   z
 in table    i   Nz(Entry {} at index {} gives data {} as {}r   )r+   r-   rK   rM   r
   rm   r   rn   rP   r^   r,   ro   r9   _get_valid_tabler1   INTEL_TRANSLATION_DEBUGGINGvolloglogr   LOGLEVEL_VVVVformatr.   unpackr0   )r:   ri   rp   rY   r   size
large_pagestartindexbase_addresstable
entry_datas               r<   rl   zIntel._translate_entry   s    )#&????4+??????9	17#e**D   '+o 8	E 8	E"D$
&&u--  =IqL*SZZ7,FM    u/ G$ %W$E EHJJvuhl;;1ME  ::t'!+TD4E-E L )),77E} =IqL*SZZ7,FM   $++9J0J"0# #J
 + 	

+>EEE

E

FM$*<jII!LMM	    }T%7DDHUUhr=   i  r   c                     | j         j                            | j        || j                  }||d| j                 | j        z  k    rdS |S )z>Extracts the table, validates it and returns it if it's valid.N)_contextlayersreadr%   r2   r1   r3   )r:   r   r   s      r<   ru   zIntel._get_valid_table   sW     $))lDN
 

 E,D,,-0BBBB4r=   r!   lengthc                      	 t           fd                     ||          D                       S # t          j        $ r Y dS w xY w)zPReturns whether the address offset can be translated to a valid
        address.c                 f    g | ]-\  }}}}}j         j        |                             |          .S rJ   )r   r   is_valid).0_mapped_offsetlayerr:   s       r<   
<listcomp>z"Intel.is_valid.<locals>.<listcomp>  sK       51mQ M(/88GG  r=   F)allmappingr
   InvalidAddressException)r:   ri   r   s   `  r<   r   zIntel.is_valid	  su    		   9=ff9U9U     1 	 	 	55	s   .2 AAc                 ^    |                      |                     |          d                   S )z2Returns whether the page at offset is marked dirtyr   )ra   rl   r:   ri   s     r<   is_dirtyzIntel.is_dirty  s)    ""4#8#8#@#@#CDDDr=   Fignore_errorsc              #     K   dx}x}x}x}}|                      |||          D ]B\  }}	}
}}|||z   |k    s||z   |
k    s||k    r|	|||||fV  |}|
}|	}|}|}8||	z  }||z  }C||||||||||fV  dS dS dS dS dS dS )Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer)
        mappings.

        This allows translation layers to provide maps of contiguous
        regions in one layer
        N)_mapping)r:   ri   r   r   stashed_offsetstashed_mapped_offsetstashed_sizestashed_mapped_sizestashed_map_layerr|   r   mapped_size	map_layers                r<   r   zIntel.mapping  sL      	 	. 	 	@SCG==FMD
 D
 	3 	3?FD-i &"\1V;;),??=PP%22 "-(,8MObduuuuu!'(5%#&1#$-!! $#{2## &%1(#/!- ,0EGZ\mmmmmmm '&11((//--r=   c              #     K   |dk    rz	 |                      |          \  }}}| j        j        |                             |          st	          j        ||          n# t          j        $ r |s Y dS w xY w|||||fV  dS |dk    r	 |                      |          \  }}}t          |||z  z
  |          }	| j        j        |                             ||	          st	          j        ||          	 ||	||	|fV  ||	z  }||	z  }nu# t          j        t          j        f$ rW}
|s t          |
t          j                  rd|
j	        z  dz
  }nd| j
        z  dz
  }|dz   ||z  z
  }||z  }||z  }Y d}
~
nd}
~
ww xY w|dk    dS dS )r   r   )
layer_nameinvalid_addressNr!   )rr   r   r   r   r
   r   r(   rm   
isinstanceinvalid_bitsr@   )r:   ri   r   r   r   r   r   chunk_offsetr2   
chunk_sizeexcprX   length_diffs                r<   r   zIntel._mappingG  s7      Q;;	/3v/F/F,q*}+J7@@OO $<#-}    5   $ tt &-CCCC4qjj%6:oof6M6M3i lY.F!GPP
}+J7@@ *   %<#-|   * j,
JNNNN*$*$! 72 & & & % dJ$KLL >!22a7DD!88A=D"Qh&4-8+%+%& qjjjjjjs,   AA A54A5
A+D
 
E<%AE77E<c                 "    | j         g| j        z   S )zRReturns a list of the lower layer names that this layer is dependent
        upon.)r%   r&   )r:   s    r<   dependencieszIntel.dependenciesz  s      !D$555r=   c                     t          j        dd          t          j        dd          t          j        dd          t          j        dd          t          j        dd          gS )	Nr   F)r   optionalswap_layersTr    kernel_virtual_offsetkernel_banner)r   TranslationLayerRequirementLayerListRequirementIntRequirementStringRequirementrA   s    r<   get_requirementszIntel.get_requirements  sx     4#e   -=4PPP'->OOO'-DtTTT*$OOO
 	
r=   rO   )r!   )F);__name__
__module____qualname____doc__r0   r@   r*   ro   r)   rP   collectionsChainMapr   r   TranslationLayerInterface_direct_metadatar   ContextInterfacestrr   r   r   r#   r	   	functools	lru_cacher5   rC   r2   rF   rH   rK   rM   r   r   r\   rQ   staticmethodr,   r^   ra   rf   rh   rr   rl   bytesru   r   r   r   r   r   propertyr   classmethodconfigurationRequirementInterfacer   __classcell__r;   s   @r<   r   r      ss       >>MKL/1IJJ+{+	#	43D  .2
 
#4
 
 	

 4S>*
 

 
 
 
 
 
@ Y&3 & & &  ]& Y+# + + +  ]+ Y$# $ $ $  ]$ Y&# & & &  ]&
 Y     ] Y+ + + +  ]+ $uS#t^45    ] S C # #    \ c d    \ &c &d & & & \&O O O O O O-3 -3 - - - -; ;sC})= ; ; ; ;0Os OuS#X O O O Ob Y	S 	Xe_ 	 	 	 	 s C     Es Et E E E E
 ?D*n *n*n#&*n7;*n	%S#sC/0	1*n *n *n *nZ ?D1% 1%1%#&1%7;1%	%S#sC/0	11% 1% 1% 1%f 6d3i 6 6 6 X6
 	
j&>&S!T 	
 	
 	
 [	
 	
 	
 	
 	
r=   r   c                   Z    e Zd ZdZdZdZdZdZg dZ e	j
        ddiej                  ZdS )	IntelPAEzKClass for handling Physical Address Extensions for Intel
    architectures.<Qr   (   ))page directory pointer   Fr   	   Tr   r   TpaeTN)r   r   r   r   r0   r*   ro   r)   rP   r   r   r   r   rJ   r=   r<   r   r     s`          MKL  J
 ,{+UDM5;QRRr=   r   c                   Z    e Zd ZdZ ej        ddiej                  ZdZdZ	dZ
dZg dZd	S )
Intel32ezJClass for handling 64-bit (32-bit extensions) for Intel
    architectures.r   Intel64r   r`   4   0   ))zpage map layer 4r   F)r   r   Tr   r   N)r   r   r   r   r   r   r   r   r0   r*   ro   r)   rP   rJ   r=   r<   r   r     sd          ,{+	#U%;  MKL  JJJr=   r   c                   b     e Zd Zededefd            Zdedededeeee	f         f fdZ
 xZS )WindowsMixinrY   r   c                 <    t          | dz  p
| dz  o| dz             S )as  Returns whether a particular page is valid based on its entry.

        Windows uses additional "available" bits to store flags
        These flags allow windows to determine whether a page is still valid

        Bit 11 is the transition flag, and Bit 10 is the prototype flag

        For more information, see Windows Internals (6th Ed, Part 2, pages 268-269)
        r!         r[   r]   s    r<   r^   zWindowsMixin._page_is_valid  s+     UQYNUW_$Mego:MOOOr=   r   ri   
bit_offsetc           
         	 t                                          |          S # t          j        $ r }|j        }t          |dz            }t          |dz            }t          |dz            }|dz	  dz  }	t          |dz            }
|s|s|
s|r||z	  dk    r||z	  |j        z  }|j                            dd          r]|j                            t          j
                            ddt          |	          z             d           }|r|d|j        z  |fcY d }~S t          j        |j        |j        |j        |j        |	           d }~ww xY w)
Nr   r   rt   r!      r   r   F)r   r   r   rY   swap_offset)r"   rr   r
   rm   rY   r\   r   r$   getr   r   	path_joinr   SwappedInvalidAddressExceptionr   r   )r:   r   ri   r   r   rY   tbitpbitunknown_bitnvbitr   swap_layer_namer;   s                r<   _translate_swapzWindowsMixin._translate_swap  s   	77%%f---6 	 	 	JE)**D)**Du/00K!s"A	??D  d { *$**#z1T5FF<##M599 T&+l&6&6"0::)=3q66+A  	' 'O ' T*A1B,BOSSSSSSS ?#$($8!%!2* +    9	s!    $ EC'EE!.EE)r   r   r   r   r5   r\   r^   r   r   r   r   r   r   s   @r<   r   r     s        
Pc 
Pd 
P 
P 
P \
P!!$'!58!	sC}	! ! ! ! ! ! ! ! ! !r=   r   c                       e Zd Zd ZdS )WindowsIntelc                 :    |                      | || j                  S rO   )r   r@   r   s     r<   rr   zWindowsIntel._translate      ##D&$2IJJJr=   N)r   r   r   rr   rJ   r=   r<   r   r     s(        K K K K Kr=   r   c                   0    e Zd Zdedeeeef         fdZdS )WindowsIntelPAEri   r   c                 :    |                      | || j                  S rO   r   r*   r   s     r<   rr   zWindowsIntelPAE._translate  r   r=   N)r   r   r   r5   r   r   rr   rJ   r=   r<   r   r     sI        K KsC})= K K K K K Kr=   r   c                   4    e Zd ZdZdedeeeef         fdZdS )WindowsIntel32e-   ri   r   c                 @    |                      | || j        dz            S )Nr   r   r   s     r<   rr   zWindowsIntel32e._translate  s"    ##D&$2IQ2NOOOr=   N)r   r   r   ro   r5   r   r   rr   rJ   r=   r<   r   r     sP        
 KP PsC})= P P P P P Pr=   r   )"r   r   loggingr6   r.   typingr   r   r   r   r   r   volatility3r	   volatility3.frameworkr
   r   r   #volatility3.framework.configurationr   volatility3.framework.layersr   	getLoggerr   rw   rv   LinearlyMappedLayerr   r   r   r   r   r   r   rJ   r=   r<   <module>r      s;  
            = = = = = = = = = = = = = = = = % % % % % % C C C C C C C C C C < < < < < < / / / / / /		8	$	$# t
 t
 t
 t
 t
F& t
 t
 t
nS S S S Su S S S     u   &/ / / / /5 / / /jK K K K K< K K K
K K K K KlH K K K
P P P P PlH P P P P Pr=   