
    [
#gJ                     `   d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	m
Z
mZ d dlmZ d dlmZmZmZ d dlmZ d dlmZ  ej,                  e      ZdZ G d d	ej4                        Z G d
 de      Z G d de      Z G d de      Z G d dee      Z G d dee      Z  G d dee      Z!y)    N)AnyDictIterableListOptionalTuple)classproperty)
exceptions
interfaces	constants)requirements)linearFc                   n    e Zd ZdZdZdZdZdZeZddgZ	 e
j                  ddid	d
iej                  j                  j                        Z	 d1dej                   j"                  dededeeeef      ddf
 fdZe ej2                         defd              Ze ej2                         defd              Ze ej2                         defd              Ze ej2                         defd              Ze ej2                         defd              Ze ej2                         defd              Z ede!e"eee#f      fd       Z$e%dedededefd       Z&e%dede#fd       Z'e%dede#fd       Z(d edefd!Z)d edefd"Z*d#ede"eeef   fd$Z+d#ede"eef   fd%Z, ej2                  d&      d'edee-   fd(       Z.d2d#ed)ede#fd*Z/d#ede#fd+Z0	 d3d#ed)ed,e#de1e"eeeeef      fd-Z2	 d3d#ed)ed,e#de1e"eeeeef      fd.Z3e4de!e   fd/       Z5e6de!ejn                  jp                     fd0       Z9 xZ:S )4Intelz4Translation Layer for the Intel IA32 memory mapping.z<I       )page directory
   F)
page tabler   TarchitectureIntel32mappedTNcontextconfig_pathnamemetadatareturnc           	         t         |   ||||       | j                  d   | _        g | _        | j                  d   | _        t        | j                  | j                        dz
  | _	        | j                  | j
                  | j                  d      dz  | _        t        j                  | j                        | _        | j                   | j                  z  | _        | j                  d| j                  z  dz
  | j                  | j                        | _        t'        t)        j*                  t)        j,                  t        j                  | j                                          | _        y )N)r   r   r   r   memory_layerpage_map_offset   r   )super__init__config_base_layer_swap_layers_page_map_offsetmin_maxvirtaddr_bits_per_register_initial_position_mask_initial_entrystructcalcsize_entry_format_entry_size	page_size_entry_number_canonical_prefixintmathceillog2_index_shift)selfr   r   r   r   	__class__s        T/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/intel.pyr#   zIntel.__init__&   s2    	4( 	 	
  ;;~6') $,= > "%T%6%68O8O!PST!TJJt,,d.D.DaH3N 	 "??4+=+=>!^^t/?/??!%$)))Q.##"
  IIdii0B0B CDE
    c                     | j                   S )z'Page shift for the intel memory layers._page_size_in_bitsclss    r<   
page_shiftzIntel.page_shiftF   s     %%%r=   c                      d| j                   z  S )zaPage size for the intel memory layers.

        All Intel layers work on 4096 byte pages
        r!   r?   rA   s    r<   r2   zIntel.page_sizeL   s     C****r=   c                 "    | j                   dz
   S )z&Page mask for the intel memory layers.r!   )r2   rA   s    r<   	page_maskzIntel.page_maskU   s     "##r=   c                     | j                   S )zYReturns the bits_per_register to determine the range of an
        IntelTranslationLayer.)r*   rA   s    r<   bits_per_registerzIntel.bits_per_register[   s    
 %%%r=   c                      y)Nr    rA   s    r<   minimum_addresszIntel.minimum_addressb   s     r=   c                 &    d| j                   z  dz
  S )Nr!   )r)   rA   s    r<   maximum_addresszIntel.maximum_addressg   s     S%%%**r=   c                     | j                   S N)
_structurerA   s    r<   	structurezIntel.structurel   s    ~~r=   valuehigh_bitlow_bitc                 <    d|dz   z  dz
  }d|z  dz
  }||z  }| |z  S )zAReturns the bits of a value between highbit and lowbit inclusive.r!   rJ   )rR   rS   rT   	high_masklow_maskmasks         r<   r,   zIntel._maskp   s9     8a<(A-	LA%8#t|r=   entryc                     t        | dz        S )z>Returns whether a particular page is valid based on its entry.r!   boolrY   s    r<   _page_is_validzIntel._page_is_validy   s     EAIr=   c                     t        | dz        S )z>Returns whether a particular page is dirty based on its entry.@   r[   r]   s    r<   _page_is_dirtyzIntel._page_is_dirty~   s     EV$%%r=   addrc                     | j                   | j                  k  r|| j                  z  S |d| j                  dz
  z  k  r|S | j                  || j                  d      | j                  z   S )z[Canonicalizes an address by performing an appropiate sign extension on the higher addressesr!   r   )r*   r)   address_maskr,   r4   r:   rb   s     r<   canonicalizezIntel.canonicalize   sh    ""d&7&77$++++Q$++a//0Kzz$ 1 1158N8NNNr=   c                 N    |d| j                   dz
  z  k  r|S || j                  z  S )zRemoves canonicalization to ensure an adress fits within the correct range if it has been canonicalized

        This will produce an address outside the range if the canonicalization is incorrect
        r!   )r)   r4   re   s     r<   decanonicalizezIntel.decanonicalize   s2    
 1))A--.Kd,,,,r=   offsetc           
      J   | j                  |      \  }}| j                  |      s3t        j                  | j                  ||dz   |dt        |       d      | j                  || j                  dz
  |dz         | j                  ||d      z  }|d|dz   z  | j                  fS )zTranslates a specific offset based on paging tables.

        Returns the translated offset, the contiguous pagesize that the
        translated address lives in and the layer_name that the address
        lives in
        r!   Page Fault at entry z in page entryr   )	_translate_entryr^   r
   PagedInvalidAddressExceptionr   hexr,   _maxphyaddrr%   )r:   ri   rY   positionpages        r<   
_translatezIntel._translate   s     //7x ""5)99		1&s5zl.A  zz%!1!1A!5x!|DtzzHaH
 
 Q8a<($*:*:::r=   c                    | j                   }| j                  }| j                  || j                  z  cxk  r| j                  k  s4n t        j                  | j                  ||dz   |dt        |      z         | j                  D ]  \  }}}| j                  |      s8t        j                  | j                  ||dz   |dt        |      z   dz   |z         |r|dz  r|dz  r|dz  } ||fS |}||z  }| j                  |||dz         |dz   z	  }| j                  || j                  dz
  || j                  z         }	| j                  |	      }
|
8t        j                  | j                  ||dz   |dt        |      z   dz   |z         |
|| j                  z  || j                  z  | j                  z    }t         rrt"        j%                  t&        j(                  dj+                  t        |      t        |      t        t-        j.                  | j0                  |      d         |             t-        j.                  | j0                  |      \  } ||fS )	ziTranslates a specific offset based on paging tables.

        Returns the translated entry value
        r!   z%Entry outside virtual address range: rk   z
 in table    i   z(Entry {} at index {} gives data {} as {}r   )r+   r-   rK   rd   rM   r
   rm   r   rn   rP   r^   r,   ro   r9   _get_valid_tabler1   INTEL_TRANSLATION_DEBUGGINGvolloglogr   LOGLEVEL_VVVVformatr.   unpackr0   )r:   ri   rp   rY   r   size
large_pagestartindexbase_addresstable
entry_datas               r<   rl   zIntel._translate_entry   sk    ))##   Vd.?.?%?XDDXDXX99		17#e*D  '+oo"D$
&&u- ==IIqL*SZ7,FM  u/G$W$E R hO EHJJvuhl;1ME  ::t''!+TD4E4E-EL )),7E} ==IIqL*SZ7,FM  $+++9J9J0J""0#J
 +

++>EEE
E
FMM$*<*<jI!LM	 }}T%7%7DHUq '6t hr=   i  r   c                     | j                   j                  j                  | j                  || j                        }||d| j
                   | j                  z  k(  ry|S )z>Extracts the table, validates it and returns it if it's valid.N)_contextlayersreadr%   r2   r1   r3   )r:   r   r   s      r<   ru   zIntel._get_valid_table   sZ     $$))lDNN

 E,D,,-0B0BBBr=   lengthc                     	 t        | j                  ||      D cg c]0  \  }}}}}| j                  j                  |   j	                  |      2 c}}}      S c c}}}w # t
        j                  $ r Y yw xY w)zPReturns whether the address offset can be translated to a valid
        address.F)allmappingr   r   is_validr
   InvalidAddressException)r:   ri   r   _mapped_offsetlayers         r<   r   zIntel.is_valid  s    		 :>ff9U 51mQ MM((/88G 
 11 		s"   A" 5AA" A" "A87A8c                 H    | j                  | j                  |      d         S )z2Returns whether the page at offset is marked dirtyr   )ra   rl   r:   ri   s     r<   is_dirtyzIntel.is_dirty  s#    ""4#8#8#@#CDDr=   ignore_errorsc              #      K   dx}x}x}x}}| j                  |||      D ]?  \  }}	}
}}|||z   |k7  s||z   |
k7  s||k7  r|	|||||f |}|
}|	}|}|}6||	z  }||z  }A |||||
|||||f yyyyyyw)Returns a sorted iterable of (offset, sublength, mapped_offset, mapped_length, layer)
        mappings.

        This allows translation layers to provide maps of contiguous
        regions in one layer
        N)_mapping)r:   ri   r   r   stashed_offsetstashed_mapped_offsetstashed_sizestashed_mapped_sizestashed_map_layerr|   r   mapped_size	map_layers                r<   r   zIntel.mapping  s     	 	. 	 	@SCG==FMD
?FD-i &"\1V;),??=P%2 "-(,8MObduuu!'(5%#&1#$-! $#{2#+D
0 &%1(#/!- ,0EGZ\mmm . 0 ) 2 's   A9A;c              #   ,  K   |dk(  r`	 | j                  |      \  }}}| j                  j                  |   j                  |      st	        j
                  ||      	 |||||f y|dkD  r	 | j                  |      \  }}}t        |||z  z
  |      }	| j                  j                  |   j                  ||	      st	        j
                  ||      	 ||	||	|f ||	z  }||	z  }|dkD  ryy# t        j
                  $ r |s Y yw xY w# t        j                  t        j
                  f$ ra}
|s t        |
t        j                        rd|
j                  z  dz
  }nd| j                  z  dz
  }|dz   ||z  z
  }||z  }||z  }Y d}
~
d}
~
ww xY ww)r   r   )
layer_nameinvalid_addressNr!   )rr   r   r   r   r
   r   r(   rm   
isinstanceinvalid_bitsr@   )r:   ri   r   r   r   r   r   chunk_offsetr2   
chunk_sizeexcprX   length_diffs                r<   r   zIntel._mappingI  s     Q;	/3v/F,q*}}++J7@@O$<<#-}  P &-CCqj%6:oof6M3i lY.F!GP
}}++J7@@ * %<<#-| * j,
JNN*$*$7 qj 55 $" 7722 & %dJ$K$KL!2!22a7D!8!88A=D"Qh&4-8+%+%&s[   FAC1 F.A'D F/F1D
F	D

F#F0AFFFFc                 6    | j                   g| j                  z   S )zRReturns a list of the lower layer names that this layer is dependent
        upon.)r%   r&   )r:   s    r<   dependencieszIntel.dependencies|  s       !D$5$555r=   c                     t        j                  dd      t        j                  dd      t        j                  dd      t        j                  dd      t        j                  dd      gS )	Nr   F)r   optionalswap_layersTr    kernel_virtual_offsetkernel_banner)r   TranslationLayerRequirementLayerListRequirementIntRequirementStringRequirementrA   s    r<   get_requirementszIntel.get_requirements  se     44#e --=4P''->O''-DtT**$O
 	
r=   rO   )r!   )F);__name__
__module____qualname____doc__r0   r@   r*   ro   r)   rP   collectionsChainMapr   r   TranslationLayerInterface_direct_metadatar   ContextInterfacestrr   r   r   r#   r	   	functools	lru_cacher5   rC   r2   rF   rH   rK   rM   r   r   r\   rQ   staticmethodr,   r^   ra   rf   rh   rr   rl   bytesru   r   r   r   r   r   propertyr   classmethodconfigurationRequirementInterfacer   __classcell__r;   s   @r<   r   r      s   >MKL/1IJJ+{++	#	433DD .2
##44
 
 	

 4S>*
 

@ Y&3 &  & Y+# +  + Y$# $  $ Y&# &  &
 Y    Y+ +  + $uS#t^45   S C # #   c d   &c &d & &O O O-3 -3 -; ;sC})= ;0Qs QuS#X Qf Y	S 	Xe_ 	 	s C  Es Et E
 ?D*n*n#&*n7;*n	%S#sC/0	1*nZ ?D1%1%#&1%7;1%	%S#sC/0	11%f 6d3i 6 6
 	
j&>&>&S&S!T 	
 	
r=   r   c                   f    e Zd ZdZdZdZdZdZg dZ e	j                  ddiej                        Zy)	IntelPAEzKClass for handling Physical Address Extensions for Intel
    architectures.<Qr   (   ))page directory pointer   Fr   	   Tr   r   TpaeTN)r   r   r   r   r0   r*   ro   r)   rP   r   r   r   r   rJ   r=   r<   r   r     sF     MKLJ
 ,{++UDM5;Q;QRr=   r   c                   f    e Zd ZdZ ej
                  ddiej                        ZdZdZ	dZ
dZg dZy	)
Intel32ezJClass for handling 64-bit (32-bit extensions) for Intel
    architectures.r   Intel64r   r`   4   0   ))zpage map layer 4r   F)r   r   Tr   r   N)r   r   r   r   r   r   r   r   r0   r*   ro   r)   rP   rJ   r=   r<   r   r     sJ     ,{++	#U%;%; MKLJr=   r   c                   V     e Zd Zededefd       Zdedededeeee	f   f fdZ
 xZS )WindowsMixinrY   r   c                 <    t        | dz  xs | dz  xr | dz         S )as  Returns whether a particular page is valid based on its entry.

        Windows uses additional "available" bits to store flags
        These flags allow windows to determine whether a page is still valid

        Bit 11 is the transition flag, and Bit 10 is the prototype flag

        For more information, see Windows Internals (6th Ed, Part 2, pages 268-269)
        r!         r[   r]   s    r<   r^   zWindowsMixin._page_is_valid  s(     UQYNUW_$Mego:MOOr=   r   ri   
bit_offsetc           
         	 t         |   |      S # t        j                  $ r1}|j                  }t        |dz        }t        |dz        }t        |dz        }|dz	  dz  }	t        |dz        }
|s|s|
s|r||z	  dk7  r||z	  |j                  z  }|j                  j                  dd      r_|j                  j                  t        j                  j                  ddt        |	      z         d       }|r|d|j                  z  |fcY d }~S t        j                  |j                  |j                  |j                  |j                  |	       d }~ww xY w)
Nr   r   rt   r!      r   r   F)r   r   r   rY   swap_offset)r"   rr   r
   rm   rY   r\   r   r$   getr   r   	path_joinr   SwappedInvalidAddressExceptionr   r   )r:   r   ri   r   r   rY   tbitpbitunknown_bitnvbitr   swap_layer_namer;   s                r<   _translate_swapzWindowsMixin._translate_swap  sQ   	7%f--66 	JJE)*D)*Du/0K!s"A	?Dd{*$*#z1T5F5FF<<##M59&+ll&6&6"00::)=3q6+A 	'O '*A1B1B,BOSS ??#$($8$8!%!2!2** +  9	s"    EC#E	EAEE)r   r   r   r   r5   r\   r^   r   r   r   r   r   r   s   @r<   r   r     s\    
Pc 
Pd 
P 
P!!$'!58!	sC}	! !r=   r   c                       e Zd Zd Zy)WindowsIntelc                 <    | j                  | || j                        S rO   )r   r@   r   s     r<   rr   zWindowsIntel._translate      ##D&$2I2IJJr=   N)r   r   r   rr   rJ   r=   r<   r   r     s    Kr=   r   c                   (    e Zd Zdedeeeef   fdZy)WindowsIntelPAEri   r   c                 <    | j                  | || j                        S rO   r   r*   r   s     r<   rr   zWindowsIntelPAE._translate  r   r=   N)r   r   r   r5   r   r   rr   rJ   r=   r<   r   r     s#    K KsC})= Kr=   r   c                   ,    e Zd ZdZdedeeeef   fdZy)WindowsIntel32e-   ri   r   c                 B    | j                  | || j                  dz        S )Nr   r   r   s     r<   rr   zWindowsIntel32e._translate  s"    ##D&$2I2IQ2NOOr=   N)r   r   r   ro   r5   r   r   rr   rJ   r=   r<   r   r     s*    
 KP PsC})= Pr=   r   )"r   r   loggingr6   r.   typingr   r   r   r   r   r   volatility3r	   volatility3.frameworkr
   r   r   #volatility3.framework.configurationr   volatility3.framework.layersr   	getLoggerr   rw   rv   LinearlyMappedLayerr   r   r   r   r   r   r   rJ   r=   r<   <module>r      s   
      = = % C C < /			8	$# v
F&& v
rSu S u &/5 /jK< K
KlH K
PlH Pr=   