
    Xf                         d dl Z d dlZd dlZd dlmZmZmZ 	 d dlZdZ	n# e
$ r dZ	Y nw xY wd dlmZ d dlmZ  ej        e          Ze	r( G d de j                  Z G d	 d
ej                  ZdS dS )    N)OptionalAnyListTF)
exceptions)	resourcesc                   ,   e Zd ZdZdZd Zed             Zed             Zd Z	d Z
d Zd	 Zej        fd
Zd Zd Zdee         fdZd ZdefdZddedefdZd dee         defdZd dedee         fdZdefdZdedee         fdZd Zd Z dS )!LeechCoreFilezDClass to mimic python-native file access to a LeechCore memory spaceNc                 Z    d| _         || _        d| _        d | _        d| _        d| _         d S )Ni   r   T)_chunk_size_device_cursor_handle_pad)selfleechcore_devices     X/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/leechcore.py__init__zLeechCoreFile.__init__   s4    (D+DLDLDLDI(D    c                     | j         j        S N)handlemaxaddrr   s    r   r   zLeechCoreFile.maxaddr%   s    ;&&r   c                     | j         sE	 t          j        | j                  | _         n%# t          $ r t          d| j                   w xY w| j         S )zThe actual LeechCore file object returned by leechcorepyc

            Accessing this attribute will create/attach the handle if it hasn't already been opened
            z Unable to open LeechCore device )r   leechcorepyc	LeechCorer   	TypeErrorIOErrorr   s    r   r   zLeechCoreFile.handle)   sk     < UU#/#9$,#G#GDLL  U U U!"ST\"S"STTTU<s	   ( "A
c                     t           r   )OSErrorr   s    r   filenozLeechCoreFile.fileno6   s    Mr   c                     d S r    r   s    r   flushzLeechCoreFile.flush9   s    Dr   c                     dS )NFr#   r   s    r   isattyzLeechCoreFile.isatty<   s    5r   c                 *    t          | j                  S )zThis returns whether the handle is open

            This doesn't access self.handle so that it doesn't accidentally attempt to open the device
            )boolr   r   s    r   readablezLeechCoreFile.readable?   s    
 %%%r   c                     |t           j        k    r	|| _        d S |t           j        k    r| xj        |z  c_        d S |t           j        k    r| j        |z   | _        d S d S r   )ioSEEK_SETr   SEEK_CURSEEK_ENDr   )r   offsetwhences      r   seekzLeechCoreFile.seekF   sb    $$%2;&&&2;&&#|f4 '&r   c                     | j         S )z%Return how far into the memory we are)r   r   s    r   tellzLeechCoreFile.tellN   s
    <r   c                     dS )z2Leechcore supports writing, so this is always trueTr#   r   s    r   writablezLeechCoreFile.writableR   s    4r   linesc                 R    |                      d                    |                    S )Nr   )writejoin)r   r6   s     r   
writelineszLeechCoreFile.writelinesV   s    ::chhuoo...r   c                 J   |}|}g }| j         j        D ]}|d         |d         z   |k    s|d         ||z   k    r'|t          |d         |          t          |d         |          fgz  }|d         d         |d         d         z   }t          d||z
            }|dk    r n|S )Nbasesizer      )r   memmapmaxmin)r   startr=   chunk_start
chunk_sizeoutputentrys          r   	in_memmapzLeechCoreFile.in_memmapY   s    KJF+  &ME&M1[@@V}j(@@@v44c%-6T6TU  %RjmfRjm; D;$677
??E #Mr   bc                     | j                             | j        |          }| xj        t          |          z  c_        |S r   )r   r8   r   len)r   rI   results      r   r8   zLeechCoreFile.writem   s6    [&&t|Q77FLLCFF"LLMr   r>   r=   returnc                 `   | j                             | j        |d          }t          |          |k    r|d|         }n|d|t          |          z
  z  z   }| xj        t          |          z  c_        t          |          s*t	          j        d| j        t          |          z             |S )zWe ask leechcore to pad the data, because otherwise determining holes in the underlying file would
            be extremely inefficient borderline impossible to do consistentlyTN    zLeechCore layer read failure)r   readr   rK   r   InvalidAddressException)r   r=   datas      r   rP   zLeechCoreFile.readr   s     ;##DL$==D4yy4ETE{gD		)9::LLCII%LLt99  82DL3t994L   Kr   ._LeechCoreFile__sizec                 B   d}|| j         k    s|dk     rV||                     | j                   z  }|                    d          }|| j         z  }|dk    rd}n|| j         k    P|dk     V||                     |          z  }|                    d          }|d |         S )Nr   r      
)r   rP   find)r   rS   rR   indexs       r   readlinezLeechCoreFile.readline   s    D4+++vzz		$"2333		%(($**A::F 4+++vzz DIIf%%%DIIe$$E<r   _LeechCoreFile__hintc                     d}g }||k     s|dk     r8|                                  }|t          |          z  }||gz  }||k     2|dk     8|S )Nr   )rX   rK   )r   rY   counterrL   lines        r   	readlineszLeechCoreFile.readlines   sd    GFF""fqjj}}3t99$4&  F""fqjj Mr   c                 *    |                                  S r   )rP   r   s    r   readallzLeechCoreFile.readall   s    99;;r   c                     |                                  }t          t          |                    D ]}||         ||<   t          |          S r   )rP   rangerK   )r   rI   rR   rW   s       r   readintozLeechCoreFile.readinto   sG    99;;Ds4yy)) ' ';%t99r   c                 T    | j         r| j                                          d | _         d S r   )r   closer   s    r   rd   zLeechCoreFile.close   s+    | %""$$$DLLLr   c                     | j         S r   )r   r   s    r   closedzLeechCoreFile.closed   s
    <r   )r>   ).)!__name__
__module____qualname____doc__
_leechcorer   propertyr   r   r!   r$   r&   r)   r+   r,   r1   r3   r5   r   bytesr:   rH   r8   intrP   r   rX   r]   r_   	bytearrayrb   rd   rf   r#   r   r   r	   r	      s       RR
	) 	) 	) 
	' 	' 
	' 

	  
	  

	 	 	 		 	 		 	 		& 	& 	& ')k 	5 	5 	5 	5	  	  	 	 	 		/DK 	/ 	/ 	/ 	/	 	 	(	5 	 	 	 	
	 	S 	% 	 	 	 	 	  	 8C= 	 5 	  	  	  	 	 	C 	$u+ 	 	 	 		U 	 	 	 		i 	HSM 	 	 	 		  	  	 
	  	  	  	  	 r   r	   c                   z    e Zd ZdZedee         fd            Zede	j
        j        dee         fd            ZdS )LeechCoreHandlerzgHandler for the invented `leechcore` scheme.  This is an unofficial scheme and not registered with IANArM   c                     dgS )z3We need to turn caching *off* for a live filesystem	leechcorer#   )clss    r   non_cached_schemesz#LeechCoreHandler.non_cached_schemes   s      = r   reqc                     | j         dk    rDd                    | j                            d          dd                   }t	          |          S dS )z1Handles the request if it's the leechcore scheme.rs   z://r?   N)typer9   full_urlsplitr	   )rv   
device_uris     r   default_openzLeechCoreHandler.default_open   sN     x;&&"ZZ(:(:5(A(A!""(EFF
$Z0004r   N)rg   rh   ri   rj   classmethodr   strru   staticmethodurllibrequestRequestr   r   r|   r#   r   r   rq   rq      sz        uu		!tCy 	! 	! 	! 
	! 
	fn4 	# 	 	 	 
	 	 	r   rq   )r+   loggingurllib.parser   typingr   r   r   r   HAS_LEECHCOREImportErrorvolatility3.frameworkr   volatility3.framework.layersr   	getLogger__file__vollog	RawIOBaser	   VolatilityHandlerrq   r#   r   r   <module>r      s9  
 
			      & & & & & & & & & &MM   MMM - , , , , , 2 2 2 2 2 2		8	$	$ aO  O  O  O  O  O  O  O b    96     ga as    ))