
    Xf                         d dl Z d dlZd dlZd dlmZmZmZ 	 d dlZdZ	d dlmZ d dlmZ  ej                  e      Ze	r+ G d de j$                        Z G d	 d
ej(                        Zyy# e
$ r dZ	Y Uw xY w)    N)OptionalAnyListTF)
exceptions)	resourcesc                      e Zd ZdZdZd Zed        Zed        Zd Z	d Z
d Zd	 Zej                  fd
Zd Zd Zdee   fdZd ZdefdZddedefdZddee   defdZddedee   fdZdefdZdedee   fdZd Zd Z y)LeechCoreFilezDClass to mimic python-native file access to a LeechCore memory spaceNc                 X    d| _         || _        d| _        d | _        d| _        d| _         y )Ni   r   T)_chunk_size_device_cursor_handle_pad)selfleechcore_devices     X/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/leechcore.py__init__zLeechCoreFile.__init__   s.    (D+DLDLDLDI(D    c                 .    | j                   j                  S N)handlemaxaddrr   s    r   r   zLeechCoreFile.maxaddr%   s    ;;&&&r   c                     | j                   s1	 t        j                  | j                        | _         | j                   S | j                   S # t        $ r t        d| j                         w xY w)zThe actual LeechCore file object returned by leechcorepyc

            Accessing this attribute will create/attach the handle if it hasn't already been opened
            z Unable to open LeechCore device )r   leechcorepyc	LeechCorer   	TypeErrorIOErrorr   s    r   r   zLeechCoreFile.handle)   sf     <<U#/#9#9$,,#GDL <<4<< ! U!$DT\\N"STTUs   $A
 
"A,c                     t         r   )OSErrorr   s    r   filenozLeechCoreFile.fileno6   s    Mr   c                      y r    r   s    r   flushzLeechCoreFile.flush9   s    r   c                      y)NFr#   r   s    r   isattyzLeechCoreFile.isatty<   s    r   c                 ,    t        | j                        S )zThis returns whether the handle is open

            This doesn't access self.handle so that it doesn't accidentally attempt to open the device
            )boolr   r   s    r   readablezLeechCoreFile.readable?   s    
 %%r   c                     |t         j                  k(  r|| _        y |t         j                  k(  r| xj                  |z  c_        y |t         j                  k(  r| j
                  |z   | _        y y r   )ioSEEK_SETr   SEEK_CURSEEK_ENDr   )r   offsetwhences      r   seekzLeechCoreFile.seekF   sP    $%2;;&&2;;&#||f4 'r   c                     | j                   S )z%Return how far into the memory we are)r   r   s    r   tellzLeechCoreFile.tellN   s    <<r   c                      y)z2Leechcore supports writing, so this is always trueTr#   r   s    r   writablezLeechCoreFile.writableR   s    r   linesc                 B    | j                  dj                  |            S )Nr   )writejoin)r   r6   s     r   
writelineszLeechCoreFile.writelinesV   s    ::chhuo..r   c                    |}|}g }| j                   j                  D ]f  }|d   |d   z   |k  s|d   ||z   k\  r|t        |d   |      t        |d   |      fgz  }|d   d   |d   d   z   }t        d||z
        }|dk  se |S  |S )Nbasesizer      )r   memmapmaxmin)r   startr=   chunk_start
chunk_sizeoutputentrys          r   	in_memmapzLeechCoreFile.in_memmapY   s    KJF++ &ME&M1[@V}j(@@v4c%-6TU  %RjmfRjm; D;$67
?M Mr   bc                     | j                   j                  | j                  |      }| xj                  t        |      z  c_        |S r   )r   r8   r   len)r   rI   results      r   r8   zLeechCoreFile.writem   s3    [[&&t||Q7FLLCF"LMr   r=   returnc                 N   | j                   j                  | j                  |d      }t        |      |kD  r|d| }n|d|t        |      z
  z  z   }| xj                  t        |      z  c_        t        |      s,t	        j
                  d| j                  t        |      z         |S )zWe ask leechcore to pad the data, because otherwise determining holes in the underlying file would
            be extremely inefficient borderline impossible to do consistentlyTN    zLeechCore layer read failure)r   readr   rK   r   InvalidAddressException)r   r=   datas      r   rP   zLeechCoreFile.readr   s     ;;##DLL$=D4y4ET{gD	)9::LLCI%Lt9 882DLL3t94L  Kr   _LeechCoreFile__sizec                 :   d}|| j                   kD  s|dk  r\|| j                  | j                         z  }|j                  d      }|| j                   z  }|dk\  rd}n|| j                   kD  rV|dk  r\|| j                  |      z  }|j                  d      }|d | S )Nr   r      
)r   rP   find)r   rS   rR   indexs       r   readlinezLeechCoreFile.readline   s    D4+++vz		$"2"233		%($***A:F 4+++vz DIIf%%DIIe$E<r   _LeechCoreFile__hintc                     d}g }||k  s|dk  r0| j                         }|t        |      z  }||gz  }||k  r*|dk  r0|S )Nr   )rX   rK   )r   rY   counterrL   lines        r   	readlineszLeechCoreFile.readlines   sV    GFF"fqj}}3t9$4&  F"fqj Mr   c                 "    | j                         S r   )rP   r   s    r   readallzLeechCoreFile.readall   s    99;r   c                 z    | j                         }t        t        |            D ]
  }||   ||<    t        |      S r   )rP   rangerK   )r   rI   rR   rW   s       r   readintozLeechCoreFile.readinto   s<    99;Ds4y) ';%'t9r   c                 ^    | j                   r| j                   j                          d | _         y r   )r   closer   s    r   rd   zLeechCoreFile.close   s     ||""$DLr   c                     | j                   S r   )r   r   s    r   closedzLeechCoreFile.closed   s    <<r   )r>   ).)!__name__
__module____qualname____doc__
_leechcorer   propertyr   r   r!   r$   r&   r)   r+   r,   r1   r3   r5   r   bytesr:   rH   r8   intrP   r   rX   r]   r_   	bytearrayrb   rd   rf   r#   r   r   r	   r	      s    R
	) 
	' 
	' 

	  

	 				& ')kk 	5	 		/DK 	/	(	5 	
	S 	% 	 	 8C= 	 5 	 	C 	$u+ 		U 		i 	HSM 		 
	 r   r	   c                   t    e Zd ZdZedee   fd       Zede	j                  j                  dee   fd       Zy)LeechCoreHandlerzgHandler for the invented `leechcore` scheme.  This is an unofficial scheme and not registered with IANArM   c                     dgS )z3We need to turn caching *off* for a live filesystem	leechcorer#   )clss    r   non_cached_schemesz#LeechCoreHandler.non_cached_schemes   s      = r   reqc                     | j                   dk(  r8dj                  | j                  j                  d      dd       }t	        |      S y)z1Handles the request if it's the leechcore scheme.rs   z://r?   N)typer9   full_urlsplitr	   )rv   
device_uris     r   default_openzLeechCoreHandler.default_open   sB     xx;&"ZZ(:(:5(A!"(EF
$Z00r   N)rg   rh   ri   rj   classmethodr   strru   staticmethodurllibrequestRequestr   r   r|   r#   r   r   rq   rq      sR    u		!tCy 	! 
	! 
	fnn44 	# 	 
	r   rq   )r+   loggingurllib.parser   typingr   r   r   r   HAS_LEECHCOREImportErrorvolatility3.frameworkr   volatility3.framework.layersr   	getLogger__file__vollog	RawIOBaser	   VolatilityHandlerrq   r#   r   r   <module>r      s   
 
   & &M - 2			8	$O  O b966 g   Ms   A* *A43A4