
    Xf(                         d dl Z d dlmZmZmZmZmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ  G d d	ej                  Z G d
 dej                  Z G d dej                  ZdS )    N)OptionalDictAnyListIterableTuple)
interfaces	constants
exceptions)requirements)linear)utility)intermedc                       e Zd ZdZdS )PDBFormatExceptionz@Thrown when an error occurs with the underlying MSF file format.N)__name__
__module____qualname____doc__     R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/msf.pyr   r      s        JJJJr   r   c                       e Zd ZdddZ	 d!dddeded	eeeef                  d
df
 fdZe	d
efd            Z
d Zdededee         d
efdZd
eeeej        j        f                  fdZe	d             Ze	d
ee         fd            Zed
eej        j                 fd            Ze	d
efd            Ze	d
efd            Zd"deded
efdZ	 d#dededed
eeeeeeef                  fdZd
ed         fd Z  xZ!S )$PdbMultiStreamFormatz*Microsoft C/C++ program database 2.00
JGzMicrosoft C/C++ MSF 7.00
DS)MSF_HDRBIG_MSF_HDRNcontext#interfaces.context.ContextInterfaceconfig_pathnamemetadatareturnc                 D   t                                          ||||           | j        d         | _        t          j                            || j        dd          | _        | 	                                }|t          |d          |\  | _        | _        i | _        d S )N
base_layerwindowspdbz Could not find a suitable header)super__init__config_base_layerr   IntermediateSymbolTablecreate_config_path_pdb_symbol_table_check_headerr   _version_header_streams)selfr   r   r    r!   response	__class__s         r   r(   zPdbMultiStreamFormat.__init__   s     	+tX>>>;|4!)!A!H!HT&	5"
 "
 %%''$T+MNNN&.#t|(*r   c                     | j         S N)r.   r3   s    r   pdb_symbol_tablez%PdbMultiStreamFormat.pdb_symbol_table+   s    %%r   c           	      v   | j         rd S | j                            | j        | j        d          }|                    d          j        }t          j        | j	        j
        j        | j	        j        z            }t          j        ||z  | j	        j        z            }|                    d| j	        j        j        ||                    d                    }|                     d| j	        j
        j        d |D                       }| j                            | j        |d          }|                    dd||                    d                    }|                     d| j	        j
        j        d	 |D                       }| j                            | j        |d          }|                    dd
          }	|                    d||	|                    d                    }
|	dz   |z  }t!          |	          D ]}t          j        |
|         | j        z            }|dk    s|
|         dk    rd | j         |<   A|                    d|||                    d                    }|||z  z  }|                     dt%          |          z   |
|         d |D                       | j         |<   d S )Nr   )offsetzunsigned longarray)object_typer;   countsubtype
root_indexc                     g | ]}|S r   r   .0xs     r   
<listcomp>z5PdbMultiStreamFormat.read_streams.<locals>.<listcomp>G   s    ###1Q###r   rootc                     g | ]}|S r   r   rB   s     r   rE   z5PdbMultiStreamFormat.read_streams.<locals>.<listcomp>T   s    <S<S<S1Q<S<S<Sr   )r=   r;      l    streamc                     g | ]}|S r   r   rB   s     r   rE   z5PdbMultiStreamFormat.read_streams.<locals>.<listcomp>q   s    1111Q111r   )r2   r   moduler9   r*   get_typesizemathceilr1   
StreamInfoStreamInfoSizePageSizeobjectvolcreate_stream_from_pagesrange	page_sizestr)r3   rK   
entry_sizeroot_table_num_pagesroot_index_sizer@   root_index_layer_name
root_pagesroot_layer_namenum_streamsstream_sizescurrent_offsetrI   	list_sizestream_page_lists                  r   read_streamsz!PdbMultiStreamFormat.read_streams/   s   = 	4 $$T%:D<LUV$WW___55:
#yL#2T\5JJ 
  
 )!J.$,2GG
 
 ]]<#(!OOO44	 # 
 

 !% = =L#2##
###!
 !
 $$!#8 % 
 
 ]]&OOO44	 # 
 

 77DL+:<S<S
<S<S<S
 
 $$T%:OTU$VVmmmJJ}}OOO44	 % 
 
 &/Z7K(( 	 	F	,v"6"GHHIA~~f!5!C!C(,f%%#)== ')#"OOO<<	 $1 $ $  )j"88(,(E(Es6{{* (11 0111) )f%%	 	r   stream_namemaximum_sizepagesc                 n   | j         dz   |z   }t          j        j        } || j        |          }| j         | j        j         ||d          <   || j        j         ||d          <   || j        j         ||d          <   t          | j        ||          }| j        j        	                    |           |S )N_r$   rg   rf   )
r    r	   configuration	path_joinr   r   r)   PdbMSFStreamlayers	add_layer)r3   re   rf   rg   
layer_namerk   r   layers           r   rU   z-PdbMultiStreamFormat.create_stream_from_pagest   s     Y_{2
,6	i 0+>>DHIIIk<@@A?DIIk7;;<FRIIk>BBCT\;
CC%%e,,,r   c                    | j         D ]~}| j        t          j        z   |z   }| j                            || j        d          }t          j        |j	                  | j         |         k    r|j
        dk     s|j
        dk    s||fc S dS )zPVerifies the header of the PDB file and returns the version of the
        file.r      i   N)_headersr9   r
   BANGr   rS   r*   r   array_to_stringMagicrR   )r3   headerheader_typecurrent_headers       r   r/   z"PdbMultiStreamFormat._check_header   s     m 	2 	2F/).@6IK!\00d>NPQRRN&~';<<f@UUU"+e33%.-@@!>1111tr   c                     | j         j        S r7   )r1   rR   r8   s    r   rW   zPdbMultiStreamFormat.page_size   s    |$$r   c                     | j         gS )zMReturns a list of the lower layers that this layer is dependent
        upon.r*   r8   s    r   dependenciesz!PdbMultiStreamFormat.dependencies   s      !!r   c                 0    t          j        dd          gS )Nr$   F)r    optional)r   TranslationLayerRequirementclss    r   get_requirementsz%PdbMultiStreamFormat.get_requirements   s"     4,QVWWW
 	
r   c                 :    | j         j        | j                 j        S r7   )r   rm   r*   maximum_addressr8   s    r   r   z$PdbMultiStreamFormat.maximum_address       |"4#34DDr   c                 :    | j         j        | j                 j        S r7   )r   rm   r*   minimum_addressr8   s    r   r   z$PdbMultiStreamFormat.minimum_address   r   r   rH   r;   lengthc                 X    | j         j        | j                                     ||          S r7   r   rm   r*   is_validr3   r;   r   s      r   r   zPdbMultiStreamFormat.is_valid   %    |"4#34==ffMMMr   Fignore_errorsc              #   &   K   ||||| j         fV  d S r7   r|   )r3   r;   r   r   s       r   mappingzPdbMultiStreamFormat.mapping   s(       fffd.>>>>>>>r   rl   c                     |                                   || j        vrt          | j        d          | j        |         r4| j        j        | j        |                  }t          |t                    r|S d S )NzStream not present)rd   r2   r   r    r   rm   
isinstancerl   )r3   indexrp   s      r   
get_streamzPdbMultiStreamFormat.get_stream   su    %%$TY0DEEE= 	L'e(<=E%.. tr   r7   rH   F)"r   r   r   rs   rX   r   r   r   r(   propertyr9   rd   intr   rU   r   r	   objectsObjectInterfacer/   rW   r}   classmethodrj   RequirementInterfacer   r   r   boolr   r   r   r   __classcell__r5   s   @r   r   r      s       JA H .2+ +6+ + 	+
 4S>*+ 
+ + + + + +& &# & & & X&C C CJ.1:>s)	   xc:3E3U.U(VW     % % X% "d3i " " " X"
 
j&>&S!T 
 
 
 [

 E E E E XE E E E E XEN Ns NC N N N N N ?D? ??#&?7;?	%S#sC/0	1? ? ? ?
8N#;        r   r   c                       e Zd Z	 ddddededeeeef                  ddf
 fdZedee         fd	            Z	e
deej        j                 fd
            Z	 ddedededeeeeeeef                  fdZedee         fd            ZddededefdZedefd            Zedefd            Zedefd            Z xZS )rl   Nr   r   r   r    r!   r"   c                 f   t                                          ||||           | j        d         | _        | j                            dd           | _        t          | j                  | _        | j        st          |d          t          | j
        t                    st          d          d S )Nr$   rg   zInvalid/no pages specifiedz/Base Layer must be a PdbMultiStreamFormat layer)r'   r(   r)   r*   get_pageslen
_pages_lenr   r   
_pdb_layerr   	TypeError)r3   r   r   r    r!   r5   s        r   r(   zPdbMSFStream.__init__   s     	+tX>>>;|4koogt44dk**{ 	I$T+GHHH$/+?@@ 	OMNNN	O 	Or   c                 l    | j         j        | j                 }t          |t                    r|j        S d S r7   )_contextrm   r*   r   r   r9   )r3   rp   s     r   r9   zPdbMSFStream.pdb_symbol_table   s5    $T%56e122 	))4r   c                     t          j        dt          d          t          j        d          t          j        d          gS )Nrg   rH   )r    element_typemin_elementsr$   )r    rf   )r   ListRequirementr   r   IntRequirementr   s    r   r   zPdbMSFStream.get_requirements   sN     (3Q   4,GGG'^<<<
 	
r   Fr;   r   r   c              #   \  K   d}| j         j        }|dk    rt          j        ||z   |z            }||z   |z  }t	          ||z
  |          }|| j        k    r!|st          j        | j        ||z             n"||z   || j	        |         |z  |z   || j
        fV  ||z  }||z  }|dk    d S d S )Nr   )ro   invalid_address)r   rW   rN   floorminr   r   InvalidAddressExceptionr    r   r*   )	r3   r;   r   r   returnedrW   pagepage_position
chunk_sizes	            r   r   zPdbMSFStream.mapping   s      O-	qjj:v0I=>>D#h.);MY6??Jt&&$ $<#'9fx>O   
 x'K%	1!6"#-t/?@ @ @ @ 
"Hj F qjjjjjjr   c                     | j         gS r7   r|   r8   s    r   r}   zPdbMSFStream.dependencies   s     !!r   rH   c                 X    | j         j        | j                                     ||          S r7   r   r   s      r   r   zPdbMSFStream.is_valid   r   r   c                     dS )Nr   r   r8   s    r   r   zPdbMSFStream.minimum_address   s    qr   c                 v    | j                             dt          | j                  | j        j        z            S )Nrf   )r)   r   r   r   r   rW   r8   s    r   r   zPdbMSFStream.maximum_address   s3    {C,,t/HH
 
 	
r   c                     | j         | j        j        vrt          | j         d| j                    | j        j        | j                  }t	          |t
                    r|S t          d          )Nz%No PdbMultiStreamFormat layer found: z&Base layer is not PdbMultiStreamFormat)r*   r   rm   r   r   r   r   )r3   results     r   r   zPdbMSFStream._pdb_layer  sv    4=#777$ J8HJJ   %d&67f233 	M@AAAr   r7   r   r   )r   r   r   rX   r   r   r   r(   r   r9   r   r   r	   rj   r   r   r   r   r   r   r   r}   r   r   r   r   r   r   r   s   @r   rl   rl      s!        .2O O6O O 	O
 4S>*O 
O O O O O O  (3-    X 
j&>&S!T 
 
 
 [
 ?D! !!#&!7;!	%S#sC/0	1! ! ! !* "d3i " " " X"N Ns NC N N N N N     X 
 
 
 
 X

 	B0 	B 	B 	B X	B 	B 	B 	B 	Br   rl   )rN   typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.objectsr   volatility3.framework.symbolsr   LayerExceptionr   LinearlyMappedLayerr   rl   r   r   r   <module>r      s\    = = = = = = = = = = = = = = = = C C C C C C C C C C < < < < < < / / / / / / 1 1 1 1 1 1 2 2 2 2 2 2K K K K K2 K K Kf f f f f65 f f fRSB SB SB SB SB6- SB SB SB SB SBr   