
    Xf(                         d dl Z d dlmZmZmZmZmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ  G d d	ej(                        Z G d
 dej,                        Z G d dej,                        Zy)    N)OptionalDictAnyListIterableTuple)
interfaces	constants
exceptions)requirements)linear)utility)intermedc                       e Zd ZdZy)PDBFormatExceptionz@Thrown when an error occurs with the underlying MSF file format.N)__name__
__module____qualname____doc__     R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/msf.pyr   r      s    Jr   r   c                       e Zd ZdddZ	 ddddeded	eeeef      d
df
 fdZe	d
efd       Z
d Zdededee   d
efdZd
eeeej"                  j$                  f      fdZe	d        Ze	d
ee   fd       Zed
eej.                  j0                     fd       Ze	d
efd       Ze	d
efd       Zd deded
efdZ	 d!dededed
eeeeeeef      fdZd
ed   fdZ  xZ!S )"PdbMultiStreamFormatz*Microsoft C/C++ program database 2.00
JGzMicrosoft C/C++ MSF 7.00
DS)MSF_HDRBIG_MSF_HDRNcontext#interfaces.context.ContextInterfaceconfig_pathnamemetadatareturnc                    t         |   ||||       | j                  d   | _        t        j
                  j                  || j                  dd      | _        | j                         }|t        |d      |\  | _        | _        i | _        y )N
base_layerwindowspdbz Could not find a suitable header)super__init__config_base_layerr   IntermediateSymbolTablecreate_config_path_pdb_symbol_table_check_headerr   _version_header_streams)selfr   r   r    r!   response	__class__s         r   r(   zPdbMultiStreamFormat.__init__   s     	+tX>;;|4!)!A!A!H!HT&&	5"
 %%'$T+MNN&.#t|(*r   c                     | j                   S N)r.   r3   s    r   pdb_symbol_tablez%PdbMultiStreamFormat.pdb_symbol_table+   s    %%%r   c           	      $   | j                   ry | j                  j                  | j                  | j                  d      }|j                  d      j                  }t        j                  | j                  j                  j                  | j                  j                  z        }t        j                  ||z  | j                  j                  z        }|j                  d| j                  j                  j                  ||j                  d            }| j                  d| j                  j                  j                  |D cg c]  }| c}      }| j                  j                  | j                  |d      }|j                  dd||j                  d            }| j                  d| j                  j                  j                  |D cg c]  }| c}      }	| j                  j                  | j                  |	d      }|j                  dd      }
|j                  d||
|j                  d            }|
d	z   |z  }t!        |
      D ]  }t        j                  ||   | j"                  z        }|dk(  s||   d
k(  rd | j                   |<   E|j                  d|||j                  d            }|||z  z  }| j                  dt%        |      z   ||   |D cg c]  }| c}      | j                   |<    y c c}w c c}w c c}w )Nr   )offsetzunsigned longarray)object_typer;   countsubtype
root_indexroot)r=   r;      l    stream)r2   r   moduler9   r*   get_typesizemathceilr1   
StreamInfoStreamInfoSizePageSizeobjectvolcreate_stream_from_pagesrange	page_sizestr)r3   rD   
entry_sizeroot_table_num_pagesroot_index_sizer@   xroot_index_layer_name
root_pagesroot_layer_namenum_streamsstream_sizescurrent_offsetrC   	list_sizestream_page_lists                   r   read_streamsz!PdbMultiStreamFormat.read_streams/   s   == $$T%:%:D<L<LUV$W___5::
#yyLL##22T\\5J5JJ 
 ))!J.$,,2G2GG
 ]]<<##((!OOO4	 # 

 !% = =LL##22"#1Q#!
 $$!!#8 % 
 ]]&OOO4	 # 

 77DLL++::
<S1Q<S
 $$T%:%:OTU$VmmmJ}}OOO4	 % 
 &/Z7K( 	F		,v"6"GHIA~f!5!C(,f%#)== ')#"OOO<	 $1 $  )j"88(,(E(Es6{* ( 011Q1)f%	7 $ =T: 2s   	L	L#	Lstream_namemaximum_sizepagesc                    | j                   dz   |z   }t        j                  j                  } || j                  |      }| j                   | j
                  j                   ||d      <   || j
                  j                   ||d      <   || j
                  j                   ||d      <   t        | j
                  ||      }| j
                  j                  j                  |       |S )N_r$   ra   r`   )
r    r	   configuration	path_joinr   r   r)   PdbMSFStreamlayers	add_layer)r3   r_   r`   ra   
layer_namere   r   layers           r   rN   z-PdbMultiStreamFormat.create_stream_from_pagest   s     YY_{2
,,66	 0 0+>DHIIIk<@A?DIk7;<FRIk>BCT\\;
C%%e,r   c                 ^   | j                   D ]  }| j                  t        j                  z   |z   }| j                  j                  || j                  d      }t        j                  |j                        | j                   |   k(  sz|j                  dk  r|j                  dkD  r||fc S  y)zPVerifies the header of the PDB file and returns the version of the
        file.r      i   N)_headersr9   r
   BANGr   rL   r*   r   array_to_stringMagicrK   )r3   headerheader_typecurrent_headers       r   r/   z"PdbMultiStreamFormat._check_header   s     mm 	2F//)..@6IK!\\00d>N>NPQRN&&~';';<f@UU"++e3%..-@!>11	2 r   c                 .    | j                   j                  S r7   )r1   rK   r8   s    r   rP   zPdbMultiStreamFormat.page_size   s    ||$$$r   c                     | j                   gS )zMReturns a list of the lower layers that this layer is dependent
        upon.r*   r8   s    r   dependenciesz!PdbMultiStreamFormat.dependencies   s       !!r   c                 2    t        j                  dd      gS )Nr$   F)r    optional)r   TranslationLayerRequirementclss    r   get_requirementsz%PdbMultiStreamFormat.get_requirements   s     44,QVW
 	
r   c                 \    | j                   j                  | j                     j                  S r7   )r   rg   r*   maximum_addressr8   s    r   r   z$PdbMultiStreamFormat.maximum_address   #    ||""4#3#34DDDr   c                 \    | j                   j                  | j                     j                  S r7   )r   rg   r*   minimum_addressr8   s    r   r   z$PdbMultiStreamFormat.minimum_address   r   r   r;   lengthc                 h    | j                   j                  | j                     j                  ||      S r7   r   rg   r*   is_validr3   r;   r   s      r   r   zPdbMultiStreamFormat.is_valid   *    ||""4#3#34==ffMMr   ignore_errorsc              #   2   K   ||||| j                   f y wr7   rv   )r3   r;   r   r   s       r   mappingzPdbMultiStreamFormat.mapping   s      fffd.>.>>>s   rf   c                     | j                          || j                  vrt        | j                  d      | j                  |   r8| j                  j
                  | j                  |      }t        |t              r|S y )NzStream not present)r^   r2   r   r    r   rg   
isinstancerf   )r3   indexrj   s      r   
get_streamzPdbMultiStreamFormat.get_stream   sg    %$TYY0DEE==LL''e(<=E%.r   r7   rB   F)"r   r   r   rm   rQ   r   r   r   r(   propertyr9   r^   intr   rN   r   r	   objectsObjectInterfacer/   rP   rw   classmethodrd   RequirementInterfacer}   r   r   boolr   r   r   r   __classcell__r5   s   @r   r   r      s   JAH .2+6+ + 	+
 4S>*+ 
+& &# & &CJ.1:>s)	xc:3E3E3U3U.U(VW  % % "d3i " "
 
j&>&>&S&S!T 
 

 E E E E E ENs NC N N ?D??#&?7;?	%S#sC/0	1?
8N#; r   r   c                   N    e Zd Z	 ddddededeeeef      ddf
 fdZedee   fd	       Z	e
deej                  j                     fd
       Z	 ddedededeeeeeeef      fdZedee   fd       ZddededefdZedefd       Zedefd       Zedefd       Z xZS )rf   Nr   r   r   r    r!   r"   c                 B   t         |   ||||       | j                  d   | _        | j                  j	                  dd       | _        t        | j
                        | _        | j
                  st        |d      t        | j                  t              st        d      y )Nr$   ra   zInvalid/no pages specifiedz/Base Layer must be a PdbMultiStreamFormat layer)r'   r(   r)   r*   get_pageslen
_pages_lenr   r   
_pdb_layerr   	TypeError)r3   r   r   r    r!   r5   s        r   r(   zPdbMSFStream.__init__   s     	+tX>;;|4kkoogt4dkk*{{$T+GHH$//+?@MNN Ar   c                     | j                   j                  | j                     }t        |t              r|j
                  S y r7   )_contextrg   r*   r   r   r9   )r3   rj   s     r   r9   zPdbMSFStream.pdb_symbol_table   s6    $$T%5%56e12)))r   c                     t        j                  dt        d      t        j                  d      t        j                  d      gS )Nra   rB   )r    element_typemin_elementsr$   )r    r`   )r   ListRequirementr   rz   IntRequirementr{   s    r   r}   zPdbMSFStream.get_requirements   sA     ((3Q 44,G''^<
 	
r   r;   r   r   c              #     K   d}| j                   j                  }|dkD  rt        j                  ||z   |z        }||z   |z  }t	        ||z
  |      }|| j
                  k\  r&|sMt        j                  | j                  ||z         ||z   || j                  |   |z  |z   || j                  f ||z  }||z  }|dkD  ry y w)Nr   )ri   invalid_address)r   rP   rG   floorminr   r   InvalidAddressExceptionr    r   r*   )	r3   r;   r   r   returnedrP   pagepage_position
chunk_sizes	            r   r   zPdbMSFStream.mapping   s      OO--	qj::v0I=>D#h.);MY6?Jt&$$<<#'99fx>O  x'KK%	1!6"#-t/?/?@ @ 
"Hj F qjs   B=C Cc                     | j                   gS r7   rv   r8   s    r   rw   zPdbMSFStream.dependencies   s      !!r   c                 h    | j                   j                  | j                     j                  ||      S r7   r   r   s      r   r   zPdbMSFStream.is_valid   r   r   c                      y)Nr   r   r8   s    r   r   zPdbMSFStream.minimum_address   s    r   c                     | j                   j                  dt        | j                        | j                  j
                  z        S )Nr`   )r)   r   r   r   r   rP   r8   s    r   r   zPdbMSFStream.maximum_address   s4    {{C,t/H/HH
 	
r   c                    | j                   | j                  j                  vr#t        | j                   d| j                          | j                  j                  | j                      }t	        |t
              r|S t        d      )Nz%No PdbMultiStreamFormat layer found: z&Base layer is not PdbMultiStreamFormat)r*   r   rg   r   r   r   r   )r3   results     r   r   zPdbMSFStream._pdb_layer  sy    4==#7#77$  78H8H7IJ  %%d&6&67f23M@AAr   r7   r   r   )r   r   r   rQ   r   r   r   r(   r   r9   r   r   r	   rd   r   r}   r   r   r   r   r   rw   r   r   r   r   r   r   r   s   @r   rf   rf      sm    .2O6O O 	O
 4S>*O 
O  (3-   
j&>&>&S&S!T 
 
 ?D!!#&!7;!	%S#sC/0	1!* "d3i " "Ns NC N N    
 
 

 	B0 	B 	Br   rf   )rG   typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.objectsr   volatility3.framework.symbolsr   LayerExceptionr   LinearlyMappedLayerr   rf   r   r   r   <module>r      sa     = = C C < / 1 2K22 Kf655 fRSB6-- SBr   