
    XfT                        d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZm	Z	m
Z
mZ d dlmZmZmZ d dlmZmZ d dlmZ  ej*                  e      Z G d dej0                        Z G d d	ej4                  j6                        Zy)
    N)AnyDictListOptionalSetTuple)	constants
exceptions
interfaces)scanners	segmented)intermedc                       e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZ ej.                  d      d ej.                  d      d ej.                  d      d ej.                  d      d ej.                  d      d ej.                  dez   dz         d ej.                  dez   dz         diZ	 d8dej4                  j6                  d ed!ed"eeeef      d#df
 fd$Z e!	 d9d%ejD                  jF                  d!efd&       Z$d%ejD                  jF                  d!ed#efd'Z%d(e&d)e&d#e'e(e'e&e&e&e&f      e&f   fd*Z)d+ Z*d#efd,Z+d- Z,d.e-d/e&d0e&d1e&d#e-f
d2Z. e/j`                  d34      d:d0e&d5e&d6e1d#e-f fd7       Z2 xZ3S );QemuSuspendLayerz)A Qemu suspend-to-disk translation layer.r                        ~             @      z(\w+[\d{1,2}\.]*)z"^pc-i440fx-([23456789]|\d\d+)\.\d$)      @                 z^pc-i440fx-[01]\.\d$)r   r   r    z^pc-q35-\d\.\d$)l      ` l        r    z	^microvm$)r   r   r    z^xen$)      ` r!   r    z^pc-i440fx-$z^pc-q35-Ncontextconfig_pathnamemetadatareturnc                     t         j                  j                  ||dd      | _        d | _        d | _        t               | _        d| _        d| _	        d| _
        d| _        t        | 5  ||||       y )Ngenericqemu    r   )r#   r$   r%   r&   )r   IntermediateSymbolTablecreate_qemu_table_name_configuration_architectureset_compressed_current_segment_name_pci_hole_start_pci_hole_end_pci_hole_minimumsuper__init__)selfr#   r$   r%   r&   	__class__s        S/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/qemu.pyr8   zQemuSuspendLayer.__init__Q   s~     !) @ @ G G[)V!
 #!%(U%(" !"4( 	 	
r+   
base_layerc                     |j                  dd      }|d d dk7  rt        j                  |d      |dd  dk7  rt        j                  |d      t        j	                  d       y )	Nr   r   r   s   QEVMzNo QEMU magic bytess      zUnsupported QEMU version foundzQEVM header found)readr
   LayerExceptionvollogdebug)clsr<   r%   headers       r;   _check_headerzQemuSuspendLayer._check_headerf   sg     A&"1:,,++D2GHH!":,,++D2RSS()r+   c                    d}d}t        |j                  dz   |j                  |       D ]  }||j                  dz   k7  s|j                  ||      |z   j	                  d      }d|v s?|j                  d      }|j                  d|      }|dk\  r||d }t        j                  |      c S t               c S  t        j                  |d      )	z5Reads the JSON configuration from the end of the file   r+   r          {r   Nz1Invalid JSON configuration at the end of the file)rangemaximum_addressminimum_addressr>   rstriprfindfindjsonloadsdictr
   r?   )r9   r<   r%   
chunk_sizedatailast_null_bytestart_of_jsons           r;   _read_configurationz$QemuSuspendLayer._read_configurationq   s     
&&*J,F,F
 	"A J..22":6=EEgNd?%)ZZ%8N$(IIdN$CM$)#MN3#zz$//6M	" ''E
 	
r+   index	page_sizec                 N   d}g }i }| j                   j                  | j                     }|sqt        j                  d|j                  |d            d   }||dz
  z  }|||dz
  z  z  }|dz  }|| j                  k\  r|| j                  | j                  z
  z  }|| j                  z  r| j                  j                  | j                  t        j                  z   dz   || j                        }	|	dk7  r| j                  j                  | j                  t        j                  z   dz   |dz   |	z   | j                        }
|
||j                  |dz   |	      <   |d|	z   dz   z  }| j                  j                  | j                  t        j                  z   dz   || j                        }	|	dk7  rt        | j                  j!                         D cg c]  }|d   	 c}      dz   }|j#                  d	|      | j$                  k  rEt&        j)                  d
|j#                  d	      dd| j$                  d       d\  | _        | _        || j*                  | j,                  z  z  r|| j.                  z  sh| j                  j                  | j                  t        j                  z   dz   || j                        }	|j                  |dz   |	      | _        |d|	z   z  }|| j*                  z  rE| j0                  d	k(  r0|j3                  |||df       | j4                  j7                  |       |dz  }n)| j0                  d	k(  r|j3                  ||||f       ||z  }|| j8                  z  r t;        j<                  | j>                  d      || j@                  z  rd}|sq||fS c c}w )zDRecovers the new index and any sections of memory from a ram sectionNz>Qr   r   r   unsigned charoffset
layer_nameunsigned long longs   pc.ramz5QEVM turning off PCI hole due to small image size: 0xxz < 0x)r   r   z XBZRLE compression not supportedT)!r#   layers_base_layerstructunpackr>   r4   r5   SEGMENT_FLAG_MEM_SIZE_contextobjectr.   r	   BANGmaxpci_hole_tablevaluesgetr6   r@   rA   SEGMENT_FLAG_COMPRESSSEGMENT_FLAG_PAGESEGMENT_FLAG_CONTINUEr3   appendr2   addSEGMENT_FLAG_XBZRLEr
   r?   r%   SEGMENT_FLAG_EOS)r9   rX   rY   donesegments
size_arrayr<   addrflagsnamelen
total_sizer`   highest_possible_maximums                r;   _get_ram_segmentsz"QemuSuspendLayer._get_ram_segments   s    
\\(()9)9:
==zua'@A!DD IM*E 49q=12DQJEt+++**T-A-AAAt111--..))INN:_L #// / 
 l!%!5!5--	>AUU$qy72#'#3#3 "6 "J
 GQJzuqy'BCQ[1_,E"mm22--	>P$#'#3#3 3 G l t':':'A'A'CD!1DEI ) NN9.FG,,- LLOPZP^P^_hPijkOllqrv  sI  sI  JK  rL  M @D<D($*<22T5K5KKL : ::"mm22--	>P$#'#3#3 3 G
 2<G1TD.Q[(E455511Y> ui(CD((,,T2QJE11Y> ui(KLY&Et/// //IIA  t,,,K L I Es   N"c                 
   | j                   j                  | j                     }| j                  || j                         | j
                  s!| j                  || j                        | _        d}d}t               }d}d}|| j                  k7  r||j                  k  r|dkD  r|s| j                  sE| j                         | _
        | j                  $t        j                  t        j                  d       | j                   D ]r  }|j#                  | j                        s| j                   |   \  | _        | _        | _        t        j                  t        j*                  d| j                           n2 t        j                  t        j*                  d| j                          d}| j                   j-                  | j.                  t        j0                  z   d	z   || j                  
      }|dz  }|| j2                  k(  r| j                   j-                  | j.                  t        j0                  z   dz   || j                  
      }| j                   j-                  | j.                  t        j0                  z   dz   |dz   | j                  |      | _
        |d|z   z  }n|| j4                  k(  s|| j6                  k(  rQ| j                   j-                  | j.                  t        j0                  z   dz   || j                  
      }	|	}|dz  }| j                   j-                  | j.                  t        j0                  z   d	z   || j                  
      }
|dz  }| j                   j-                  | j.                  t        j0                  z   dz   || j                  |
      }||
z  }|dz  }| j                   j-                  | j.                  t        j0                  z   dz   || j                  
      }|dz  }||d||<   | j9                  |||      }nC|| j:                  k(  s|| j<                  k(  rm| j                   j-                  | j.                  t        j0                  z   dz   || j                  
      }	|	}|dz  }| j9                  |||   d   ||   d         }n|| j>                  k(  rv| j                   j-                  | j.                  t        j0                  z   dz   || j                  
      }	|dz  }|	|k7  rYtA        jB                  | jD                  d| d|	       || j                  k(  rn#tA        jB                  | jD                  d|       || j                  k7  r||j                  k  ry y y y )Nr   F   z)QEVM architecture could not be determinedzQEVM architecture detected as: z!QEVM unknown architecture found: Tr[   r\   r   unsigned longstringr   )r]   r^   
max_length)r%   
version_idr%   r   zQEMU section footer mismatch: z and z"QEMU unknown section encountered: )#r#   ra   rb   rD   r%   r/   rW   rQ   QEVM_EOFrJ   r0    _fallback_determine_architecturer@   logr	   LOGLEVEL_VVrj   matchr6   r4   r5   LOGLEVEL_VVVVrg   r.   rh   QEVM_CONFIGURATIONQEVM_SECTION_STARTQEVM_SECTION_FULLextract_dataQEVM_SECTION_PARTQEVM_SECTION_ENDQEVM_SECTION_FOOTERr
   r?   _name)r9   r<   section_byterX   section_infocurrent_section_idarch_detectedregexsection_len
section_idname_lenr%   r   s                r;   _load_segmentszQemuSuspendLayer._load_segments   s[   \\(()9)9:
:tyy1"""&":"::tyy"QDvdmm+9S9S0Srz- )))-)N)N)PD&))1

%11G "00 E{{4#5#56
 !//6	 2 0 .

%33=d>P>P=QR  JJ!//;D<N<N;OP !%<<..%%	6H++ / L
 QJEt666"ll11))INN:_L #// 2 
 &*\\%8%8))INN:XE 19#//*	 &9 &" [( 7 774#9#99!\\00))INN:_L #// 1 

 &0"
<<..))INN:_L #// / 
 
||**))INN:XE #//'	 +  ! 
!\\00))INN:_L #// 1 

 
 !",4/0
 ))%zB 6 664#8#88!\\00))INN:_L #// 1 

 &0"
)) !34V< !34\B
 !9!99!\\00))INN:_L #// 1 

 
!33$33

89K8LER\Q]^  . //JJ"D\N S y dmm+9S9S0S+0S+r+   c                 T   d}d}| j                   j                  | j                     }t        j	                  t
        j                  d       t        j                  |      }|j                  | j                   |      D ]K  }|j                  |d      }t        j                  ||      }|j                         j                         }|c S  d }| j                  j!                  dg       D ]<  }	|	j!                  dd      j#                         }
d	|
v sd
|
v rd|z   } nd|
v s7d|z   } n |r)t        j	                  t
        j$                  d|        |S d}t        j                  |      }|j                  | j                   |      D ]  }|j                  |d      }t        j                  ||      }d|j'                         d   j                         j#                         z   |z   }t        j	                  t
        j$                  d|        |c S  t        j)                  d       y )Ns2   pc-(i440fx|q35)-(\d{1,2}\.\d{1,2}|\w+[\d{1,2}\.]*)z-2.0z)QEVM fallback architecture detection used)r#   scannerr   devices	vmsd_name i440fxpiixz	pc-i440fxich9zpc-q35z,Architecture version unknown, default used: s   Standard PC \((i440FX|Q35)zpc-r   z-Could not determine QEMU target architecture!)r#   ra   rb   r@   r   r	   r   r   RegExScannerscanr>   researchgroupdecoder/   rl   lowerLOGLEVEL_VVVgroupswarning)r9   architecture_patterndefault_suffixr<   resr]   lineregex_resultsarchitecturedevicedevice_names              r;   r   z1QemuSuspendLayer._fallback_determine_architecturef  s   U\\(()9)9:


9**,WX##$89 oodllCoH 	 F??62.DII&:DAM(..0779L		  ))--i< 	F **["5;;=K;&&K*?*^;;&'.8	 JJ&&>~>NO    >##$89 oodllCoH 
	 F??62.DII&:DAM,,.q188:@@BB^S  JJ&&>~>NO  
	  	FGr+   c                    |dk(  rc|dk7  rt        j                  d|       | j                  || j                  j	                  dd            \  }}| xj
                  |z  c_        |S |dk(  r|dk7  rt        j                  d|       | j                  j                  | j                  t        j                  z   d	z   || j                  
      }|dz  }|dk(  rd}d}d}|dk7  r{|dk7  rv|dk7  rq| j                  j                  | j                  t        j                  z   dz   || j                  
      }	|	\  }}}|d|| j                  z  z   z  }|dk7  r|dk7  r|dk7  rq|S |dk(  r|dz  }|S |dk(  rN| j                  j                  | j                  t        j                  z   dz   || j                  
      }
|d|
z   z  }|S )Nramr   zQEMU unknown RAM version_id rY   rF   z
spapr/htabr   zQEMU unknown HTAB version_id r   r\   r   r~   htabr   zdirty-bitmapz	pbs-stater_   )r
   r?   r|   r/   rl   	_segmentsr#   rg   r.   r	   rh   rb   HASH_PTE_SIZE_64)r9   rX   r%   r   new_segmentsrC   
htab_indexhtab_n_validhtab_n_invalidr   r   s              r;   r   zQemuSuspendLayer.extract_data  s   5=Q //2:,?  #'"8"8t**..{DA#L% NNl*NB A \!Q //3J<@  \\((%%	6H++ ) F
 QJE{
 !" Ao,!*;RS@S<<..--	>G$#'#3#3 / D
 @D<JnQ,1F1F"FGGE !Ao,!*;RS@S"  ^#QJE  [ ,,--%%	69MM++ . K
 Q_$Er+   rS   mapped_offsetr]   output_lengthc                     | j                   j                  dd      }|||dz
  z  z  }|| j                  v r||z  }|||z
  ||z   |z
   }|S )a  Takes the full segment from the base_layer that the data occurs in, checks whether it's compressed
        (by locating it in the segment list and verifying if that address is compressed), then reading/expanding the
        data, and finally cutting it to the right size.  Offset may be the address requested rather than the location
        of the starting data.  It is the responsibility of the layer to turn the provided data chunk into the right
        portion of data necessary.
        rY   rF   r   )r/   rl   r2   )r9   rS   r   r]   r   rY   start_offsetresults           r;   _decode_datazQemuSuspendLayer._decode_data  si     ''++K>	 9q=!9:4+++)#Df|+mf.D|.STr+   i   )maxsizelengthpadc                 &    t         |   |||      S N)r7   r>   )r9   r]   r   r   r:   s       r;   r>   zQemuSuspendLayer.read  s    w|FFC00r+   r   )r   )F)4__name__
__module____qualname____doc__r   r   r   r   r   QEVM_SUBSECTIONQEVM_VMDESCRIPTIONr   r   r   rm   re   rn   rs   ro   rr   SEGMENT_FLAG_HOOK	distro_rer   compilerj   r   r#   ContextInterfacestrr   r   r   r8   classmethodra   DataLayerInterfacerD   rW   intr   r   r|   r   r   r   bytesr   	functools	lru_cacheboolr>   __classcell__)r:   s   @r;   r   r      s   3HO   & %I 	

89 <

 	

*+-R

%&(M

< "G

8C

>I-45 8

 	

;*T12 5
N6 .2
##44
 
 	

 4S>*
 

* KM*#**==*EH* *
$++>>
FI
	
2PP%(P	tE#sC,-.3	4PdHT/# /b*X*-7:KN	$ Y%13 1 1$ 15 1 &1r+   r   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	QemuStacker
   Nr#   r^   progress_callbackr'   c                 H   	 t         j                  |j                  |          |j                  j                  d      }||j                  t        j                  j                  |d      <   t        |||      }| j                          |S # t        j                  $ r Y y w xY w)Nr   r<   )r   rD   ra   r
   r?   free_layer_nameconfigr   configuration	path_joinstacker_slow_warning)rB   r#   r^   r   new_namelayers         r;   stackzQemuStacker.stack  s    	**7>>*+EF >>112DE 	z//99(LQR !(H=  " (( 		s   "B B! B!r   )r   r   r   stack_orderr   r   r#   r   r   r	   ProgressCallbackr   ra   r   r    r+   r;   r   r     sg    K
 9=	##44  %55	
 
*##66	7 r+   r   )r   rO   loggingr   rc   typingr   r   r   r   r   r   volatility3.frameworkr	   r
   r   volatility3.framework.layersr   r   volatility3.framework.symbolsr   	getLoggerr   r@   NonLinearlySegmentedLayerr   	automagicStackerLayerInterfacer   r   r+   r;   <module>r      sg       	  8 8 C C < 2			8	$E1y:: E1P*&&<< r+   