
    Xf2                     B   d dl Z d dlZd dlmZmZmZmZmZmZm	Z	m
Z
 d dlmZmZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ  ej:                  e      Z G d
 dej@                        Z! G d dej@                        Z" G d dejF                        Z$y)    N)AnyCallableDictIterableListOptionalTupleUnion)	constants
exceptions
interfacesobjects)requirements)IntRequirementTranslationLayerRequirement)InvalidAddressException)linear)intermed)pslistc                       e Zd ZdZy)RegistryFormatExceptionzEThrown when an error occurs with the underlying Registry file format.N__name__
__module____qualname____doc__     W/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/registry.pyr   r      s    Or   r   c                       e Zd ZdZy)RegistryInvalidIndexzAThrown when an index that doesn't exist or can't be found occurs.Nr   r   r   r   r!   r!      s    Kr   r!   c                       e Zd Z	 d%dej                  j
                  dededeeee	f      ddf
 fdZ
d Zdefd	Zedefd
       Zedef fd       Zedefd       ZdeddfdZdeddfdZ	 d&dededeeej0                     ej0                  f   fdZ	 d%deej0                  gdf   deej0                     ddfdZededededefd       Zedeej>                  j@                     fd       Z!dedefdZ"	 d&dededede#e$eeeeef      fd Z%edee   fd!       Z&d'dededefd"Z'edefd#       Z(edefd$       Z) xZ*S )(RegistryHiveNcontextconfig_pathnamemetadatareturnc           
         t         	|   ||||       | j                  d   | _        | j                  d   | _        | j                  d   | _        d| _        t        j                  j                  || j                  dd      | _        | j                  j                  | j
                  t        j                  z   dz   | j                  | j                        }|j!                         | _        |j$                  | _        | j&                  j(                  d	k7  r$t+        | j,                  d
| j                   d      t.        j0                  j3                  | j                  | j                  d   | j                  d         D ]l  }|j4                  j7                  d|j4                  j8                  j:                  d      }|dk(  sE|j<                  dk(  sU|j?                         }|| _         n | j&                  j@                  jC                         | _"        d| _#        	 | j&                  jH                  d   jJ                  | _&        | j&                  jH                  d   jJ                  | _'        d| jN                  z  | _(        tR        jU                  t        jV                  d| j,                   dtY        | jP                                y # tZ        j\                  $ rl d| _&        d| _'        d| jN                  z  | _(        tR        jU                  t        jV                  d| j,                   dtY        | jP                                Y y w xY w)N)r$   r%   r&   r'   
base_layerhive_offset
nt_symbolsi   windowsregistry_CMHIVEl   >} zRegistry hive at z  does not have a valid signaturestringreplace)
max_lengtherrorsRegistry   r              zSetting hive z max address to zException when setting hive z max address, using )/super__init__config_base_layer_hive_offset_table_name
_page_sizer   IntermediateSymbolTablecreate_config_path_reg_table_namer$   objectr   BANGget_name_cmhive_nameHivehive	Signaturer   r&   r   PsListlist_processesImageFileNamecastvolcountInheritedFromUniqueProcessIdadd_process_layer	BaseBlockdereference_base_block_minaddrStorageLength_hive_maxaddr_non_volatile_hive_maxaddr_volatile_maxaddrvolloglogLOGLEVEL_VVVVhexr   r   )
selfr$   r%   r&   r'   cmhiveproc	proc_nameproc_layer_name	__class__s
            r   r:   zRegistryHive.__init__   s    	4( 	 	
  ;;|4 KK6;;|4!'??FFT&&	: 
 $$y~~-	9

 #OO-KK	 99*,)		#D$5$5#66VW  MM00LL$++l3T[[5N
 		D **//T%7%7%;%;%A%A) 0 I J&4+L+LPQ+Q"&"8"8":#2 		  99..::<	.2ii.?.?.B.I.ID+*.))*;*;A*>*E*ED'&)D)DDDMJJ''		{*:3t}};M:NO 11 	.8D+*4D'&)D)DDDMJJ''.tyyk9McRVR_R_N`Mab		s    B+K A<M
Mc                 6    |r| j                   S | j                  S N)rZ   rY   )r`   volatiles     r   _get_hive_maxaddrzRegistryHive._get_hive_maxaddrc   s     +3D''	
9=9X9X	
r   c                 "    | j                   xs dS )Nz[NONAME])rG   r`   s    r   rF   zRegistryHive.get_nameh   s      .J.r   c                     | j                   S rg   )r=   rk   s    r   r+   zRegistryHive.hive_offsetk   s       r   c                     t         |   dz  S )z9Return a mask that allows for the volatile bit to be set.r7   )r9   address_mask)r`   re   s    r   rn   zRegistryHive.address_masko   s     w#j00r   c                     t        j                  t              5  | j                  j                  j                  ddd      dk(  r| j                  j                  cddd       S 	 ddd       y# 1 sw Y   yxY w)z2Returns the offset for the root cell in this hive.r0   r5   latin-1r2   encodingregfN    )
contextlibsuppressr   rU   rJ   rN   RootCellrk   s    r   root_cell_offsetzRegistryHive.root_cell_offsett   s}       !89 	1  **//Y 0  
 ''00	1 	1	1 	1 s   AA//A8cell_offsetzobjects.StructTypec                     | j                   j                  | j                  t        j                  z   dz   |dz   | j
                        }|S )z5Returns the appropriate Cell value for a cell offset.
_CELL_DATAr5   )object_typeoffset
layer_name)_contextrD   r>   r   rE   r&   )r`   ry   cells      r   get_cellzRegistryHive.get_cell   sI     }}##((9>>9LH?yy $ 

 r   c                    | j                  |      }|j                  ddd      }|dk(  r|j                  j                  S |dk(  r|j                  j                  S |dk(  r|j                  j
                  S |dk(  r|j                  j                  S |d	k(  s
|d
k(  s|dk(  r|j                  j                  S t        j                  dj                  ||j                  j                  j                  |             |S )zWReturns the appropriate Node, interpreted from the Cell based on its
        Signature.r0      rp   rq   nkskvkdblflhriz*Unknown Signature {} (0x{:x}) at offset {})r   rN   uKeyNodeKeySecurityKeyValue	ValueDataKeyIndexr\   debugformatrJ   )r`   ry   r   	signatures       r   get_nodezRegistryHive.get_node   s     }}[)IIh1yII	66>>!$66%%%$66??"$66###$)t"3yD7H66??" LL<CCtvv~~77
 Kr   keyreturn_listc                    | j                  | j                        }|j                  j                  j	                  t
        j                  dz         s9t        | j                  dj                  |j                  j                              |g}|j	                  d      r|dd }|j                  d      }g }|rk|ri|d   j                         }|D ]J  }|j                         j                         |d   j                         k(  s6||gz   }||d   gz   |dd }} n g }|r|ri|s-t        dj                  |d   dj                  |                  |r|S |d   S )	zGets a specific registry key by key path.

        return_list specifies whether the return result will be a single
        node (default) or a list of nodes from root to the current node
        (if return_list is true).
        _CM_KEY_NODEz&Encountered {} instead of _CM_KEY_NODE\Nr   r6   zKey {} not found under {})r   rx   rO   	type_nameendswithr   rE   r   r&   r   splitget_subkeysrF   lowerKeyErrorjoin)	r`   r   r   	root_nodenode_key	key_array	found_keysubkeyssubkeys	            r   get_keyzRegistryHive.get_key   sc    MM$"7"78	}}&&//	0OP)		8??MM++  ;<<cr(CIIdO	!	Hrl..0G!  ??$**,	!0B0B0DD'6(2H+4	!~+EyQRQS}yI  H +229Q<9AUV  O|r   visitornodec                     |s| j                  | j                        } ||       |j                         D ]  }| j                  ||        y)z]Applies a callable (visitor) to all nodes within the registry tree
        from a given node.N)r   rx   r   visit_nodes)r`   r   r   s      r   r   zRegistryHive.visit_nodes   sJ     ==!6!67D$$& 	,DWd+	,r   valuehigh_bitlow_bitc                 <    d|dz   z  dz
  }d|z  dz
  }||z  }| |z  S )zAReturns the bits of a value between highbit and lowbit inclusive.r   r6   r   )r   r   r   	high_masklow_maskmasks         r   _maskzRegistryHive._mask   s9     8a<(A-	wJ!#8#t|r   c                 h    t        dddd      t        j                  dd      t        d	d
d      gS )Nr+   z4Offset within the base layer at which the hive livesr   F)r&   descriptiondefaultoptionalr,   zWindows kernel symbols)r&   r   r*   z&Layer in which the registry hive lives)r&   r   r   )r   r   SymbolTableRequirementr   )clss    r   get_requirementszRegistryHive.get_requirements   sK     "R	 //!/G (!D
 	
r   r}   c                    | j                  |dd      dz	  }|dz  | j                  |      kD  rt        j                  t        j
                  dj                  | j                  t        |dz        t        | j                  |            |rdnd| j                                      t        | j                  d      | j                  j                  |   }| j                  |dd      dz	  }| j                  |d	d
      d
z	  }| j                  |dd      dz	  }|j                  j                  |   }|j                  |   }|j!                         |z   S )z[Translates a single cell index to a cell memory offset and the
        suboffset within it.   r8   zHLayer {} couldn't translate offset {}, greater than {} in {} store of {}volativeznon-volatilez.Mapping request for value greater than maxaddr               r   )r   ri   r\   r]   r   LOGLEVEL_VVVr   r&   r_   rF   r!   rI   rW   Map	DirectoryTableget_block_offset)	r`   r}   rh   storage	dir_indextable_index	suboffsettableentrys	            r   
_translatezRegistryHive._translate   s7   
 ::fb"-3J!7!7!AAJJ&&ZaaII+,..x89"*JMMO	 '		K  ))##H-JJvr2."4	jjR0B6JJvr1-2	%%i0K(%%')33r   lengthignore_errorsc                 |   |dk  rt        d      g }|}|}| j                  || j                  dz
  z  z
  }|dkD  ret        ||| j                        }	 | j                  |      }|j	                  ||||| j
                  f       ||z  }||z  }| j                  }|dkD  re|S # t        j                  $ r |s Y 6w xY w)Nr   z7Mapping length of RegistryHive must be positive or zeror6   )
ValueErrorr?   minr   appendr<   r   LayerException)	r`   r}   r   r   responsecurrent_offsetremaining_length
chunk_sizetranslated_offsets	            r   mappingzRegistryHive.mapping  s     A:VWW
 !__$//A2E(FG
"Z)94??KJ$(OON$C!&")"(( j(N
*J% "&  ,, $ %s   1B" "B;:B;c                 "    | j                   d   gS )z>Returns a list of layer names that this layer translates onto.r*   )r;   rk   s    r   dependencieszRegistryHive.dependencies7  s     L)**r   c                 <   t        j                  t        j                        5  t	        | j                  ||      D cg c]1  \  }}}}}| j                  j                  |   j                  ||      3 c}}}}      cddd       S c c}}}}w # 1 sw Y   yxY w)z>Returns a boolean based on whether the offset is valid or not.NF)	ru   rv   r   r   allr   r$   layersis_valid)r`   r}   r   _layers        r   r   zRegistryHive.is_valid<  s      !C!CD 	 :>ff9U 5Avvu LL''.77G	 		 s   B6B
7	B
BBc                     | j                   S rg   )rV   rk   s    r   minimum_addresszRegistryHive.minimum_addressH      }}r   c                     | j                   S rg   )r[   rk   s    r   maximum_addresszRegistryHive.maximum_addressL  r   r   rg   )F)r6   )+r   r   r   r   r$   ContextInterfacestrr   r   r   r:   ri   rF   propertyintr+   rn   rx   r   r   boolr
   r   r   
StructTyper   r   r   staticmethodr   classmethodconfigurationRequirementInterfacer   r   r   r	   r   r   r   r   r   __classcell__)re   s   @r   r#   r#      s    .2B##44B B 	B
 4S>*B 
BH

/# / !S ! ! 1c 1 1 
# 
 
C ,@ C ,@ 6 -2''%)'	tG&&'););;	<'X .2,7--.45, w))*, 
	, S C # #   
j&>&>&S&S!T 
 
$4 4 4> ?D  #& 7; 	%S#sC/0	1 D +d3i + +
s 
C 
 
      r   r#   )%ru   loggingtypingr   r   r   r   r   r   r	   r
   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   0volatility3.framework.configuration.requirementsr   r    volatility3.framework.exceptionsr   volatility3.framework.layersr   volatility3.framework.symbolsr   volatility3.plugins.windowsr   	getLoggerr   r\   r   r   r!   LinearlyMappedLayerr#   r   r   r   <module>r      s      N N N L L < E / 2 .			8	$Pj77 PL:44 Lp6-- pr   