
    XfA(                        d dl Z d dlZd dlZd dlZd dlmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZmZmZ d dlmZ  ej        e          Z G d dej                  Z G d	 d
ej                  Z G d dej        j                  ZdS )    N)AnyDictListOptional)	constants
exceptions
interfaces)requirements)physical	resources	segmented)nativec                       e Zd ZdZdS )VmwareFormatExceptionzHThrown when an error occurs with the underlying VMware vmem file format.N)__name__
__module____qualname____doc__     U/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/vmware.pyr   r      s        RRRRr   r   c                       e Zd ZdZdZ	 ddej        j        dedede	e
eef                  ddf
 fd	Zdd
Zededefd            ZddZedee         fd            Zedeej        j                 fd            Z xZS )VmwareLayerz<4sII64sQQNcontextconfig_pathnamemetadatareturnc                     || _         || _        d| _        | j        d         | j        d         c| _        | _        t                                          ||||           d S )Ni   
base_layer
meta_layer)r   r   r   )_context_config_path
_page_sizeconfig_base_layer_meta_layersuper__init__)selfr   r   r   r   	__class__s        r   r*   zVmwareLayer.__init__   sg      ' K%K% 	+$*
 	kxXXXXXr   c                 .    |                                   dS )z*Loads up the segments from the meta_layer.N)_read_headerr+   s    r   _load_segmentszVmwareLayer._load_segments,   s    r   sizec                     | dk    rdndS )N   vmware!unsigned intzvmware!unsigned long longr   )r1   s    r   _choose_typezVmwareLayer._choose_type0   s    (,		$$7RRr   c           	         d| j         j        vr<| j         j                            t          j        dt          j                             | j        j                            | j	        d          }t          j        | j                  }|                    d|          }t          j        | j        |          \  }}}|dvr%t          | j        dt#          |                     |d         dz  }t          j        | j                  }i }	t'          |          D ]T}
t          j        | j        |                    ||
|z  z   |                    \  }}}|                    d          }||	|<   U|	d         }d	}|}i }| j         j                            d
          j        }|st/          |                    |d                    }t/          |                    |dz   d                    }|dk    o|dk    }|s| j                             d| j	        |dz   |          }|dz	  dz  }g }t'          |          D ]C}|                    | j                             d
||z   dz   ||z  z   | j	                             D|dz  }|dv r|dk    rdnd}| j                             |                     |          | j	        |dz   |z   ||z  z             }| j                             d| j	        |dz   |z   ||z  z   d|z  z   dz   |          }|d|z   ||z  z   d|z  z   dz   |z   z  }nR| j                             |                     |          | j	        |dz   |z   ||z  z             }|d|z   ||z  z   |z   z  }||f||t5          |          f<   ||d         d         dk    rt          | j        d          t'          |d         d                   D ]k}|d|ff         d         | j        z  }|d|ff         d         | j        z  }|d|ff         d         | j        z  }| j                            ||||f           ldS )z1Checks the vmware header to make sure it's valid.vmwareNr   )s   оҾs   ѺѺs   ҾҾs   ӾӾz$Wrong magic bytes for Vmware layer:        s   memoryFr4      zvmware!string   )
layer_nameoffset
max_length      )r=   r<   ?   )>   rA   r3      )r<   r=   zvmware!bytes)r<   r=   length)regionsCountr   z%VMware VMEM is not split into regions	regionPPNregionPageNum
regionSize)r#   symbol_spaceappendr   NativeTable
std_ctypesr   layersgetr(   structcalcsizeheader_structurereadunpackr   r   reprgroup_structurerangerstripget_typer1   ordobjectr5   tupler%   	_segments)r+   r"   header_sizedatamagicunknown
groupCountversion
group_sizegroupsgroupr   tag_location_unknownmemory	tags_readr=   tags	index_lenflagsname_lenindices_lenindicesindexdata_len	data_sizeregionmapped_offsetrD   s                                r   r.   zVmwareLayer._read_header4   sE   4=555M&--"8V->??   \(,,T-=tDD
od&;<<q+..%+]43H$%O%O"w
 
 
 
 (	O$u++OO   (S._T%9::
:&& 	( 	(E+1=$uz/A BJOO, ,(D, ;;w''D'F4LL	"	M.778MNNS	 ?	=
2233E:??6A:q99::H!8(a-I ;=}++##/!A:'	 ,    %zQ.";//  ENN,,1#)H#4q#8EI<M#N'+'7 -      !4<     %,qLLqqaH $ 4 4))(33#'#3%zH4i8OP !5 ! !I  =//&#'#3% " # '2 4 h,	 '
    ) 0 
 
D "#&24 h,' 	
 $$FF  =//))(33#'#3%zH4i8OP 0  D
 a(lkI.EFQQF05t}dE'NN+,  ?	=B $%a(A--'	B   D!56q9:: 	K 	KF;	23A6HF /F9!=>qADOSM<&34Q7$/IFN!!6=&&"IJJJJ		K 	Kr   c                     | j         | j        gS N)r'   r(   r/   s    r   dependencieszVmwareLayer.dependencies   s     $"233r   c                 Z    t          j        dd          t          j        dd          gS )zPThis vmware translation layer always requires a separate metadata
        layer.r!   F)r   optionalr"   )r
   TranslationLayerRequirement)clss    r   get_requirementszVmwareLayer.get_requirements   s6    
 4,QVWWW4,QVWWW
 	
r   rv   )r   N)r   r   r   rQ   rU   r	   r   ContextInterfacestrr   r   r   r*   r0   staticmethodintr5   r.   propertyr   rw   classmethodconfigurationRequirementInterfacer|   __classcell__)r,   s   @r   r   r      sc       O .2Y Y#4Y Y 	Y
 4S>*Y 
Y Y Y Y Y Y$    S3 S3 S S S \SoK oK oK oKb 4d3i 4 4 4 X4 
j&>&S!T 
 
 
 [
 
 
 
 
r   r   c                   |    e Zd ZdZe	 ddej        j        dede	j
        deej        j                 fd            ZdS )	VmwareStacker   Nr   r<   progress_callbackr   c                    |j         |         }t          |t          j                  sdS |j        }|                    d          r|dd         dz   }|dd         dz   }|j                             d          }t          j        	                    ddd	|          }	d
}
t          j        t                    5  t          j                                        |          5 }|                    d          }ddd           n# 1 swxY w Y   ||j        t          j        	                    |	d          <   |j                             t          j        ||	|                     d}
ddd           n# 1 swxY w Y   d
}|
st          j        t                    5  t          j                                        |                              d          }||j        t          j        	                    |	d          <   |j                             t          j        ||	|                     d}ddd           n# 1 swxY w Y   t&                              t*          j        d|
 d| d           |
sc|sat.          j                            |          }t.          j                            |          }t&                              d| d| d           dS |j                             d          }||j        t          j        	                    |	d          <   ||j        t          j        	                    |	d          <   t7          ||	|          }|S dS )z8Attempt to stack this based on the starting information.Nz.vmemz.vmssz.vmsnVmwareMetaLayer	automagiclayer_stackerstackF
   locationTzMetadata found: VMSS (z) or VMSN ()zNo metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. z and .r   r!   r"   )rM   
isinstancer   	FileLayerr   endswithfree_layer_namer	   r   	path_join
contextlibsuppressIOErrorr   ResourceAccessoropenrR   r&   	add_layervolloglogr   LOGLEVEL_VVVVospathbasenamewarningr   )r{   r   r<   r   memlayerr   vmssvmsncurrent_layer_namecurrent_config_pathvmss_successfp_vmsn_successvmem_file_basenameexample_vmss_file_basenamenew_layer_name	new_layers                     r   r   zVmwareStacker.stack   s;    >*-(H$677 	4$W%% 8	CRC=7*DCRC=7*D!(!?!?@Q!R!R",":"D"D_g7I# # !L$W-- 	$ 	$/1166t<< $A$ $ $ $ $ $ $ $ $ $ $ $ $ $ $  ,667JJWW ((&w0CEWXX    $	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ 	$ !L ((11 ( (!24499$??DDRHHA
 	 N"0::/ 
 N,, *#%8:L   
 $(L( ( ( ( ( ( ( ( ( ( ( ( ( ( ( JJ'QQQ,QQQ  
    %'W%5%5h%?%?"-/W-=-=d-C-C* K  Ug  K  K  nH  K  K  K   t$^;;MJJN  N(223FUU
 # N(223FUU $G-@.QQItsJ   8'E0D5E0D	E0D		AE00E47E4BH66H:=H:rv   )r   r   r   stack_orderr   r	   r   r}   r~   r   ProgressCallbackr   rM   DataLayerInterfacer   r   r   r   r   r      s        K
 9=	D D#4D D %5	D
 
*#6	7D D D [D D Dr   r   )r   loggingrO   r   typingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   r   r   volatility3.framework.symbolsr   	getLoggerr   r   LayerExceptionr   SegmentedLayerr   r   StackerLayerInterfacer   r   r   r   <module>r      ss         				 , , , , , , , , , , , , C C C C C C C C C C < < < < < < G G G G G G G G G G 0 0 0 0 0 0		8	$	$S S S S SJ5 S S SZ
 Z
 Z
 Z
 Z
)* Z
 Z
 Z
zH H H H HJ(> H H H H Hr   