
    XfA(                     2   d dl Z d dlZd dlZd dlZd dlmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZmZmZ d dlmZ  ej*                  e      Z G d dej0                        Z G d	 d
ej4                        Z G d dej8                  j:                        Zy)    N)AnyDictListOptional)	constants
exceptions
interfaces)requirements)physical	resources	segmented)nativec                       e Zd ZdZy)VmwareFormatExceptionzHThrown when an error occurs with the underlying VMware vmem file format.N)__name__
__module____qualname____doc__     U/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/vmware.pyr   r      s    Rr   r   c                       e Zd ZdZdZ	 ddej                  j                  dedede	e
eef      ddf
 fd	Zdd
Zededefd       ZddZedee   fd       Zedeej,                  j.                     fd       Z xZS )VmwareLayerz<4sII64sQQNcontextconfig_pathnamemetadatareturnc                     || _         || _        d| _        | j                  d   | j                  d   c| _        | _        t        |   ||||       y )Ni   
base_layer
meta_layer)r   r   r   )_context_config_path
_page_sizeconfig_base_layer_meta_layersuper__init__)selfr   r   r   r   	__class__s        r   r*   zVmwareLayer.__init__   sZ      ' KK%KK% 	+$*
 	kxXr   c                 $    | j                          y)z*Loads up the segments from the meta_layer.N)_read_headerr+   s    r   _load_segmentszVmwareLayer._load_segments,   s    r   sizec                     | dk(  rdS dS )N   vmware!unsigned intzvmware!unsigned long longr   )r1   s    r   _choose_typezVmwareLayer._choose_type0   s    (,	$R7RRr   c           	         d| j                   j                  vrG| j                   j                  j                  t        j                  dt        j
                               | j                  j                  j                  | j                  d      }t        j                  | j                        }|j                  d|      }t        j                  | j                  |      \  }}}|dvr"t        | j                   dt#        |             |d   dz  }t        j                  | j$                        }i }	t'        |      D ]R  }
t        j                  | j$                  |j                  ||
|z  z   |            \  }}}|j)                  d      }||	|<   T |	d   }d	}|}i }| j                   j                  j+                  d
      j,                  }|st/        |j                  |d            }t/        |j                  |dz   d            }|dk(  xr |dk(  }|s| j                   j1                  d| j                  |dz   |      }|dz	  dz  }g }t'        |      D ]E  }|j                  | j                   j1                  d
||z   dz   ||z  z   | j                               G |dz  }|dv r|dk(  rdnd}| j                   j1                  | j3                  |      | j                  |dz   |z   ||z  z         }| j                   j1                  d| j                  |dz   |z   ||z  z   d|z  z   dz   |      }|d|z   ||z  z   d|z  z   dz   |z   z  }nT| j                   j1                  | j3                  |      | j                  |dz   |z   ||z  z         }|d|z   ||z  z   |z   z  }||f||t5        |      f<   |s|d   d   dk(  rt        | j                   d      t'        |d   d         D ]i  }|d|ff   d   | j6                  z  }|d|ff   d   | j6                  z  }|d|ff   d   | j6                  z  }| j8                  j                  ||||f       k y)z1Checks the vmware header to make sure it's valid.vmwareNr   )s   оҾs   ѺѺs   ҾҾs   ӾӾz$Wrong magic bytes for Vmware layer:        s   memoryFr4      zvmware!string   )
layer_nameoffset
max_length      )r=   r<   ?   )>   rA   r3      )r<   r=   zvmware!bytes)r<   r=   length)regionsCountr   z%VMware VMEM is not split into regions	regionPPNregionPageNum
regionSize)r#   symbol_spaceappendr   NativeTable
std_ctypesr   layersgetr(   structcalcsizeheader_structurereadunpackr   r   reprgroup_structurerangerstripget_typer1   ordobjectr5   tupler%   	_segments)r+   r"   header_sizedatamagicunknown
groupCountversion
group_sizegroupsgroupr   tag_location_unknownmemory	tags_readr=   tags	index_lenflagsname_lenindices_lenindicesindexdata_len	data_sizeregionmapped_offsetrD   s                                r   r.   zVmwareLayer._read_header4   s   4==555MM&&--""8V->->? \\((,,T-=-=tD
ood&;&;<q+.%+]]43H3H$%O"w
 
 
 (		A$u+O  (S.__T%9%9:
:& 	(E+1==$$uz/A BJO,(D, ;;w'D'F4L	( 	"	MM..778MNSS	
23E:??6A:q9:H!8(a-I}}++##//!A:'	 ,   %zQ.";/ ENN,,1#)H#4q#8EI<M#N'+'7'7 -  !4<    %,qLqaH $ 4 4))(3#'#3#3%zH4i8OP !5 !I  ==//&#'#3#3% " # '2 4 h,	 '
    ) 0 
D "#&24 h,' 	
 $$F  ==//))(3#'#3#3%zH4i8OP 0 D
 a(lkI.EFQQF05t}dE'N+, B $%a(A-'		B  D!56q9: 	KF;	23A6HF /F9!=>qADOOSM<&34Q7$//IFNN!!6=&&"IJ		Kr   c                 2    | j                   | j                  gS N)r'   r(   r/   s    r   dependencieszVmwareLayer.dependencies   s      $"2"233r   c                 ^    t        j                  dd      t        j                  dd      gS )zPThis vmware translation layer always requires a separate metadata
        layer.r!   F)r   optionalr"   )r
   TranslationLayerRequirement)clss    r   get_requirementszVmwareLayer.get_requirements   s0    
 44,QVW44,QVW
 	
r   rv   )r   N)r   r   r   rQ   rU   r	   r   ContextInterfacestrr   r   r   r*   r0   staticmethodintr5   r.   propertyr   rw   classmethodconfigurationRequirementInterfacer|   __classcell__)r,   s   @r   r   r      s    O .2Y##44Y Y 	Y
 4S>*Y 
Y$ S3 S3 S SoKb 4d3i 4 4 
j&>&>&S&S!T 
 
r   r   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	VmwareStacker   Nr   r<   progress_callbackr   c                    |j                   |   }t        |t        j                        sy|j                  }|j                  d      r|dd dz   }|dd dz   }|j                   j                  d      }t        j                  j                  ddd	|      }	d
}
t        j                  t              5  t        j                         j                  |      5 }|j!                  d      }ddd       ||j"                  t        j                  j                  |	d      <   |j                   j%                  t        j                  ||	|             d}
ddd       d
}|
st        j                  t              5  t        j                         j                  |      j!                  d      }||j"                  t        j                  j                  |	d      <   |j                   j%                  t        j                  ||	|             d}ddd       t&        j)                  t*        j,                  d|
 d| d       |
s]|s[t.        j0                  j3                  |      }t.        j0                  j3                  |      }t&        j5                  d| d| d       y|j                   j                  d      }||j"                  t        j                  j                  |	d      <   ||j"                  t        j                  j                  |	d      <   t7        ||	|      }|S y# 1 sw Y   7xY w# 1 sw Y   xY w# 1 sw Y   3xY w)z8Attempt to stack this based on the starting information.Nz.vmemz.vmssz.vmsnVmwareMetaLayer	automagiclayer_stackerstackF
   locationTzMetadata found: VMSS (z) or VMSN ()zNo metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. z and .r   r!   r"   )rM   
isinstancer   	FileLayerr   endswithfree_layer_namer	   r   	path_join
contextlibsuppressIOErrorr   ResourceAccessoropenrR   r&   	add_layervolloglogr   LOGLEVEL_VVVVospathbasenamewarningr   )r{   r   r<   r   memlayerr   vmssvmsncurrent_layer_namecurrent_config_pathvmss_successfp_vmsn_successvmem_file_basenameexample_vmss_file_basenamenew_layer_name	new_layers                     r   r   zVmwareStacker.stack   s&    >>*-(H$6$67$$W%CR=7*DCR=7*D!(!?!?@Q!R",":":"D"D_g7I# !L$$W- 	$//166t< $A$  ,,667JJW ((&&w0CEWX  $	$ !L((1 (!22499$?DDRHA
 	 NN"00::/
 NN,, **#%8:L
 $(L( JJ''(k,qQ
  %'WW%5%5h%?"-/WW-=-=d-C* T  Ug  Th  hm  nH  mI  IJ  K $^^;;MJN  NN((223FU
 # NN((223FU $G-@.QI_$ $	$ 	$( (s2   1$L)L'A'L)3BL6L&	!L))L36M rv   )r   r   r   stack_orderr   r	   r   r}   r~   r   ProgressCallbackr   rM   DataLayerInterfacer   r   r   r   r   r      sm    K
 9=	D##44D D %55	D
 
*##66	7D Dr   r   )r   loggingrO   r   typingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   r   r   volatility3.framework.symbolsr   	getLoggerr   r   LayerExceptionr   SegmentedLayerr   r   StackerLayerInterfacer   r   r   r   <module>r      s       	 , , C C < G G 0			8	$SJ55 SZ
)** Z
zHJ((>> Hr   