
    *1f                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j        e          Z G d de	j                  Z G d	 d
e	j                  ZdS )    N)Optional)	constants
interfaces
exceptions)elf)intermed)	ELF_CLASSc                        e Zd ZdZ ej        d          ZdZej	        Zde
j        j        dededdf fd	Zd
edede
j        j        fdZddZe	 dde
j        j        dedefd            Z xZS )XenCoreDumpLayerzA layer that supports the Xen Dump-Core format as documented at: https://xenbits.xen.org/docs/4.6-testing/misc/dump-core-format.txtz<IBBBiELFcontextconfig_pathnamereturnNc                     t           j                            ||dd          | _        t           j                            ||dd          | _        i | _        t                                          |||           d S )Nlinuxr   xen)r   IntermediateSymbolTablecreate_elf_table_name_xen_table_name_segment_headerssuper__init__)selfr   r   r   	__class__s       R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/xen.pyr   zXenCoreDumpLayer.__init__   s{      (?FF['5 
  
  (?FF['5 
  
 !#+t44444    varnamesegment_indexc                     | j         |         }| j                            | j        t          j        z   |z   | j        |j        |j                  }|j        |j	        j
        j        j        z  |j	        _        |S )N)
layer_nameoffsetsize)r   r   objectr   r   BANG_base_layer	sh_offsetsh_sizeentriesvolsubtyper#   count)r   r   r   hdrresults        r   _extract_result_arrayz&XenCoreDumpLayer._extract_result_array"   sr     #M2$$ 9>1G;'=	 % 
 
  #{fn.@.H.MMr   c                    | j                             | j        t          j        z   dz   | j        d          }g }g | _        t          |j                  D ]}| j                             | j        t          j        z   dz   | j        |j	        ||j
        z  z             }| j                            |           ||j        k    rJ| j         j        | j                                     |j        |j                  }|                    d          }|st%          j        d          	 |                     d|                    d                    }n# t,          $ r d	}Y nw xY w	 |                     d
|                    d                    }n# t,          $ r d	}Y nw xY w| j        |                    d                   }d}	|rc|sat          t/          |j                            D ]>}
|j        |
         }|r-|dk    r'|                    ||	z  |j        |
|	z  z   |	|	f           ?n|rk|sit          t/          |j                            D ]F}
|j        |
         }|j        dk    r,|                    |j        |	z  |j        |
|	z  z   |	|	f           Gn8|r|rt%          j        | j        d          t%          j        | j        d          t/          |          dk    r"t%          j        | j        d| j                   || _        d	S )zHLoad the segments from based on the PT_LOAD segments of the Elf64 format
Elf64_Ehdrr   )r!   r"   
Elf64_Shdr    z%No segment names, not a Xen Core Dumpxen_p2ms   .xen_p2mNxen_pfns   .xen_pfns
   .xen_pagesi   l    z!Both P2M and PFN in Xen Core Dumpz$Neither P2M nor PFN in Xen Core DumpzNo ELF segments defined in )r   r$   r   r   r%   r&   r   rangee_shnume_shoffe_shentsizeappend
e_shstrndxlayersreadr'   r(   splitr   ElfFormatExceptionr/   index
ValueErrorlenr)   pfnr   	_segments)r   ehdrsegmentssindexshdrsegment_namesp2m_datapfn_data	pages_hdr	page_sizeentry_indexentrys               r   _load_segmentszXenCoreDumpLayer._load_segments/   s   |"" 9>1L@' # 
 
  "DL)) 	= 	=F<&&$y~5D+|v0@'@A '  D !((...(( $ 3D4D E J JNDL! ! !. 3 3G < < 	R()PQQQ	11=..{;; HH  	 	 	HHH		11=..{;; HH  	 	 	HHH	 )-*=*=m*L*LM		 	H 	$S)9%:%:;;   (5 Uj00OO!I-%/;3JK%%	  	  	h 	$S)9%:%:;;   (59
**OO!I	1%/;3JK%%	  	  	( 	(4WXXX(	A   x==A(	K9IKK   "s$   %)E EE")F FFr   
base_layerr"   c                    	 |                     || j        j                  }n2# t          j        $ r  t          j        |j        d|dd          w xY w| j                            |          \  }}}}|| j	        k    r"t          j        |j        d|dd|d          || j
        k    rt          j        |j        d|d          d	S )
Nz	Offset 0x0xz% does not exist within the base layerzBad magic 0xxz at file offset 0xzELF class is not 64-bit (2): dT)r=   _header_structr#   r   InvalidAddressExceptionr   r?   r   unpackMAGICr	   )clsrQ   r"   header_datamagic	elf_clasself_data_encodingelf_versions           r   _check_headerzXenCoreDumpLayer._check_header   s   	$//&#2D2IJJKK1 	 	 	(LFLLLL  	
 >A=O=V=V>
 >
:	,k CI(!U!U!U!U6!U!U!U   %%(!N!N!N!N   ts	    # /A)r   N)r   )__name__
__module____qualname____doc__structStructrV   rY   r	   
ELFCLASS64r   r   ContextInterfacestrr   intobjectsObjectInterfacer/   rP   classmethodr<   DataLayerInterfaceboolr`   __classcell__)r   s   @r   r   r      s        N  N"V]7++NE$I5!):5IL5TW5	5 5 5 5 5 5+.			+   S" S" S" S"j MN #*=GJ	   [    r   r   c                   |    e Zd ZdZe	 ddej        j        dede	j
        deej        j                 fd            ZdS )	XenCoreDumpStacker
   Nr   r!   progress_callbackr   c                    	 t                               |j        |                   sd S nE# t          j        $ r3}t
                              t          j        d|            Y d }~d S d }~ww xY w|j        	                    d          }||j
        t          j                            |d          <   t          |||          S )NzException: r   rQ   )r   r`   r<   r   r?   volloglogr   LOGLEVEL_VVVVfree_layer_nameconfigr   configuration	path_join)rZ   r   r!   rt   excpnew_names         r   stackzXenCoreDumpStacker.stack   s    	#11'.2LMM t% 	 	 	JJy.0Dd0D0DEEE44444	 >112DEE 	z/99(LQQR  8<<<s   %* A,(A''A,)N)ra   rb   rc   stack_orderrm   r   r   rh   ri   r   ProgressCallbackr   r<   rn   r    r   r   rr   rr      s{        K
 9=	= =#4= = %5	=
 
*#6	7= = = [= = =r   rr   )loggingre   typingr   volatility3.frameworkr   r   r   volatility3.framework.layersr   volatility3.framework.symbolsr   %volatility3.framework.constants.linuxr	   	getLoggerra   rv   
Elf64Layerr   Elf64Stackerrr   r   r   r   <module>r      s            C C C C C C C C C C , , , , , , 2 2 2 2 2 2 ; ; ; ; ; ;		8	$	$N N N N Ns~ N N Nb= = = = =) = = = = =r   