
    *1f                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j                  e      Z G d de	j"                        Z G d	 d
e	j&                        Zy)    N)Optional)	constants
interfaces
exceptions)elf)intermed)	ELF_CLASSc                   *    e Zd ZdZ ej
                  d      ZdZej                  Zde
j                  j                  dededdf fd	Zd
edede
j                   j"                  fdZddZe	 dde
j*                  j,                  dedefd       Z xZS )XenCoreDumpLayerzA layer that supports the Xen Dump-Core format as documented at: https://xenbits.xen.org/docs/4.6-testing/misc/dump-core-format.txtz<IBBBiELFcontextconfig_pathnamereturnNc                     t         j                  j                  ||dd      | _        t         j                  j                  ||dd      | _        i | _        t        |   |||       y )Nlinuxr   xen)r   IntermediateSymbolTablecreate_elf_table_name_xen_table_name_segment_headerssuper__init__)selfr   r   r   	__class__s       R/home/panchajanya/Development/work/volatility3/volatility3/framework/layers/xen.pyr   zXenCoreDumpLayer.__init__   sf      (??FF['5 
  (??FF['5 
 !#+t4    varnamesegment_indexc                 f   | j                   |   }| j                  j                  | j                  t        j
                  z   |z   | j                  |j                  |j                        }|j                  |j                  j                  j                  j                  z  |j                  _        |S )N)
layer_nameoffsetsize)r   r   objectr   r   BANG_base_layer	sh_offsetsh_sizeentriesvolsubtyper#   count)r   r   r   hdrresults        r   _extract_result_arrayz&XenCoreDumpLayer._extract_result_array"   s     ##M2$$  9>>1G;''==	 % 
  #{{fnn.@.@.H.H.M.MMr   c                    | j                   j                  | j                  t        j                  z   dz   | j
                  d      }g }g | _        t        |j                        D ]  }| j                   j                  | j                  t        j                  z   dz   | j
                  |j                  ||j                  z  z         }| j                  j                  |       ||j                  k(  s| j                   j                  | j
                     j                  |j                  |j                         }|j#                  d      } st%        j&                  d      	 | j)                  d|j+                  d            }	 | j)                  d
|j+                  d            }| j                  |j+                  d         }d}	|rf|sdt        t/        |j0                              D ]B  }
|j0                  |
   }|s|dk7  s|j                  ||	z  |j                  |
|	z  z   |	|	f       D n|rw|sut        t/        |j0                              D ]S  }
|j0                  |
   }|j2                  dk7  s"|j                  |j2                  |	z  |j                  |
|	z  z   |	|	f       U nD|r"|r t%        j&                  | j4                  d      t%        j&                  | j4                  d      t/        |      dk(  r-t%        j&                  | j4                  d| j
                         || _        y	# t,        $ r d	}Y w xY w# t,        $ r d	}Y w xY w)zHLoad the segments from based on the PT_LOAD segments of the Elf64 format
Elf64_Ehdrr   )r!   r"   
Elf64_Shdr    z%No segment names, not a Xen Core Dumpxen_p2ms   .xen_p2mNxen_pfns   .xen_pfns
   .xen_pagesi   l    z!Both P2M and PFN in Xen Core Dumpz$Neither P2M nor PFN in Xen Core DumpzNo ELF segments defined in )r   r$   r   r   r%   r&   r   rangee_shnume_shoffe_shentsizeappend
e_shstrndxlayersreadr'   r(   splitr   ElfFormatExceptionr/   index
ValueErrorlenr)   pfnr   	_segments)r   ehdrsegmentssindexshdrsegment_namesp2m_datapfn_data	pages_hdr	page_sizeentry_indexentrys               r   _load_segmentszXenCoreDumpLayer._load_segments/   s0   ||""  9>>1L@'' # 
  "DLL) 	=F<<&&$$y~~5D++||v0@0@'@A ' D !!((.( $ 3 3D4D4D E J JNNDLL! !. 3 3G <	= (()PQQ	11=..{;H
	11=..{;H ))-*=*=m*LM		H$S)9)9%:;  ((5Uj0OO!I-%//;3JK%%		 h$S)9)9%:;  ((599
*OO!II	1%//;3JK%%		 (((4WXX((		A  x=A((		89I9I8JK  "e  	H	  	H	s$   %!L0 !M 0L?>L?MM
base_layerr"   c                    	 |j                  || j                  j                        }| j                  j                  |      \  }}}}|| j                  k7  r(t        j                  |j                  d|dd|d      || j                  k7  r$t        j                  |j                  d|d      y	# t        j                  $ r& t        j                  |j                  d|dd      w xY w)
Nz	Offset 0x0xz% does not exist within the base layerzBad magic 0xxz at file offset 0xzELF class is not 64-bit (2): dT)r=   _header_structr#   r   InvalidAddressExceptionr   r?   r   unpackMAGICr	   )clsrQ   r"   header_datamagic	elf_clasself_data_encodingelf_versions           r   _check_headerzXenCoreDumpLayer._check_header   s    	$//&#2D2D2I2IJK >A=O=O=V=V>
:	,k CII((<ay8J6RS*!U  %((#@1!N  # 11 	((F2;&KL 	s   &B3 39C,)r   N)r   )__name__
__module____qualname____doc__structStructrV   rY   r	   
ELFCLASS64r   r   ContextInterfacestrr   intobjectsObjectInterfacer/   rP   classmethodr<   DataLayerInterfaceboolr`   __classcell__)r   s   @r   r   r      s     N"V]]7+NE$$I5!))::5IL5TW5	5+.				+	+S"j MN#**==GJ	 r   r   c                       e Zd ZdZe	 ddej                  j                  dede	j                  deej                  j                     fd       Zy)	XenCoreDumpStacker
   Nr   r!   progress_callbackr   c                    	 t         j                  |j                  |         sy 	 |j                  j                  d      }||j                  t        j                  j                  |d      <   t        |||      S # t        j                  $ r1}t
        j                  t        j                  d|        Y d }~y d }~ww xY w)NzException: r   rQ   )r   r`   r<   r   r?   volloglogr   LOGLEVEL_VVVVfree_layer_nameconfigr   configuration	path_join)rZ   r   r!   rt   excpnew_names         r   stackzXenCoreDumpStacker.stack   s    	#11'..2LM N
 >>112DE 	z//99(LQR  8<< %% 	JJy..+dV0DE	s   "A; ;B?'B::B?)N)ra   rb   rc   stack_orderrm   r   r   rh   ri   r   ProgressCallbackr   r<   rn   r    r   r   rr   rr      sg    K
 9=	=##44= = %55	=
 
*##66	7= =r   rr   )loggingre   typingr   volatility3.frameworkr   r   r   volatility3.framework.layersr   volatility3.framework.symbolsr   %volatility3.framework.constants.linuxr	   	getLoggerra   rv   
Elf64Layerr   Elf64Stackerrr   r   r   r   <module>r      sT       C C , 2 ;			8	$Ns~~ Nb=)) =r   