
    Xf                        d dl Z d dlZ d dlZd dlZd dlmZmZmZmZm	Z	m
Z
mZmZmZmZ d dlmZmZ d dlmZ  ej        e          Z e j        dg d          Zdedeeeeeeef                  d	ed
eeeeeef         fdZdeeeeeef         deeeeeeef                  d	ed
efdZ  G d dej!        j"                  Z# G d dej!        j"                  Z$ G d dej!        j"                  Z% G d de%e          Z& G d de%e          Z' G d de%e          Z( G d de%e          Z) G d de%e          Z* G d de%e          Z+ G d  d!e'          Z, G d" d#ej!        j"        e          Z- G d$ d%ej!        j"        e          Z. G d& d'ej!        j"        e j/        j0                  Z1 G d( d)ej!        j"                  Z2 G d* d+e2          Z3 G d, d-e2          Z4 G d. d/e2          Z5e3d0e4d1e5d2iZ6dS )3    N)
AnyClassVarDictIterableListOptionalTupleTypeUnionoverload)	constants
interfaces)	templatesDataFormatInfolength	byteordersigneddatastruct_typedata_formatreturnc                    |t           k    r't                               | |j        |j                  S |t          k    rd}n|t
          k    rVd}|j        t          |          k    s||j                 dvrt          d          |j        dk    rdnd||j                 z   }nG|t          t          fv rt          |j                  d	z   }nt          d
t          |                     t          j        ||           d         S )z9Converts a series of bytes to a particular type of value.r   r   ?	zzezfzzzdefdInvalid float sizelittle<>s(Cannot construct struct format for type r   )int
from_bytesr   r   boolfloatr   len
ValueErrorbytesstr	TypeErrortypestructunpack)r   r   r   struct_format
float_valss        X/home/panchajanya/Development/work/volatility3/volatility3/framework/objects/__init__.pyconvert_data_to_valuer3       s    c~~K1+:L  
 
 	
 d			 
Z00+,-U::1222(H44CC#{)*+ 
	$	$K.//#5V4CTCTVVWWW=--a00    valuec                    t          | |          st          d|j                   |t          k    rBt          | t                    r-t                              | |j        |j        |j                  S |t          k    rd}n|t          k    rVd}|j        t          |          k    s||j                 dvrt          d          |j        dk    rdnd	||j                 z   }nl|t          t          fv r=t          | t                    rt          | d
          } t          |j                  dz   }nt          dt          |                     t          j        ||           S )z1Converts a particular value to a series of bytes.z-Written value is not of the correct type for r   r   r   r   r   r   r    r!   zlatin-1r"   r#   )
isinstancer,   __name__r$   to_bytesr   r   r   r&   r'   r(   r)   r*   r+   r-   r.   pack)r5   r   r   r0   r1   s        r2   convert_value_to_datar;   >   s~    e[)) 
RK<PRR
 
 	
 cj44||%!+%	  
 
 	
 d			 
Z00+,-U::1222(H44CC#{)*+ 
	$	$eS!! 	,%++EK.//#5V4CTCTVVWWW;}e,,,r4   c                   \    e Zd ZdZ G d dej        j        j                  ZdeddfdZ	dS )Voidz2Returns an object to represent void/unknown types.c                   B    e Zd Zedej        j        defd            ZdS )Void.VolTemplateProxytemplater   c                 P    t                               t          j        d           dS )a  Dummy size for Void objects.

            According to http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf, void is an incomplete type,
            and therefore sizeof(void) should fail.  However, we need to be able to construct voids to be able to
            cast them, so we return a useless size.  It shouldn't cause errors, but it also shouldn't be common,
            it is logged at the lowest level.
            zVoid size requestedr   )volloglogr   LOGLEVEL_VVVVclsr@   s     r2   sizezVoid.VolTemplateProxy.sizek   s!     JJy.0EFFF1r4   N	r8   
__module____qualname__classmethodr   objectsTemplater$   rG    r4   r2   VolTemplateProxyr?   j   sF        			
 2 ; 		 		 		 		 
		 		 		r4   rO   r5   r   Nc                      t          d          )z0Dummy method that does nothing for Void objects.z5Cannot write data to a void, recast as another object)r,   selfr5   s     r2   writez
Void.writew   s    OPPPr4   )
r8   rI   rJ   __doc__r   rL   ObjectInterfacerO   r   rS   rN   r4   r2   r=   r=   g   sw        <<    :-=N   Q3 Q4 Q Q Q Q Q Qr4   r=   c                       e Zd ZdZdS )Function Nr8   rI   rJ   rT   rN   r4   r2   rW   rW   |   s        
FFFr4   rW   c                       e Zd ZU dZeZee         ed<   de	j
        j        dede	j        j        deddf
 fd	Z	 dd
ede	j
        j        dede	j        j        dedeeeeeef         dd fdZd Zede	j
        j        dede	j        j        deeeeeef         fd            Z G d de	j        j        j                  Zdeeeeeef         de	j        j        fdZ xZS )PrimitiveObjectz\PrimitiveObject is an interface for any objects that should simulate a
    Python primitive._struct_typecontext	type_nameobject_infor   r   Nc                 `    t                                          ||||           || _        d S )Nr]   r^   r_   r   )super__init___data_format)rR   r]   r^   r_   r   	__class__s        r2   rc   zPrimitiveObject.__init__   sB     	##	 	 	
 	
 	
 (r4   rF   	new_valuec                     ||                      |||          }n|}| j                            | |          }||_        |S )ax  Creates the appropriate class and returns it so that the native type
        is inherited.

        The only reason the kwargs is added, is so that the inheriting types can override __init__
        without needing to override __new__

        We also sneak in new_value, so that we don't have to do expensive (read: impossible) context reads
        when unpickling.
        )_unmarshallr\   __new___PrimitiveObject__new_value)	rF   r]   r^   r_   r   rf   kwargsr5   results	            r2   ri   zPrimitiveObject.__new__   sM    $ OOG[+FFEEE!))#u55 #r4   c                     i }| j         j        d                                         D ]\  }}|dvr|||<   | j        |d<   | j        | j         j        d         d         | j         j        d         | j        f|fS )zVMake sure that when pickling, all appropriate parameters for new are
        provided.)r]   r   r_   r^   rf   r^   )_volmapsitemsrj   _contextrd   )rR   rk   kvs       r2   __getnewargs_ex__z!PrimitiveObject.__getnewargs_ex__   s     IN2&,,.. 	 	DAqNNNq	".{MIN2{+IN2	

  	r4   c                     d}|j         dk    r+|j                            |j        |j        |j                   }t          || j        |          S )Nr4   r   )r   layersread
layer_nameoffsetr3   r\   )rF   r]   r   r_   r   s        r2   rh   zPrimitiveObject._unmarshall   sU     !!>&&&(:K<N D %T3+;[IIIr4   c                   B    e Zd Zedej        j        defd            ZdS ) PrimitiveObject.VolTemplateProxyr@   r   c                 $    |j         j        j        S z)Returns the size of the templated object.)volr   r   rE   s     r2   rG   z%PrimitiveObject.VolTemplateProxy.size   s     <+22r4   NrH   rN   r4   r2   rO   r~      sF        		3
 2 ; 	3 	3 	3 	3 
	3 	3 	3r4   rO   r5   c                     t          || j        | j                  }| j        j                            | j        j        | j        j        |           | 	                    | j        j
                  S )zNWrites the object into the layer of the context at the current
        offset.)r;   r\   rd   rt   ry   rS   r   r{   r|   castr^   )rR   r5   r   s      r2   rS   zPrimitiveObject.write   sX    
 %UD,=t?PQQ""48#6NNNyy+,,,r4   N)r8   rI   rJ   rT   r$   r\   r   r
   __annotations__r   r]   ContextInterfacer+   rL   ObjectInformationr   rc   TUnionr'   r&   r*   ri   rw   rK   rh   rU   rO   rS   __classcell__re   s   @r2   r[   r[      s          $'L(4.&&&(#4( (  '9	(
 $( 
( ( ( ( ( (* ;? #4   '9	
 $ #udE367 
   8   J#4J $J  '9	J
 
UD%,	-J J J [J3 3 3 3 3:-=N 3 3 3-CeS89-			+- - - - - - - -r4   r[   c                   .    e Zd ZU dZeZee         ed<   dS )Booleanz,Primitive Object that handles boolean types.r\   N	r8   rI   rJ   rT   r$   r\   r   r
   r   rN   r4   r2   r   r      s,         66#&L(4.&&&&&r4   r   c                       e Zd ZdZdS )Integerz5Primitive Object that handles standard numeric types.NrY   rN   r4   r2   r   r      s        ????r4   r   c                   .    e Zd ZU dZeZee         ed<   dS )Floatz?Primitive Object that handles double or floating point numbers.r\   N)	r8   rI   rJ   rT   r'   r\   r   r
   r   rN   r4   r2   r   r      s,         II#(L(4.(((((r4   r   c                   .    e Zd ZU dZeZee         ed<   dS )Charz)Primitive Object that handles characters.r\   Nr   rN   r4   r2   r   r      s,         33#&L(4.&&&&&r4   r   c                       e Zd ZU dZeZee         ed<   	 dde	j
        j        dede	j        j        dedd	f
 fd
Z	 ddede	j
        j        dede	j        j        dedd fdZ G d de	j        j        j                  Z xZS )Bytesz7Primitive Object that handles specific series of bytes.r\      r]   r^   r_   r   r   Nc           
          t                                          |||t          |dd                     || j        d<   d S )NbigFra   r   rb   rc   r   rq   )rR   r]   r^   r_   r   re   s        r2   rc   zBytes.__init__   sR     	#&vue<<	 	 	
 	
 	
 %	(r4   rF   c                     | j                             | |                     |t          |dd          |                    S )Creates the appropriate class and returns it so that the native type
        is inherited.

        The only reason the kwargs is added, is so that the
        inheriting types can override __init__ without needing to
        override __new__
        r   Fr   r_   )r\   ri   rh   r   )rF   r]   r^   r_   r   rk   s         r2   ri   zBytes.__new__  sM     ''OO*65%@@'   
 
 	
r4   c                   B    e Zd Zedej        j        defd            ZdS )Bytes.VolTemplateProxyr@   r   c                     |j         j        S r   )r   r   rE   s     r2   rG   zBytes.VolTemplateProxy.size%  s    <&&r4   NrH   rN   r4   r2   rO   r   $  sF        		'
 2 ; 	' 	' 	' 	' 
	' 	' 	'r4   rO   )r   )r8   rI   rJ   rT   r*   r\   r   r
   r   r   r]   r   r+   rL   r   r$   rc   ri   rU   rO   r   r   s   @r2   r   r      s4        AA#(L(4.((( % %#4% %  '9	%
 % 
% % % % % %( 
 

#4
 
  '9	

 
 

 
 
 
0' ' ' ' ':-=N ' ' ' ' ' ' 'r4   r   c                       e Zd ZU dZeZee         ed<   	 	 	 dde	j
        j        dede	j        j        d	ed
ededdf fdZ	 	 	 ddede	j
        j        dede	j        j        d	ed
ededd fdZ G d de	j        j        j                  Z xZS )StringzPrimitive Object that handles string values.

    Args:
        max_length: specifies the maximum possible length that the string could hold within memory
            (for multibyte characters, this will not be the maximum length of the string)
    r\   r   utf-8strictr]   r^   r_   
max_lengthencodingerrorsr   Nc           
          t                                          |||t          |dd                     || j        d<   || j        d<   || j        d<   d S )Nr   Fra   r   r   r   r   )rR   r]   r^   r_   r   r   r   re   s          r2   rc   zString.__init__4  sj     	#&z5%@@	 	 	
 	
 	
 #-	, (	*$	(r4   rF   c                    i }|r||d<   |r||d<    | j         j        | |                     |t          |dd          |          fi |}	|	                    d          dk    r|	d|	                    d                   }	|	S )	r   r   r   r   Fr    r   N)r\   ri   rh   r   find)
rF   r]   r^   r_   r   r   r   rk   paramsr5   s
             r2   ri   zString.__new__G  s    "  	*!)F: 	&%F8( (OO*:ueDD'   
 
 
 
 ::f"".EJJv.../Er4   c                   B    e Zd Zedej        j        defd            ZdS )String.VolTemplateProxyr@   r   c                     |j         j        S r   )r   r   rE   s     r2   rG   zString.VolTemplateProxy.sizel  s     <**r4   NrH   rN   r4   r2   rO   r   k  sF        		+
 2 ; 	+ 	+ 	+ 	+ 
	+ 	+ 	+r4   rO   )r   r   r   )r8   rI   rJ   rT   r+   r\   r   r
   r   r   r]   r   rL   r   r$   rc   ri   rU   rO   r   r   s   @r2   r   r   *  so          $'L(4.&&& % %#4% %  '9	%
 % % % 
% % % % % %0 " ""#4" "  '9	"
 " " " 
" " " "H+ + + + +:-=N + + + + + + +r4   r   c                   z    e Zd ZdZ	 ddej        j        dedej        j	        de
deej                 ddf fd	Zedej        j        de
dej        j	        defd
            Z	 ddee         dej        j        fdZddee         defdZdedefdZdedefdZ G d dej        j        j                  Z xZS )Pointerz'Pointer which points to another object.Nr]   r^   r_   r   subtyper   c                 t    t                                          ||||           || j        d<   i | _        d S )N)r]   r_   r^   r   r   )rb   rc   rq   _cache)rR   r]   r^   r_   r   r   re   s         r2   rc   zPointer.__init__u  sK     	##	 	 	
 	
 	
  '	)EGr4   c                     |\  }}}|rt          d          |j        |j                 j        }|j                            |j        |j        |          }t                              |||          }	|	|z  S )a5  Ensure that pointer values always fall within the domain of the
        layer they're constructed on.

        If there's a need for all the data within the address, the
        pointer should be recast.  The "pointer" must always live within
        the space (even if the data provided is invalid).
        z"Pointers cannot have signed valuesr   )	r)   ry   native_layer_nameaddress_maskrz   r{   r|   r$   r%   )
rF   r]   r   r_   r   endianr   maskr   r5   s
             r2   rh   zPointer._unmarshall  sz     "- 	CABBB~k;<I~"";#9;;MvVVtvfEEt|r4   r{   c           	      t   || j         j        }| j                            |d          |p| j         j        }| j        j        |         j        }| |z  }| j                             | j        t          j	        
                    ||| | j         j        j                            | j        |<   | j        |         S )a  Dereferences the pointer.

        Layer_name is identifies the appropriate layer within the
        context that the pointer points to. If layer_name is None, it
        defaults to the same layer that the pointer is currently
        instantiated in.
        N)r{   r|   parentrG   r]   r_   )r   r   r   getrt   ry   r   r   r   rL   r   rG   )rR   r{   r   r|   s       r2   dereferencezPointer.dereference  s     3J;??:t,,4#Atx'AJ='
3@DD[F&*h&6&6&.@@)!).	 A   '7 ' 'DK
# {:&&r4   c                     |p| j         j        }| j        j        |                             | | j         j        j                  S )zODetermines whether the address of this pointer can be read from
        memory.)r   r   rt   ry   is_validr   rG   )rR   r{   s     r2   is_readablezPointer.is_readable  s;      =48#=
}#J/88tx?O?TUUUr4   attrc                 l    |dv rt          d          t          |                                 |          S )zbConvenience function to access unknown attributes by getting them
        from the subtype object.)r   rq   r   z"Pointer not initialized before use)AttributeErrorgetattrr   rR   r   s     r2   __getattr__zPointer.__getattr__  s;     ,,, !EFFFt''))4000r4   member_namec                 B    | j         d                             |          S )z6Returns whether the dereferenced type has this member.r   )rq   
has_memberrR   r   s     r2   r   zPointer.has_member  s    y#..{;;;r4   c            	       2   e Zd Zedej        j        defd            Zedej        j        de	ej        j                 fd            Z
edej        j        dej        j        dej        j        ddfd            Zedej        j        d	edefd
            ZdS )Pointer.VolTemplateProxyr@   r   c                 @    t           j                            |          S r   )r   rO   rG   rE   s     r2   rG   zPointer.VolTemplateProxy.size  s    +00:::r4   c                 2    d|j         v r|j         j        gS g S %Returns the children of the template.r   r   r   rE   s     r2   childrenz!Pointer.VolTemplateProxy.children  $    
 HL(( ,--Ir4   	old_child	new_childNc                 l    d|j         v r(|j         j        |k    r|                    |           dS dS dS ,Substitutes the old_child for the new_child.r   )r   N)r   r   
update_volrF   r@   r   r   s       r2   replace_childz&Pointer.VolTemplateProxy.replace_child  sL     HL((<'944''	'::::: )(44r4   r   c                 B    |j         d                             |          S )Nr   )r   r   rF   r@   r   s      r2   r   z#Pointer.VolTemplateProxy.has_member  s     <	*55kBBBr4   )r8   rI   rJ   rK   r   rL   rM   r$   rG   r   r   r   r+   r&   r   rN   r4   r2   rO   r     s&       		;
 2 ; 	; 	; 	; 	; 
	; 
	%-6	*$-.	 	 	 
	 
		; (1		; ")2		; ")2			;
 		; 		; 		; 
		; 
	C%-6	CEH	C	C 	C 	C 
	C 	C 	Cr4   rO   r   )r8   rI   rJ   rT   r   r]   r   r+   rL   r   r   r   r   ObjectTemplaterc   rK   r   rh   rU   r   r&   r   r   r   rO   r   r   s   @r2   r   r   r  s       11 7;H H#4H H  '9	H
 $H )23H 
H H H H H H" #4 $  '9	
 
   [, +/' '"3-'			+' ' ' '<V Vhsm Vt V V V V1 1 1 1 1 1<c <d < < < <C C C C C:-=N C C C C C C Cr4   r   c                   (    e Zd ZdZ	 	 ddej        j        dedej        j	        dej        j
        deded	d
f fdZ	 	 ddej        j        dedej        j	        dej        j
        deded	d fdZd Z G d dej        j        j                  Z xZS )BitFieldzOObject containing a field which is made up of bits rather than whole
    bytes.r   r]   r^   r_   	base_type	start_bitend_bitr   Nc                     t                                          |||           || j        d<   || j        d<   || j        d<   d S )Nr   r   r   )rb   rc   rq   )rR   r]   r^   r_   r   r   r   re   s          r2   rc   zBitField.__init__  sK     	)[999!*	+!*	+&	)r4   c                 j     |||          }t                               | |d|z  dz
  z  |z	            S )Nr   r   r$   ri   )	rF   r]   r^   r_   r   r   r   rk   r5   s	            r2   ri   zBitField.__new__  s?     	'{CCC{{3%ALA+=">9!LNNNr4   c                      t          d          )Nz+Writing to BitFields is not yet implementedNotImplementedErrorrQ   s     r2   rS   zBitField.write  s    !"OPPPr4   c            	           e Zd Zedej        j        defd            Zedej        j        de	ej        j                 fd            Z
edej        j        dej        j        dej        j        ddfd            ZdS )	BitField.VolTemplateProxyr@   r   c                 $    |j         j        j        S r   )r   r   rG   rE   s     r2   rG   zBitField.VolTemplateProxy.size  s    <)..r4   c                 2    d|j         v r|j         j        gS g S r   r   r   r   rE   s     r2   r   z"BitField.VolTemplateProxy.children  $    
 hl** .//Ir4   r   r   Nc                 l    d|j         v r(|j         j        |k    r|                    |           dS dS dS r   r   )r   Nr   r   r   r   s       r2   r   z'BitField.VolTemplateProxy.replace_child  L     hl**<)Y66'')'<<<<< +*66r4   )r8   rI   rJ   rK   r   rL   rM   r$   rG   r   r   r   rN   r4   r2   rO   r     s        		/
 2 ; 	/ 	/ 	/ 	/ 
	/ 
	%-6	*$-.	 	 	 
	 
		= (1		= ")2		= ")2			=
 		= 		= 		= 
		= 		= 		=r4   rO   )r   r   )r8   rI   rJ   rT   r   r]   r   r+   rL   r   rM   r$   rc   ri   rS   rU   rO   r   r   s   @r2   r   r     sr         ' '#4' '  '9	'
 %.' ' ' 
' ' ' ' ' '( O O#4O O  '9	O
 %.O O O 
O O O OQ Q Q= = = = =:-=N = = = = = = =r4   r   c                       e Zd ZdZdej        j        dedej        j	        dej        j
        deeef         dd fdZdej        j        dedej        j	        dedeeef         dd	f fd
Zd Z fdZedeeef         deeef         fd            ZddedefdZedefd            Zedeeef         fd            Zedefd            ZdedefdZdefdZ G d dej        j        j                  Z xZS )Enumerationz%Returns an object made up of choices.r]   r^   r_   r   choicesr   c                 R     |||          }t                               | |          S )Nr   r   )rF   r]   r^   r_   r   r   rk   r5   s           r2   ri   zEnumeration.__new__,  s,     	'{CCC{{3&&&r4   Nc                     t                                          |||           |                     |          | _        || j        d<   || j        d<   d S )Nr   r   )rb   rc   _generate_inverse_choices_inverse_choicesrq   )rR   r]   r^   r_   r   r   re   s         r2   rc   zEnumeration.__init__8  sU     	)[999 $ > >w G G&	)!*	+r4   c                 (    t          |           |k    S )z]An enumeration must be equivalent to its value, even if the other value is not an enumeration)r$   )rR   others     r2   __eq__zEnumeration.__eq__F  s    4yyE!!r4   c                 D    t                                                      S )zGEnumerations must be hashed as equivalent to their integer counterparts)rb   __hash__rR   re   s    r2   r   zEnumeration.__hash__J  s    ww!!!r4   c                     i }|                                 D ]C\  }}||v r5t                              t          j        d| d| d||                     >|||<   D|S )z-Generates the inverse choices for the object.zEnumeration value z duplicated as z. Keeping name )rs   rB   rC   r   LOGLEVEL_VVV)rF   r   inverse_choicesru   rv   s        r2   r   z%Enumeration._generate_inverse_choicesN  s     +-MMOO 	# 	#DAqO##

*aaa1aa_]^M_aa   !"OAr4   r5   c                 z    ||                      |           S || j        v r| j        |         S t          d          )zLooks up an individual value and returns the associated name.

        If multiple identifiers map to the same value, the first matching identifier will be returned
        N<The value of the enumeration is outside the possible choices)lookupr   r)   rQ   s     r2   r  zEnumeration.lookup\  sF    
 =;;t$$$D)))(//WXXXr4   c                 ,    |                      |           S )z;Returns the chosen name for the value this object contains.)r  rR   s    r2   descriptionzEnumeration.descriptiong  s     {{4   r4   c                     | j         d         S )Nr   )rq   r	  s    r2   r   zEnumeration.choicesl  s    y##r4   c                 8    | | j                                         v S )z:Returns whether the value for the object is a valid choice)r   valuesr	  s    r2   is_valid_choicezEnumeration.is_valid_choicep  s     t|**,,,,r4   r   c                     || j         d         v r| j         d         |         S t          d| d| j         d                    )z&Returns the value for a specific name.r   zUnknown attribute z for Enumeration r^   )rq   r   r   s     r2   r   zEnumeration.__getattr__u  sR    49Y'''9Y'--PPP	+8NPP
 
 	
r4   c                      t          d          )Nz.Writing to Enumerations is not yet implementedr   rQ   s     r2   rS   zEnumeration.write}  s    !"RSSSr4   c            	       8   e Zd ZdgZedej        j        dede	fd            Z
edej        j        defd            Zedej        j        deej        j                 fd            Zedej        j        dej        j        d	ej        j        dd
fd            Zd
S )Enumeration.VolTemplateProxyr  r@   r5   r   c                     t                               |j        d                   }||v r||         S t          d          )zLooks up an individual value and returns the associated name.

            If multiple identifiers map to the same value, the first matching identifier will be returned
            r   r  )r   r   r   r)   )rF   r@   r5   r   s       r2   r  z#Enumeration.VolTemplateProxy.lookup  sR      +DDY'    ((('..N  r4   c                 &    |j         d         j        S )Nr   )r   rG   rE   s     r2   rG   z!Enumeration.VolTemplateProxy.size  s    <,11r4   c                 2    d|j         v r|j         j        gS g S r   r   rE   s     r2   r   z%Enumeration.VolTemplateProxy.children  r   r4   r   r   Nc                 l    d|j         v r(|j         j        |k    r|                    |           dS dS dS r   r   r   s       r2   r   z*Enumeration.VolTemplateProxy.replace_child  r   r4   )r8   rI   rJ   _methodsrK   r   rL   rM   r$   r+   r  rG   r   r   r   rN   r4   r2   rO   r    s!       :		*"4"= 	c 	c 	 	 	 
	 
	2
 2 ; 	2 	2 	2 	2 
	2 
	%-6	*$-.	 	 	 
	 
		= (1		= ")2		= ")2			=
 		= 		= 		= 
		= 		= 		=r4   rO   r   ) r8   rI   rJ   rT   r   r]   r   r+   rL   r   rM   r   r$   ri   r   rc   r   r   rK   r   r  propertyr
  r   r&   r  r   r*   rS   rU   rO   r   r   s   @r2   r   r   )  s       //
'#4
' 
'  '9	
'
 %.
' c3h
' 

' 
' 
' 
'+#4+ +  '9	+
 + c3h+ 
+ + + + + +" " "" " " " " S#X 4S>    [	Y 	YC 	Y3 	Y 	Y 	Y 	Y !S ! ! ! X! $c3h $ $ $ X$ - - - - X-
 
 
 
 
 
T5 T T T T)= )= )= )= )=:-=N )= )= )= )= )= )= )=r4   r   c                       e Zd ZdZ	 	 ddej        j        dedej        j	        de
dej        d	df fd
Zed	e
fd            Zej        de
d	dfd            Zd	efdZ G d dej        j        j                  Zede
d	ej        j        fd            Zeded	eej        j                 fd            Zd Zd	e
fdZddZ xZS )Arrayz:Object which can contain a fixed number of an object type.r   Nr]   r^   r_   countr   r   c                     t                                          |||           || j        d<   || j        d<   d| j        d<   |||j        z  | j        d<   d S d S )N)r]   r^   r_   r  r   r   rG   )rb   rc   rq   rG   )rR   r]   r^   r_   r  r   re   s         r2   rc   zArray.__init__  so     	I;WWW"	'&	)	& % 4DIf r4   c                     | j         j        S )zReturns the count dynamically.r   r  r	  s    r2   r  zArray.count  s     x~r4   r5   c                 T    || j         d<   || j         d         j        z  | j         d<   dS )z#Sets the count to a specific value.r  r   rG   N)rq   rG   rQ   s     r2   r  zArray.count  s1     #	'!DIi$8$==	&r4   c                 6    t                               |           S )"Describes the object appropriately)AggregateType__repr__r	  s    r2   r#  zArray.__repr__  s    %%d+++r4   c            	       ~   e Zd Zedej        j        defd            Zedej        j        de	ej        j                 fd            Z
edej        j        dej        j        dej        j        ddfd            Zedej        j        d	edefd
            Zedej        j        d	edej        j        fd            ZdS )Array.VolTemplateProxyr@   r   c                     d|j         vrd|j         vrt          d          |j                             dd          j        |j                             dd          z  S )zNReturns the size of the array, based on the count and the
            subtype.r   r  z9Array ObjectTemplate must be provided a count and subtypeNr   )r   r)   r   rG   rE   s     r2   rG   zArray.VolTemplateProxy.size  sg     ,,1L1L O   <##It449HL<L<LWVW<X<XXXr4   c                 2    d|j         v r|j         j        gS g S r   r   rE   s     r2   r   zArray.VolTemplateProxy.children  r   r4   r   r   Nc                 n    d|j         v r)|j         d         |k    r|                    |           dS dS dS r   )r   r   r   s       r2   r   z$Array.VolTemplateProxy.replace_child  sN     HL((<	*i77''	'::::: )(77r4   childc                 H    d|j         v r|dk    rdS t          d|           )z]Returns the relative offset from the head of the parent data to
            the child member.r   r   &Member not present in array template: )r   
IndexErrorrF   r@   r)  s      r2   relative_child_offsetz,Array.VolTemplateProxy.relative_child_offset  s7     HL((Ui-?-?qMeMMNNNr4   c                 \    d|j         v r|dk    r|j         j        S t          d|           )z)Returns the template of the child member.r   r+  )r   r   r,  r-  s      r2   child_templatez%Array.VolTemplateProxy.child_template  s=    
 HL((Ui-?-?|++MeMMNNNr4   )r8   rI   rJ   rK   r   rL   rM   r$   rG   r   r   r   r+   r.  r0  rN   r4   r2   rO   r%    sw       		Y
 2 ; 	Y 	Y 	Y 	Y 
	Y 
	%-6	*$-.	 	 	 
	 
		; (1		; ")2		; ")2			;
 		; 		; 		; 
		; 
	O%-6	O?B	O	O 	O 	O 
	O 
	O%-6	O?B	O(	O 	O 	O 
	O 	O 	Or4   rO   ic                     d S r   rN   )rR   r1  s     r2   __getitem__zArray.__getitem__  s    BE#r4   r"   c                     d S r   rN   )rR   r"   s     r2   r3  zArray.__getitem__  s    JM#r4   c                    g }| j         j        | j        j                 j        }t          | j        j                  |         }d}t          |t                    rd}|g}|D ]}t          j
                            | j        j        || j        j        | j        j        j        |z  z   z  | | j        j        | j        j        j                  }|| j                            | j         |          gz  }|s|d         S |S )z%Returns the i-th item from the array.TF)r{   r|   r   r   rG   r   r   )rt   ry   r   r{   r   ranger  r7   r$   r   rL   r   r|   r   rG   r   )rR   r1  rl   r   seriesreturn_listindexr_   s           r2   r3  zArray.__getitem__  s    46}#DH$78Etx~&&q)fc"" 	KXF 	Y 	YE$,>>8.tx$(2B2G%2OPQ"&("<X%* ?  K tx'';'WWXXFF 	!9r4   c                     | j         j        S )z Returns the length of the array.r  r	  s    r2   __len__zArray.__len__  s    x~r4   c                 
   t          |t          j        j                  st	          d          t          |          | _        t          t          |                    D ]#}| |                             ||                    $d S )Nz'Only Sequences can be written to arrays)	r7   collectionsabcSequencer,   r(   r  r6  rS   )rR   r5   r9  s      r2   rS   zArray.write#  s|    %!9:: 	GEFFFZZ
3u::&& 	, 	,EKeEl++++	, 	,r4   )r   N)r   N)r8   rI   rJ   rT   r   r]   r   r+   rL   r   r$   r   r   rc   r  r  setterr#  rU   rO   r   rM   r3  slicer   r;  rS   r   r   s   @r2   r  r    s       DD ,05 5#45 5  '9	5
 5 )5 
5 5 5 5 5 5" s    X \>3 >4 > > > \>
,# , , , ,1O 1O 1O 1O 1O:-=N 1O 1O 1Of ESEZ%7%@EEE XEMUMtJ,>,G'HMMM XM  .    , , , , , , , ,r4   r  c                       e Zd ZdZdej        j        dedej        j	        de
deeee
ej        j        f         f         ddf fd	Zd
edefdZdefdZ G d dej        j        j                  Zedeeee
ej        j        f         f         ddfd            ZddedefdZdedefdZdee         f fdZd Z xZS )r"  zObject which can contain members that are other objects.

    Keep the number of methods in this class low or very specific, since
    each one could overload a valid member.
    r]   r^   r_   rG   membersr   Nc                 b    t                                          |||||           i | _        d S )N)r]   r^   r_   rG   rC  )rb   rc   _concrete_members)rR   r]   r^   r_   rG   rC  re   s         r2   rc   zAggregateType.__init__2  sE     	# 	 	
 	
 	
 35r4   r   c                     || j         j        v S )zMReturns whether the object would contain a member called
        member_name.r   rC  r   s     r2   r   zAggregateType.has_memberD  s     dh...r4   c                 .   dx}}| j         j        | j         j        k    r|d| j         j         dz  }| j         j        rd| j         j         d}d| j        j         d| j         j         | d| j         j         d| j         j        d	d
| j         j         | dS )r!  rX   z
 (Native: )z (.r     z: z @ 0xxz #r!   )	r   r   r{   r   re   r8   r^   r|   rG   )rR   extrasr   s      r2   r#  zAggregateType.__repr__I  s    !!8%)<<<@48#=@@@@F8 	87 4777K X4>*  X  XTX-?  X  X  XPTPXPc  X  Xjnjrjy  X  X  X  @D  @H  @M  X  OU  X  X  X  	Xr4   c            	          e Zd Zedej        j        defd            Zedej        j        de	ej        j                 fd            Z
edej        j        dej        j        dej        j        ddfd            Zedej        j        d	edefd
            Zedej        j        d	edej        j        fd            Zedej        j        dedefd            ZdS )AggregateType.VolTemplateProxyr@   r   c                 n    |j                             dd          t          d          |j         j        S )z'Method to return the size of this type.rG   Nz'ObjectTemplate not provided with a size)r   r   r)   rG   rE   s     r2   rG   z#AggregateType.VolTemplateProxy.sizeS  s6     |--5 !JKKK<$$r4   c                 R    d |j         j                                        D             S )z&Method to list children of a template.c                     g | ]\  }}|S rN   rN   ).0_members      r2   
<listcomp>z;AggregateType.VolTemplateProxy.children.<locals>.<listcomp>_  s    JJJyq&FJJJr4   )r   rC  r  rE   s     r2   r   z'AggregateType.VolTemplateProxy.childrenZ  s*    
 KJHL,@,G,G,I,IJJJJr4   r   r   Nc                     |j         j                            di           D ]F}|j         j        |         \  }}||k    r)|j         j        }||f||<   |                    |           GdS )zQReplace a child elements within the arguments handed to the
            template.rC  )rC  N)r   rC  r   r   )rF   r@   r   r   rT  relative_offsetmember_templatetmp_lists           r2   r   z,AggregateType.VolTemplateProxy.replace_childa  s     #,.229bAA 
: 
:3;<3G3O0"i//  (|3H(7'CHV$ '''999
: 
:r4   r)  c                 z    |j         j                            |d          }|t          d|           |d         S )z5Returns the relative offset of a child to its parent.N Member not present in template: r   r   rC  r   r,  rF   r@   r)  retlists       r2   r.  z4AggregateType.VolTemplateProxy.relative_child_offsetv  D    
 l*..ud;;G !KE!K!KLLL1:r4   c                 z    |j         j                            |d          }|t          d|           |d         S )z.Returns the template of a child to its parent.Nr[  r   r\  r]  s       r2   r0  z-AggregateType.VolTemplateProxy.child_template  r_  r4   r   c                     ||j         j        v S )zQReturns whether the object would contain a member called
            member_name.rG  r   s      r2   r   z)AggregateType.VolTemplateProxy.has_member  s     (,"666r4   )r8   rI   rJ   rK   r   rL   rM   r$   rG   r   r   r   r+   r.  r0  r&   r   rN   r4   r2   rO   rN  R  s       		%
 2 ; 	% 	% 	% 	% 
	% 
	K%-6	K*$-.	K 	K 	K 
	K 
	: (1	: ")2	: ")2		:
 	: 	: 	: 
	:( 
	%-6	?B		 	 	 
	 
	%-6	?B	(	 	 	 
	 
	7%-6	7EH	7	7 	7 	7 
	7 	7 	7r4   rO   c                 2   d}t           D ]}t          | |          r|j        }t          |t          j        j                  sJ | dt          |                       t          d |                                D                       sJ | d            d S )Nr"  z& members parameter must be a mapping: c                 ^    g | ]*}t          |t                    ot          |          d k    +S )   )r7   tupler(   )rR  rT  s     r2   rU  z0AggregateType._check_members.<locals>.<listcomp>  sB        FE**?s6{{a/?  r4   z: members must be a tuple of relative_offsets and templates)	AggregateTypesr7   r8   r=  r>  Mappingr-   allr  )rF   rC  agg_nameagg_types       r2   _check_memberszAggregateType._check_members  s     #& 	- 	-H#x(( -#,[_,
 
 	N 	NMMd7mmMM	N 	N 	N  %nn..  
 
 	S 	S
 RRR	S 	S 	S 	S 	Sr4   rT  r   c                 ,    |                      |          S )z1Specifically named method for retrieving members.)r   r   s     r2   rT  zAggregateType.member  s    %%%r4   c                 Z   |dv rt          d          || j        v r| j        |         S |                    d          r7|                    d          s"d|v r||                    dd          d         }|| j        j        v r| j        j        | j        j                 j	        }| j        j        |         \  }}t          |t          j                  r)| j        j                            |j        j                  }t           j                            | j        j        || j        j        |z   z  || | j        j        |j                  } || j        |          }|| j        |<   |S d	}t,          D ]}t          | |          r|j        }t          | d
| j        j         d|           )z)Method for accessing members of the type.)rE  r   z(Object has not been properly initializedrS  __r   N)r{   r|   r   r   r   rG   r   r"  z has no attribute: .)r   rE  
startswithr   r   rC  rt   ry   r{   r   r7   r   ReferenceTemplatesymbol_spaceget_typer^   r   rL   r   r|   r   rG   rf  r8   )	rR   r   r   rW  r@   r_   rT  ri  rj  s	            r2   r   zAggregateType.__getattr__  s    /// !KLLL4))))$//??3 	.(=(= 	.$$,,		$**,,-D48###='(;<ID(,(8(>%OX(I$?@@ W=5>>x|?UVV$,>>8.tx@A "&("<] ?  K XdmMMMF+1D"4(M"& 	- 	-H$)) -#,GGDH,>GGGG
 
 	
r4   c                     t          t                                                                t          | j        j                  z   S )z6Returns a complete list of members when dir is called.)listrb   __dir__r   rC  r  s    r2   rv  zAggregateType.__dir__  s1    EGGOO%%&&dh.>)?)???r4   c                 l    d}t           D ]}t          | |          r|j        }t          | d          )Nr"  zKs cannot be written to directly, individual members must be written instead)rf  r7   r8   r,   )rR   r5   ri  rj  s       r2   rS   zAggregateType.write  sO    "& 	- 	-H$)) -#,ddd
 
 	
r4   )rT  )r8   rI   rJ   rT   r   r]   r   r+   rL   r   r$   r   r	   rM   rc   r&   r   r#  rU   rO   rK   rk  objectrT  r   r   r   rv  rS   r   r   s   @r2   r"  r"  +  s        5#45 5  '9	5
 5 c5j&8&A!ABBC5 
5 5 5 5 5 5$/c /d / / / /
X# X X X X>7 >7 >7 >7 >7:-=N >7 >7 >7@ S3c:+=+F&F GGHS	S S S [S,& &3 &f & & & & 
  
  
  
  
  
Z@# @ @ @ @ @ @
 
 
 
 
 
 
r4   r"  c                       e Zd ZdS )
StructTypeNr8   rI   rJ   rN   r4   r2   rz  rz            Dr4   rz  c                       e Zd ZdS )	UnionTypeNr{  rN   r4   r2   r~  r~    r|  r4   r~  c                       e Zd ZdS )	ClassTypeNr{  rN   r4   r2   r  r    r|  r4   r  r.   unionclass)7r=  collections.abcloggingr.   typingr   r   r   r   r   r   r	   r
   r   r   r   volatility3.frameworkr   r   volatility3.framework.objectsr   	getLoggerr8   rB   
namedtupler   r*   r$   r'   r+   r&   r3   r;   rL   rU   r=   rW   r[   r   r   r   r   r   r   r   r   r   r>  r?  r  r"  rz  r~  r  rf  rN   r4   r2   <module>r     s5  
                                  8 7 7 7 7 7 7 7 3 3 3 3 3 3		8	$	$''777 
1
1fS%T9:;1  1 CsD()	1 1 1 1<&-#ueS$./&-fS%T9:;&-  &- 	&- &- &- &-RQ Q Q Q Q:- Q Q Q*    z!1   \- \- \- \- \-j(8 \- \- \-D' ' ' ' 'os ' ' '@ @ @ @ @os @ @ @) ) ) ) )OU ) ) )' ' ' ' '?C ' ' '/' /' /' /' /'OU /' /' /'dE+ E+ E+ E+ E+_c E+ E+ E+PwC wC wC wC wCg wC wC wCt:= := := := :=z!13 := := :=z@= @= @= @= @=*$4c @= @= @=F|, |, |, |, |,J.0H |, |, |,~{
 {
 {
 {
 {
J&6 {
 {
 {
|	 	 	 	 	 	 	 		 	 	 	 	 	 	 		 	 	 	 	 	 	 	 h	7IwOr4   