vf!6ddlZddlZddlZddlZddlmZmZddlmZm Z m Z m Z ddl m Z ddlmZmZddlmZddlmZej*eZGdd ej0ZGd d e j4j6ZGd d ej:Zy)N)DictList) constants exceptions interfaces renderers) requirements) configurationplugins) format_hints)intermedceZdZejZejZejZejZejZ y)VMCSTestN) __name__ __module__ __qualname__enumautoVMCS_ABORT_INVALIDVMCS_LINK_PTR_IS_NOT_FSVMCS_HOST_CR4_NO_VTXVMCS_CR3_IS_ZEROVMCS_GUEST_CR4_RESERVEDV/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/vmscan.pyrrsH"'diik$499; tyy{'diikrrc@eZdZddeedeffd ZdedefdZxZS)PageStartScanner signatures page_sizect|t|s tdt|d|_|D]%}t||jk7std||_||_y)Nz#No signatures passed to constructorrz:Signatures of different lengths passed to PageStartScanner)super__init__len ValueError_siglen _signatures _page_size)selfrr item __class__s rr#zPageStartScanner.__init__sq :BC C:a=)  D4yDLL( P  &#rdata data_offsetc#Kt||jzt||jD]:}||||jz|jvs"||z||||jzf<yw)zPScans only the start of every page, to see whether a signature is present or notN)ranger(r$r&r')r)r,r- page_starts r__call__zPageStartScanner.__call__*sw $// )3t9doo  JJdll!:;t?O?OO,j4<<&?@  s AA.A.)i) rrrrbytesintr#r1 __classcell__)r+s@rrrs- $4; $3 $ U  rrcheZdZdZdZdZejejejhZ e de e jjfdZde j"j$dedeeeffdZe de j"j$d e j.j0de efd Zd Zd Zy )VmscanzKScans for Intel VT-d structues and generates VM volatility configs for them)r7r)rrreturncbtjddtjddddgS) NprimaryzPhysical base memory layer)name description log-thresholdz0Number of criteria failed to log to debug outputr7T)r<r=defaultoptional)r TranslationLayerRequirementIntRequirement)clss rget_requirementszVmscan.get_requirementsBs>  4 4,H   ' '$N    rcontext config_pathc jtjjtjj dd}g}|D]}tjj |jdd}tjj|tj|dtjj dd|}|j|i}|D]N}|j|} tjdt| j!dj"} ||| <P|S)aEnumerate all JSON files containing VMCS information and return the structures Signatures can be generated using data extracted using the vmcs_layout tool at https://github.com/google/rekall/tree/master/tools/linux/vmcs_layout Args: context: The volatility context to work against config_path: The location to store symbol table configurations under Returns: A dictionary of pattern bytes to the string representation of the architecture genericvmcs.r)filenamez>- . 3 3DHHOOa4G KT   H77 7L   !3 3 H<< >. . H<< z Potential z VMCS found at xz with failed criteria: )rbrErFrhconfiggetscanrlistkeys_progress_callbackobjectrBANGr<rsr Hexrfrjeptrmr$vollogdebugrInvalidAddressExceptionAttributeError)r) structureslayerrjmatchrIrrs r _generatorzVmscan._generators11$,,@P@PQ  ##DKK $:; <<  N +LL'' ^(DEE#ZZ LL T*//"34 5  # #  MFE  ||**u% 6@JJ!+ #44T\\4H "&u-(,,TXX__=(,,TXX6(,,T^^< ;'4;;+GG (E):(;?488??[\J]]tvAuBC/ 466G  s+CHDG?;H?HHHHctjdtfdtjfdtjfdtjfg|j S)N ArchitecturezVMCS Physical offsetEPTz Guest CR3)rTreeGridstrr rr)r)s rrunz Vmscan.runsX!!%')9)9: (()l../   OO   rN)rrr__doc___required_framework_version_versionrrrrSTRICTLY_REQUIRED_TESTS classmethodrrr RequirementInterfacerDrEContextInterfacerrr2rbobjectsObjectInterfacersrrrrrr6r66sU"+H ##((%%   j&>&>&S&S!T    $!))::$IL$ eSj $L+##44+  00+ c ++Z'R  rr6)rloggingrOrXtypingrrvolatility3.frameworkrrrr#volatility3.framework.configurationr volatility3.framework.interfacesr r volatility3.framework.renderersr volatility3.framework.symbolsr getLoggerrrIntFlagrrhScannerInterfacerPluginInterfacer6rrrrsv   NN<C82   8 $*t||*z((994c W $ $c r