
    *1fq                         d Z ddlZddlmZmZmZ ddlmZmZm	Z	 ddl
mZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ej        e          Z G d dej                  ZdS )zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)ListOptionalType)	constants
interfaces	renderers)requirements)plugins)utility)format_hints)intermed)elf)ELF_MAX_EXTRACTION_SIZE)pslistc                      e Zd ZdZdZdZedeej	        j
                 fd            Zedej        j        deded	ej        j        d
ej        j        deej        j                 deej        j                 fd            Zd Zd ZdS )Elfsz4Lists all memory mapped ELF files for all processes.   r   r   )r   r      returnc           	          t          j        ddg d          t          j        dt          j        d          t          j        dd	t          d
          t          j        dddd
          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptionaldumpzExtract listed processesF)r   r   defaultr#   )r	   ModuleRequirementPluginRequirementr   PsListListRequirementintBooleanRequirement)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/elfs.pyget_requirementszElfs.get_requirements   s     **???  
 *fmY   (< 	   +6	  
 	
    context
layer_nameelf_table_namevmataskopen_methodc           	         |j         |         }d}|                    |t          j        z   dz   |j        |          }	|	                                sdS i }
|	                                D ]}	 |j        j        dk    rn=# t          $ r0 t                              t          j        d|j                    Y Nw xY w|j        }|j        }||z   }||j        z  r
||j        z  }||j        z  r||j        z  |j        z   }||z
  }|dk     s|t"          k    rt          d|           ||
|<   d}t%          |
                                          D ]/}|
|         }|                    |j        |z   |d	
          }||z   }0 |d|j         dt-          j        |j                   d|j        dd          }|                    |           |S )a]  Extracts an ELF as a FileHandlerInterface
        Args:
            context: the context to operate upon
            layer_name: The name of the layer on which to operate
            elf_table_name: the name for the symbol table containing the symbols for ELF-files
            vma: virtual memory allocation of ELF
            task: the task object whose memory should be output
            open_method: class to provide context manager for opening the file
        Returns:
            An open FileHandlerInterface object containing the complete data for the task or None in the case of failure
        NElf)offsetr1   PT_LOADz*Skipping unknown ELF program header type: r   z(The claimed size of the ELF is invalid: r/   Tpadzpid..z#xz.dmp)layersobjectr   BANGvm_startis_validget_program_headersp_typer   
ValueErrorvolloglogLOGLEVEL_VVVVp_vaddrp_memsz	page_size	page_maskr   sortedkeysreadr!   r   array_to_stringcommwrite)r,   r0   r1   r2   r3   r4   r5   
proc_layerfile_handle
elf_objectsectionsphdrstartsizeend	real_sizeelf_datasection_start	read_sizebufs                       r-   elf_dumpzElfs.elf_dump7   s<   , ^J/
^^Y^+e3<! $ 
 

 ""$$ 	42244 	( 	(D;*i77 8   

+NNN    LE<D$,C
 z++ 5
 44Z)) JZ11Z5IIeI 1}}	,C C C !WI!W!WXXX'HUOO#HMMOO44 	& 	&M /I//#,">	t/TTC#~HH!kX48XXg5di@@XX3<XXXX
 
 	(###s   ,A>>7B87B8c           
   #     K   t           j                            | j        | j        ddt
          j                  }|D ]>}|                                }|s| j        j        |         }t          j
        |j                  }|j                                        D ]}|                    |j        dd          }|dk    r&|                    | j        |          }	d}
| j        d	         rP|                     | j        ||||| j                  }d
}
|r(|                                 t+          |j                  }
d|j        |t1          j        |j                  t1          j        |j                  |	|
ffV  @d S )Nlinuxr   )class_types   Tr:   s   ELFDisabledr$   zError outputting filer   )r   IntermediateSymbolTablecreater0   config_pathr   rb   add_process_layerr=   r   rO   rP   mmget_vma_iterrN   r@   get_nameconfigr_   openclosestrpreferred_filenamer!   r   Hexvm_end)selftasksr2   r4   proc_layer_namerR   r   r3   hdrpathfile_outputrS   s               r-   
_generatorzElfs._generator   s     !9@@L$*GU A 
 
  )	 )	D"4466O" ,_=J*4955Dw++--     ooclA4o@@*$$||DL$77(;v& J"&--'&	# #K #:K" J#))+++&)+*H&I&I $(66$(44#
 
 
 
 
- )	 )	r/   c           
         t           j                            | j                            dd                     }t          j        dt          fdt          fdt          j
        fdt          j
        fdt          fdt          fg|                     t           j                            | j        | j        d         |	                              S )
Nr!   PIDProcessStartEndz	File PathzFile Outputr   )filter_func)r   r(   create_pid_filterrl   getr   TreeGridr*   ro   r   rq   ry   
list_tasksr0   )rs   r   s     r-   runzElfs.run   s    m55dkooeT6R6RSS!C ,*+()c"$ OO((L$+h"7[ )   
 
 	
r/   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer.   r0   ContextInterfacero   objectsObjectInterfacer   r
   FileHandlerInterfacer   r_   ry   r    r/   r-   r   r      s       >>"+H
j&>&S!T 
 
 
 [
0 O#4O O 	O
 /O  0O *,ABO 
*$9	:O O O [Ob- - -^
 
 
 
 
r/   r   )r   loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   .volatility3.framework.symbols.linux.extensionsr   %volatility3.framework.constants.linuxr   volatility3.plugins.linuxr   	getLoggerr   rE   PluginInterfacer   r   r/   r-   <module>r      s;  ' '  ' ' ' ' ' ' ' ' ' ' B B B B B B B B B B < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 2 2 2 2 2 2 > > > > > > I I I I I I , , , , , , 
	8	$	$q
 q
 q
 q
 q
7" q
 q
 q
 q
 q
r/   