vfdZddlZddlmZmZmZddlmZmZm Z ddl m Z ddl m Z ddlmZddlmZdd lmZdd lmZdd lmZdd lmZej4eZGd de j:Zy)zkA module containing a collection of plugins that produce data typically found in Linux's /proc file system.N)ListOptionalType) constants interfaces renderers) requirements)plugins)utility) format_hints)intermed)elf)ELF_MAX_EXTRACTION_SIZE)pslistcjeZdZdZdZdZedeejjfdZ edejjdeded ejj d ejj d eej$j&deej$j&fd Zd ZdZy)Elfsz4Lists all memory mapped ELF files for all processes.rr)rrreturnc tjddgdtjdtjdtj dd t d tjd d dd gS)Nkernelz Linux kernel)Intel32Intel64AArch64)name description architecturesrr)rpluginversionpidzFilter on specific process IDsT)rr element_typeoptionaldumpzExtract listed processesF)rrdefaultr#)r ModuleRequirementPluginRequirementrPsListListRequirementintBooleanRequirement)clss Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/elfs.pyget_requirementszElfs.get_requirementssx  * **?   * *fmmY   ( (<     + +6    context layer_nameelf_table_namevmatask open_methodc |j|}d}|j|tjzdz|j|} | j st jdyi} | jD]} | jjdk7r | j} | j} | | z}| |j zr| |j"z} ||j zr||j"z|j z}|| z }|dks |t$kDrtd||| | <d }t'| j)D]-}| |}|j+|j|z|d }||z}/|d |j,d t/j0|j2d |jdd}|j5||S#t$r5t jtjd| jYwxYw)a]Extracts an ELF as a FileHandlerInterface Args: context: the context to operate upon layer_name: The name of the layer on which to operate elf_table_name: the name for the symbol table containing the symbols for ELF-files vma: virtual memory allocation of ELF task: the task object whose memory should be output open_method: class to provide context manager for opening the file Returns: An open FileHandlerInterface object containing the complete data for the task or None in the case of failure NElf)offsetr1z$ELF object to be dumped is not validPT_LOADz*Skipping unknown ELF program header type: rz(The claimed size of the ELF is invalid: r/Tpadzpid..z#xz.dmp)layersobjectrBANGvm_startis_validvollogdebugget_program_headersp_typer ValueErrorlog LOGLEVEL_VVVVp_vaddrp_memsz page_size page_maskrsortedkeysreadr!r array_to_stringcommwrite)r,r0r1r2r3r4r5 proc_layer file_handle elf_objectsectionsphdrstartsizeend real_sizeelf_data section_start read_sizebufs r-elf_dumpz Elfs.elf_dump7s,^^J/  ^^ Y^^ +e 3<<!$ ""$ LL? @224 (D ;;**i78LLE< t/TC#~H  & "488*Ag55dii@A3<"+H j&>&>&S&S!T  0P##44PP P    / / P   00 P*,,AABP *$$99 :PPd-^ r/r)rloggingtypingrrrvolatility3.frameworkrrr#volatility3.framework.configurationr volatility3.framework.interfacesr volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr .volatility3.framework.symbols.linux.extensionsr%volatility3.framework.constants.linuxrvolatility3.plugins.linuxr getLoggerrrBPluginInterfacerrr/r-rs['''BB<4182>I,   8 $r 7 " "r r/