*1f4PvddlZddlZddlmZmZddlmZddlmZm Z m Z m Z ddl m Z mZmZmZmZddlmZddlmZejeZGdd eZGd d eZGd d eZGddeZGddeZGddeZGddejj Z!dS)N)ABCabstractmethod)Enum) GeneratorIteratorListTuple)class_subclasses constants exceptions interfaces renderers) requirements)utilityc"eZdZdZdZdZdZdZdS) DescStateEnumrN)__name__ __module__ __qualname__ desc_miss desc_reserveddesc_committeddesc_finalized desc_reusableZ/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/kmsg.pyrrs'IMNNMMMr rc eZdZdZdZdZdejjdej j fdZ e dejjdej j de eeeeeeffdZede eeeeeeffd Ze ed ejjdefd Zd ed edefdZdedefdZdefdZdZdZdeeeeeffdZe dedefdZe dedefdZdS)ABCKmsgKernel log buffer reader)emergalertcriterrwarnnoticeinfodebug) kernusermaildaemonauthsysloglprnewsuucpcronauthprivftpcontextconfigc||_||_|j|jd|_|jj|_|jdj|_dS)Nkernelzlong unsigned int)_context_configmodulesvmlinux layer_nameget_typesizelong_unsigned_int_size)selfr9r:s r!__init__zABCKmsg.__init__<sU    t|H'=> ,1&*l&;&;>+ & & 1'' 66 6.00 0r c,|dzrdnd}d||dzfz}|S)NlCPUTaskz%s(%u)lr)rEro caller_namecallers r!rqzABCKmsg.get_caller_texts.(:5Aee6 [)k*ABB r cn|j|j||||fSri)facilitylevelrmrsrks r! get_prefixzABCKmsg.get_prefixs8 L I  ) )# . . OOC   r r{c|t|jkr |j|Std|dt |S)NzLevel  unknown)lenLEVELSrKr,str)rPr{s r!get_level_textzABCKmsg.get_level_textsL 3sz?? " ":e$ $ LL1%111 2 2 2u:: r rzc|t|jkr |j|Std|dt |S)Nz Facility r~)r FACILITIESrKr,r)rPrzs r!get_facility_textzABCKmsg.get_facility_textsN c#.)) ) )>(+ + LL7X777 8 8 8x== r N)rrr__doc__rrr r9ContextInterface configurationHierarchicalDictrF classmethodrr rrSrrNModuleInterfaceboolrJintrdrgrmrsrqr|rrrr r!r#r#sN"" F J V#4 V(9 V V V V'J#4'J(9'J %S#sC/0 1 'J'J'J['JR  XeCc3$;<=    ^   J$6$F 4   ^[ =s=C=C==== MC MC M M M M1s1111111  sCc'9!:    33[!!!!![!!!r r#c\eZdZdZedefdZdeee e e e e ffdZ dS) Kmsg_pre_3_5zThe kernel ring buffer (log_buf) is a char array that sequentially stores log lines, each separated by newline (LF) characters. i.e: <6>[ 9565.250411] line1!\n<6>[ 9565.250412] line2\n... rGc|doS|d o=|do'|dd S)Nlog_end log_first_idxrLrj) has_symbolhas_typerBrprXs r!rJzKmsg_pre_3_5.symtab_checkssu   y ) ) &&777   ''B$$U++66yAA r c#pK|jd}|jd}tj||}|jd}||kr||z }||d}|d|}||z}|}|D]} t jd| } | s| \} } } t| }|dz}|dz }| |}| |}tj }||| || fVdS) Nlog_buf) symbol_name log_buf_len)countrz <(\d+)>\[\s*(\d+\.\d+)\]\s(.*?)$r) r@object_from_symbolrpointer_to_string splitlinesrematchgroupsrrrrrr)rE log_buf_ptrrrrstart first_half second_half log_buf_lines log_buf_linemlevel_facility_str timestamp_strlinelevel_facilityr{rz level_txt facility_txtrxs r!rNzKmsg_pre_3_5.runsnl55)5LL l55-5PP +K{KKK,11i1HH [ k)E J!&5&/K ;.G**,, ) G GL>   __W-- ' 'E & & & & & ' 'r c#K|jd}|jd}t|jd}t|jd}|}|}||kr|}n|}||kr||z}|j||} | jdkrd}|}n|| \} } } } || }|| }| | D] }||| | |fV | | D] }||| | |fV || jz }||kdSdS)Nrrr log_next_idx) object_typerr) r@rrrobjectrr|rrrr)rErrrrrcur_idxend_idxrrrzr{ timestamprxrrrs r!rNzKmsg_3_5_to_3_11.run"sl55i@@ l55mDD DL;;OLLMM 4<::>JJKK 3355 < ' '"GG!G$w.J,%%/*%UUCw!||&59__S5I5I2%F //66 #55h??  ..s33KKD& 9fdJJJJJ //44KKD& 9fdJJJJJ37"'r )rrrrrrrJrrrrrrrr rNrr r!rrs t   [ 99999 )Ic4o$>)))) 'YsD$%? ' ' ' '.#XeCc3$;<=.#.#.#.#.#.#r rc4eZdZdZedefdZdZdS)Kmsg_3_11_to_5_10zStarting from version 3.11, the struct 'log' was renamed to 'printk_log'. While 'log_buf' is declared as a pointer and '__log_buf' as a char array, it essentially holds an array of 'printk_log' structs. rGc,|dSN printk_log)rrXs r!rJzKmsg_3_11_to_5_10.symtab_checksYs ---r cdSrrrUs r!rz&Kmsg_3_11_to_5_10._get_log_struct_name]s|r N)rrrrrrrJrrr r!rrSsT .t...[.r rceZdZdZedefdZdefdZde eddffdZ de eddffdZ de e eeeeeffdZdS) Kmsg_5_10_to_a\In 5.10 the kernel ring buffer implementation changed. Previously only one process should read /proc/kmsg and it is permanently open and periodically read by the syslog daemon. A high level structure 'printk_ringbuffer' was added to represent the printk ring buffer which actually contains two ring buffers. The descriptor ring 'desc_ring' contains the records' metadata, text offsets and states. The data block ring 'text_data_ring' contains the records' text strings. A pointer to the high level structure is kept in the prb pointer which is initialized to a static ring buffer. .. code-block:: c static struct printk_ringbuffer *prb = &printk_rb_static; In SMP systems with more than 64 CPUs this ring buffer size is dynamically allocated according the number of CPUs based on the value of CONFIG_LOG_CPU_MAX_BUF_SHIFT. The prb pointer is updated consequently to this dynamic ring buffer in setup_log_buf(). .. code-block:: c prb = &printk_rb_dynamic; Behind scenes, 'log_buf' is still used as external buffer. When the static 'printk_ringbuffer' struct is initialized, _DEFINE_PRINTKRB sets text_data_ring.data pointer to the address in 'log_buf' which points to the static buffer '__log_buf'. If a dynamic ring buffer takes place, setup_log_buf() sets text_data_ring.data of 'printk_rb_dynamic' to the new allocated external buffer via the 'prb_init' function. In that case, the original external static buffer in '__log_buf' and 'printk_rb_static' are unused. .. code-block:: c new_log_buf = memblock_alloc(new_log_buf_len, LOG_ALIGN); prb_init(&printk_rb_dynamic, new_log_buf, ...); log_buf = new_log_buf; prb = &printk_rb_dynamic; See printk.c and printk_ringbuffer.c in kernel/printk/ folder for more details. rGc,|dS)Nprb)rrXs r!rJzKmsg_5_10_to_.symtab_checkss!!%(((r c|j}d|z}|jj|z}|jj|z}|dzrdS||krd}|j}||z} |j| z} t |j||z } || | S)Nrr) size_bits text_blk_lposbeginnextrDdataminrrd) rEtext_data_ringdescr+ text_data_sztext_data_maskrend desc_id_size text_startrrs r!get_text_from_data_ringz%Kmsg_5_10_to_.get_text_from_data_rings%/ l*"(>9 %6 19 2 3;;E2 \) $z1t}cEk22vx000r Nc#lK||||}|Ed{VdSri)rr)rErrr+rs r!rzKmsg_5_10_to_.get_log_linessE++ND$GG??$$$$$$$$$$$r c#Ktj|jj}|rd|Vtj|jj}|r d|VdSdS)Nz SUBSYSTEM=z DEVICE=)rarray_to_stringdev_info subsystemdevice)rEr+ dict_texts r!rzKmsg_5_10_to_.get_dict_linessx+DM,CDD  ,+ ++ + + ++DM,@AA  )(Y(( ( ( ( ( ( ) )r c#K|jd}|j}|j}d|jz}|jjtjzdz}|j ||j |j d||j }|j ||j|j d||j }|j}|dz} | dz } d | z} | } |jj} d}| |kr|jj}|| |z}|| |z}t'|jj| z d z}|t&jt&jfvr||\}}}}||}||}||||D] }|||||fV ||D] }|||||fV | dz } | | z} | |kdSdS) Nrrarrayprb_desc)rsubtyperrA printk_inforr)r@r dereference desc_ringr count_bitssymbol_table_namer BANGr=rdescsrBrAinfosrDtail_idcounterhead_idr state_varrrr|rrrr)rE ringbuffersrr desc_count array_typedesc_arrinfo_arrdesc_state_var_bytes_szdesc_state_var_bits_szdesc_flags_shiftdesc_flags_mask desc_id_maskcur_idend_idrr+ desc_staterzr{rrxrrrs r!rNzKmsg_5_10_to_.runsrl55e<<HHJJ ) $3).. \3inDwN ='' ?L))*55 (  ='' ?L))-88 (  #'"=!81!<1A5//'' "*&.FFZ/0DFZ/0D&(>BR(RVW'WXXJ,,6:__T5J5J2%F //66 #55h??  ..~tTJJKKD& 9fdJJJJJ //55KKD& 9fdJJJJJ aKF l "F'r )rrrrrrrJrrrrrrr rNrr r!rras**X)t)))[)1S11114%9S$PT_;U%%%%)iT4&@))))6#XeCc3$;<=6#6#6#6#6#6#r rc eZdZdZdZdZedeej j fdZ de e ee eeeeefffdZdZdS) Kmsgr$)rr)rrrrGc6tjddgdgS)Nr<z Linux kernel)Intel32Intel64AArch64)name description architectures)rModuleRequirement)rPs r!get_requirementszKmsg.get_requirementss2  **???     r c#hKt|j|jD]}d|fV dS)NrIr)r#rSr9r:)rEvaluess r! _generatorzKmsg._generatorsFoodl4;oOO  Ff+      r c |jjddstjdt jdtfdtfdtfdtfdtfg|S) N dwarf2jsonc| p|dkS)N)rrr)version_s r!zKmsg.run.. s'k-Qg >Qr zmInvalid symbol table, please ensure the ISF table produced by dwarf2json was produced using a version > 0.4.1rzr{rrxr) r9 symbol_spaceverify_table_versionsr SymbolSpaceErrorrTreeGridrrrUs r!rNzKmsg.runs|(>> QQ   - !S!#c"3   OO     r N)rrrr_required_framework_version_versionrrr rRequirementInterfacerrr rrrrNrr r!rrs"""+H j&>&S!T   [ HU3c3S#6M0N+N%OP     r r)"rloggingabcrrenumrtypingrrrr volatility3.frameworkr r r r r#volatility3.framework.configurationrvolatility3.framework.objectsr getLoggerrrKrr#rrrrpluginsPluginInterfacerrr r!r5s@ ########333333333333=<<<<<111111  8 $ $Dd!d!d!d!d!cd!d!d!N1G1G1G1G1G71G1G1GhV#V#V#V#V#wV#V#V#r     (   N#N#N#N#N#GN#N#N#b& & & & & :  -& & & & & r