vf*PbddlZddlZddlmZmZddlmZddlmZm Z m Z m Z ddl m Z mZmZmZmZddlmZddlmZej,eZGdd eZGd d eZGd d eZGddeZGddeZGddeZGddej>j@Z!y)N)ABCabstractmethod)Enum) GeneratorIteratorListTuple)class_subclasses constants exceptions interfaces renderers) requirements)utilityc eZdZdZdZdZdZdZy) DescStateEnumrN)__name__ __module__ __qualname__ desc_miss desc_reserveddesc_committeddesc_finalized desc_reusableZ/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/kmsg.pyrrsIMNNMr rc eZdZdZdZdZdejjdejjfdZ e dejjdejjde eeeeeeffdZede eeeeeeffd Ze ed ejj&defd Zd ed edefdZdedefdZdefdZdZdZdeeeeeffdZe dedefdZe dedefdZy)ABCKmsgKernel log buffer reader)emergalertcriterrwarnnoticeinfodebug) kernusermaildaemonauthsysloglprnewsuucpcronauthprivftpcontextconfigc||_||_|j|jd|_|jj|_|jj dj |_y)Nkernelpointer)_context_configmodulesvmlinux layer_nameget_typesizelong_unsigned_int_size)selfr9r:s r!__init__zABCKmsg.__init__<sY    t||H'=> ,,11&*ll&;&;I&F&K&K#r returnc#K|j|d}d}t|D]}|j|s0tj t j d|jEtj t j d|j|||}|jEd{n|tjdyy7 w)a3It calls each subclass symtab_checks() to test the required conditions to that specific kernel implementation. Args: context: The volatility3 context on which to operate config: Core configuration Yields: The kmsg records. Same as run() r<N)rAz7Kmsg implementation '%s' doesn't match this memory dumpz!Kmsg implementation '%s' matches!r9r:z-Unsupported kernel ring buffer implementation) r@r symtab_checksvolloglogr LOGLEVEL_VVVVrrunerror)clsr9r:rA kmsg_instsubclasss r!run_allzABCKmsg.run_allGs //&"23 (- H))'): ++M%%  JJ''3!!  !@I }} & & % (   LLH I  'sB1C3C4!Ccy)aWalks through the specific kernel implementation. Returns: tuple: facility [str]: The log facility: kern, user, etc. See FACILITIES level [str]: The log level: info, debug, etc. See LEVELS timestamp [str]: The message timestamp. See nsec_to_sec_str() caller [str]: The caller ID: CPU(1) or Task(1234). See get_caller() line [str]: The log message. NrrFs r!rOz ABCKmsg.runqr rAcy)apThis method on each sublasss will be called to evaluate if the kernel being analyzed fulfill the type & symbols requirements for the implementation. The first class returning True will be instantiated and called via the run() method. Returns: bool: True if the kernel being analyzed fulfill the class requirements. NrrQrAs r!rKzABCKmsg.symtab_checks~rWr addrlengthc|jj|jj||}|j ddS)Nutf8replace)encodingerrors)r>layersrBreaddecode)rFrZr[txts r! get_stringzABCKmsg.get_strings:mm""4??388vFzz6)z<>+ &'' 6 6..0 0r c,|dzrdnd}d||dzfz}|S)NlCPUTaskz%s(%u)lr)rFrp caller_namecallers r!rrzABCKmsg.get_caller_texts)(:5e6 [)k*ABB r cr|j|j|j||j|fSrj)facilitylevelrnrtrls r! get_prefixzABCKmsg.get_prefixs6 LL II  ) )# . OOC   r r|c|t|jkr|j|Stjd|dt |S)NzLevel  unknown)lenLEVELSrLr,str)rQr|s r!get_level_textzABCKmsg.get_level_texts@ 3szz? "::e$ $ LL6%1 2u: r r{c|t|jkr|j|Stjd|dt |S)Nz Facility r)r FACILITIESrLr,r)rQr{s r!get_facility_textzABCKmsg.get_facility_textsA c#..) )>>(+ + LL9XJh7 8x= r N)rrr__doc__rrr r9ContextInterface configurationHierarchicalDictrG classmethodrr rrTrrOModuleInterfaceboolrKintrerhrnrtrrr}rrrr r!r#r#s" F J L##44 L((99 L'J##44'J((99'J %S#sC/0 1 'J'JR  XeCc3$;<=     J$6$6$F$F 4  =s=C=C= MC MC M1s11  sCc'9!: 33!!!!r r#cHeZdZdZedefdZdeee e e e e ffdZ y) Kmsg_pre_3_5zThe kernel ring buffer (log_buf) is a char array that sequentially stores log lines, each separated by newline (LF) characters. i.e: <6>[ 9565.250411] line1!\n<6>[ 9565.250412] line2\n... rHc|jdxrH|jd xr4|jdxr |jdjd S)Nlog_end log_first_idxrMrk) has_symbolhas_typerCrqrYs r!rKzKmsg_pre_3_5.symtab_checkssf   y ) &&77   'B$$U+66yA r c#DK|jjd}|jjd}tj||}|jjd}||kDr||z }||d}|d|}||z}|j }|D]} t j d| } | s| j\} } } t| }|dz}|dz }|j|}|j|}tj}||| || fyw) Nlog_buf) symbol_name log_buf_len)countrz <(\d+)>\[\s*(\d+\.\d+)\]\s(.*?)$r) rAobject_from_symbolrpointer_to_string splitlinesrematchgroupsrrrrrs)rF log_buf_ptrrrrstart first_half second_half log_buf_lines log_buf_linemlevel_facility_str timestamp_strlinelevel_facilityr|r{ level_txt facility_txtrys r!rOzKmsg_pre_3_5.runs8ll55)5L ll55-5P ++K{K,,11i1H [ k)E J!&5/K ;.G**, ) GLrarBrbsplitrc)rFrrr dict_offset dict_datachunks r!get_dict_lineszKmsg_3_5_to_3_11.get_dict_liness <<1 335,,//@EEggnn6E MM((9>>  __W- 'E & & 'sCCc#K|jjd}|jjd}t|jjd}t|jjd}|j}|}||kr|}n|}||kr||z}|jj ||} | j dk(rd}|}n|j | \} } } } |j| }|j| }|j| D] }||| | |f |j| D] }||| | |f || j z }||kryyw)Nrrr log_next_idx) object_typerr) rArrrobjectrr}rrrr)rFrrrrrcur_idxend_idxrrr{r| timestampryrrrs r!rOzKmsg_3_5_to_3_11.run"stll55i@ ll55mD DLL;;OLM 4<<::>JK 335 < '"G!G$w.J,,%%/*%UCww!|&59__S5I2%F //6 #55h?  ..s3KD& 9fdJJK //4KD& 9fdJJK377"'s E E%#E%)rrrrrrrKrrrrrrrr rOrr r!rrs t  99 )Ic4o$>) 'YsD$%? '.#XeCc3$;<=.#r rc,eZdZdZedefdZdZy)Kmsg_3_11_to_5_10zStarting from version 3.11, the struct 'log' was renamed to 'printk_log'. While 'log_buf' is declared as a pointer and '__log_buf' as a char array, it essentially holds an array of 'printk_log' structs. rHc$|jdSN printk_log)rrYs r!rKzKmsg_3_11_to_5_10.symtab_checksYs --r cyrrrVs r!rz&Kmsg_3_11_to_5_10._get_log_struct_name]sr N)rrrrrrrKrrr r!rrSs' .t..r rceZdZdZedefdZdefdZde eddffdZ de eddffdZ de e eeeeeffdZy) Kmsg_5_10_to_a\In 5.10 the kernel ring buffer implementation changed. Previously only one process should read /proc/kmsg and it is permanently open and periodically read by the syslog daemon. A high level structure 'printk_ringbuffer' was added to represent the printk ring buffer which actually contains two ring buffers. The descriptor ring 'desc_ring' contains the records' metadata, text offsets and states. The data block ring 'text_data_ring' contains the records' text strings. A pointer to the high level structure is kept in the prb pointer which is initialized to a static ring buffer. .. code-block:: c static struct printk_ringbuffer *prb = &printk_rb_static; In SMP systems with more than 64 CPUs this ring buffer size is dynamically allocated according the number of CPUs based on the value of CONFIG_LOG_CPU_MAX_BUF_SHIFT. The prb pointer is updated consequently to this dynamic ring buffer in setup_log_buf(). .. code-block:: c prb = &printk_rb_dynamic; Behind scenes, 'log_buf' is still used as external buffer. When the static 'printk_ringbuffer' struct is initialized, _DEFINE_PRINTKRB sets text_data_ring.data pointer to the address in 'log_buf' which points to the static buffer '__log_buf'. If a dynamic ring buffer takes place, setup_log_buf() sets text_data_ring.data of 'printk_rb_dynamic' to the new allocated external buffer via the 'prb_init' function. In that case, the original external static buffer in '__log_buf' and 'printk_rb_static' are unused. .. code-block:: c new_log_buf = memblock_alloc(new_log_buf_len, LOG_ALIGN); prb_init(&printk_rb_dynamic, new_log_buf, ...); log_buf = new_log_buf; prb = &printk_rb_dynamic; See printk.c and printk_ringbuffer.c in kernel/printk/ folder for more details. rHc$|jdS)Nprb)rrYs r!rKzKmsg_5_10_to_.symtab_checkss!!%((r c8|j}d|z}|jj|z}|jj|z}|dzry||kDrd}|j}||z} |j | z} t |j||z } |j| | S)Nrr) size_bits text_blk_lposbeginnextrEdataminrre) rFtext_data_ringdescr+ text_data_sztext_data_maskrend desc_id_size text_startrrs r!get_text_from_data_ringz%Kmsg_5_10_to_.get_text_from_data_rings%// l*""((>9  %%6 19 3;E22 \) $$z1t}}cEk2vx00r Nc#fK|j|||}|jEd{y7wrj)rr)rFrrr+rs r!rzKmsg_5_10_to_.get_log_liness*++ND$G??$$$s '1/1c#Ktj|jj}|rd|tj|jj}|rd|yyw)Nz SUBSYSTEM=z DEVICE=)rarray_to_stringdev_info subsystemdevice)rFr+ dict_texts r!rzKmsg_5_10_to_.get_dict_liness_++DMM,C,CD  {+ +++DMM,@,@A YK( ( sA'A)c#K|jjdj}|j}|j}d|j z}|jj tjzdz}|jj||j|jjd||j}|jj||j|jjd||j}|j}|dz} | dz } d | z} | } |j j"} d}| |k7r|j$j"}|| |z}|| |z}t'|j(j"| z d z}|t&j*t&j,fvrx|j/|\}}}}|j1|}|j3|}|j5|||D] }|||||f |j7|D] }|||||f | dz } | | z} | |k7ryyw) Nrrarrayprb_desc)rsubtyperrB printk_inforr)rAr dereference desc_ringr count_bitssymbol_table_namer BANGr>rdescsrCrBinfosrEtail_idcounterhead_idr state_varrrr}rrrr)rF ringbuffersrr desc_count array_typedesc_arrinfo_arrdesc_state_var_bytes_szdesc_state_var_bits_szdesc_flags_shiftdesc_flags_mask desc_id_maskcur_idend_idrr+ desc_stater{r|rryrrrs r!rOzKmsg_5_10_to_.runs_ll55e<HHJ )) $33)... \\33innDwN =='' ??LL))*5 ( =='' ??LL))-8 ( #'"="=!81!<1A5//'' ""**&&..FFZ/0DFZ/0D&(>(>BR(RVW'WXJ,,,,6:__T5J2%F //6 #55h?  ..~tTJKD& 9fdJJK //5KD& 9fdJJK aKF l "F's II I )rrrrrrrKrrrrrrr rOrr r!rras*X)t))1S14%9S$PT_;U%)iT4&@)6#XeCc3$;<=6#r rc eZdZdZdZdZedeejjfdZ de e ee eeeeefffdZdZy) Kmsgr$)rr)rrrrHc8tjddgdgS)Nr<z Linux kernel)Intel32Intel64AArch64)name description architectures)rModuleRequirement)rQs r!get_requirementszKmsg.get_requirementss%  * **?   r c#xKtj|j|jD]}d|f yw)NrJr)r#rTr9r:)rFvaluess r! _generatorzKmsg._generators4oodll4;;oO Ff+  s8:c|jjjddstjdt j dtfdtfdtfdtfdtfg|jS) N dwarf2jsonc| xs|dkDS)N)rrr)version_s r!zKmsg.run.. s'k-Qg >Qr zmInvalid symbol table, please ensure the ISF table produced by dwarf2json was produced using a version > 0.4.1r{r|rryr) r9 symbol_spaceverify_table_versionsr SymbolSpaceErrorrTreeGridrrrVs r!rOzKmsg.runs||((>> Q -- !!S!#c"3   OO   r N)rrrr_required_framework_version_versionrrr rRequirementInterfacerrr rrrrOrr r!rrsj""+H j&>&>&S&S!T  HU3c3S#6M0N+N%OP r r)"rloggingabcrrenumrtypingrrrr volatility3.frameworkr r r r r#volatility3.framework.configurationrvolatility3.framework.objectsr getLoggerrrLrr#rrrrpluginsPluginInterfacerrr r!r6s #33=1   8 $Dd!cd!N1G71GhV#wV#r ( N#GN#b& :   - -& r