[ #g_GZddlZddlZddlZddlmZmZddlmZmZm Z m Z ddl m Z m Z ddlmZddlmZddlmZddlmZdd lmZej0eZeGd d ZeGd d ZGddej:ej<ZGddej:Z y)N) dataclassastuple)ListSetTypeIterable) renderers interfaces) format_hints)plugins) requirements) timeliner) mountinfoceZdZUdZeed<eed<eed<eed<eed<eed<eed<eed <eed <eed <eed <eed <eed<y) InodeUserzInode user representation, featuring augmented information and formatted fields. This is the data the plugin will eventually display. superblock_addr mountpointdevice inode_num inode_addrtype inode_pages cached_pages file_mode access_timemodification_time change_timepathN)__name__ __module__ __qualname____doc__int__annotations__str_/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/pagecache.pyrrsPO KNO IN Ir'rceZdZUdZej j ed<eed<ej j ed<eed<dejjde fdZ y ) InodeInternalzInode internal representation containing only the core objects Fields: superblock: 'super_block' struct mountpoint: Superblock mountpoint path inode: 'inode' struct path: Dentry full path superblockrinoder kernel_layerreturnc|jjj}|jjd|jj}t |j j}|j jj}|j jxstj}t tj|j jt|jz }t |j j j"}|j j%} |j j'} |j j)} |j j+} t-||j.||||||| | | | |j0 } | S)zAugment the inode information to be presented to the user Args: kernel_layer: The kernel layer to obtain the page size Returns: An InodeUser dataclass :) rrrrrrrrrrrrr)r+voloffsetmajorminorr#r,i_inoget_inode_typer UnparsableValuemathceili_sizefloat page_size i_mappingnrpages get_file_modeget_access_timeget_modification_timeget_change_timerrr)selfr-rrrr inode_typerrraccess_time_dtmodification_time_strchange_time_str inode_users r(to_userzInodeInternal.to_user:sW//--44OO))*!DOO,A,A+BC (() ZZ^^** ZZ..0OI4M4M4O $))DJJ$5$5l>T>T8U$UVW 4:://778 JJ,,. 335 $ @ @ B**446+!#%&3' r'N) rr r!r"r objectsObjectInterfacer$r%layersTranslationLayerInterfacerrIr&r'r(r*r**sX""222O    - -- I)&--GG) )r'r*c\eZdZdZdZdZedeejjfdZ e dejjdedefdZed eed ejjd efd Zed ej(j*dedeefdZdZdZe dZdZy)FileszLists files from memoryrrrrr.ctjddddgtjdtjdtj d d t d tjd dd gS)Nkernel Linux kernelIntel32Intel64name description architecturesr)rSrQrrZpluginversionrz=List of space-separated file type filters i.e. --type REG DIRT)rZr[ element_typeoptionalfindzFilename (full path) to findrZr[ra)r ModuleRequirementPluginRequirementr MountInfoListRequirementr%StringRequirementclss r(get_requirementszFiles.get_requirementsms|  * **()4   * * )<)= 4.2.x). Fast symlinks are filesystem agnostic. Args: inode: The inode (or pointer) to dump symlink_path: The symlink name Returns: If it can resolve the symlink, it returns a string "symlink_path -> target_path" Otherwise, it returns the same symlink_path i_linkstringzutf-8replace) max_lengthencodingerrorsz -> )is_link has_memberrn dereferencecast)r,rl i_link_strs r(_follow_symlinkzFiles._follow_symlinksc" U]]u'7'7'Aell11388S799J+^4 ||j||j||}t||||}|u&yw)aRetrieves the inodes from the superblocks Args: context: The context that the plugin will operate within vmlinux_module_name: The name of the kernel module on which to operate Yields: An InodeInternal object rrr)r+rr,rN) rrfget_superblockssets_rootrwis_rootrrrr*rrz)rjrrsuperblocks_iter seen_inodesr{r+rr}root_dentry_ptrr|root_inode_ptr root_inode root_pathinode_inr file_dentryfile_inode_ptr file_inodes r( get_inodeszFiles.get_inodess %..>> 3?  e  &6 "J )S0jJ)//O")557K&&()00N!'335J&&(, OON +"I$%%  H N+.*:*:{J+& ;#!,!4!4%+779 !**,"[0/// J ())$"  3+M'7sE E"c#"K|jd}|jj|}|jj|j}|j |j|}|jd}|D]}|r|j j|vr"|jdr?|j|jdk(sN|j|}dt|fy|j|}dt|fyw)NrUrrrbr) configrmodulesrL layer_namerr,r6rrIr)rCrvmlinux vmlinux_layer inodes_iter types_filterr inode_outs r( _generatorzFiles._generator&s"kk(3,,&&':; ++G,>,>? ooLL 3& {{6* #H = = ?| S{{6"==DKK$77 ( 0 0 ?Igi011$,,]; '),--$s CD ADc# K|jd}|jj|}|jj|j}|j |j|}|D]}|j |}d|j}|tjj|jf|tjj|jf|tjj|jfyw)zGenerates tuples of (description, timestamp_type, timestamp) These need not be generated in any particular order, sorting will be done later rUrzCached Inode for N)rrrrLrrrIrr TimeLinerTypeACCESSEDrMODIFIEDrCHANGEr)rCrrrrrrr[s r(generate_timelinezFiles.generate_timeline>s #kk(3,,&&':; ++G,>,>? ooLL 3& $H ((7I-inn-=>Ky66??AVAVV Vy66??A\A\\ \y66==y?T?TT T $sD Dc#K|D]h\}}g}t||D]L\}}|d}t||tjjfr|}n||}|j |N||fjyw)zDUses the headers type to cast the fields obtained from the generatorrSN)zip isinstancer r BaseAbsentValueappend) headers generatorlevelfieldsformatted_fieldsheaderfield header_typeformatted_fields r(format_fields_with_headersz Files.format_fields_with_headersTs'ME6! !$Wf!5 $Qi K)=)=)M)MN',O&1%&8O ''8"6)) )'sA/A1cdtjfdtfdtfdtfdtjfdtfdtfdtfd tfd tjfd tjfd tjfd tfg }t j ||j||jS)NSuperblockAddr MountPointDeviceInodeNum InodeAddrFileType InodePages CachedPagesFileMode AccessTimeModificationTime ChangeTimeFilePath) r Hexr%r#datetimer TreeGridrrrCrs r(runz Files.runfs |// 0 3  sO   ,** +   3  C   8,, - !2!2 3 8,, -    !! T44Wdoo>OP  r'N)rr r!r"_required_framework_version_version classmethodrr configurationRequirementInterfacerk staticmethodrJrKr%rzrr#rrContextInterfacerr*rrrrrr&r'r(rOrOfs%!"+H j&>&>&S&S!T  .!!11 0-Y3x-Y ''77-Y -Y-Y^U##44U!U - UUn.0U,**" r'rOc eZdZdZdZdZedeejjfdZ e dejjdedeej"j$d ej&j(dd f d Zd Zd Zy )rz%Lists and recovers cached inode pagesrPrRr.c tjddddgtjdtdtjd d d tj d dd tjddd gS)NrUrVrWrXrYfilesrRr]rbzFilename (full path) to find Trcr,z Inode addressdumpzOutput file path)r rdrerOrhIntRequirementris r(rkzInodePages.get_requirementss  * **()4   * *UI   * *;   ' '+   * *. '  r'r,filename open_methodrNc:|jstjdy ||5}|j}|j ||j D]}\}}||j z}||z } |d| } |t| z|kDr,tjd|jj|||j||j|  dddy#1swYyxYw#t$r!} tjd|| Yd} ~ yd} ~ wwxYw)aEExtracts the inode's contents from the page cache and saves them to a file Args: inode: The inode to dump filename: Filename for writing the inode content open_method: class for constructing output files vmlinux_layer: The kernel layer to obtain the page size The inode is not a regular fileNzAPage out of file bounds: inode 0x%x, inode size %d, page index %dz Unable to write to file (%s): %s) is_regvollogerrorr:truncate get_contentsr<lenr1objectseekwriteIOError) r,rrrf inode_sizepage_idx page_content current_fprr page_byteses r(write_inode_content_to_filez&InodePages.write_inode_content_to_files|| LL: ;   JX& (!"\\  :&.3.@.@.B*Hl!)M,C,C!CJ!+j!8J!-kz!:J!C O3j@ _!II,,&$  FF:&GGJ'/C  ( ( ($ J LL;Xq I I Js5C0B.C$C0$C-)C0-C00 D9DDc #tK|jd}|jj|}|jj|j}|jdr%|jdrt j dy|jdrStj|j|}|D],}|j|jdk(s |j}nInG|jdr"|jd|jdd}nt j dyjst j d y|j}|js$t j d |jdy|jD]}|j j"} |j%} |j&} t)|j*} | |j,z} | |k}|j/}d j1|Dcgc]}|j3d d c}}| | | | ||f}d|f|jdrY|jd}t j5d|j j"||j7|||j8|yycc}ww)NrUr,rbz,Cannot use --inode and --find simultaneouslyrT)absolutez%You must use either --inode or --findrzInvalid inode at 0x%x,PG_rrrz![*] Writing inode at 0x%x to '%s')rrrrLrrrrOrrr,rrr:r get_pagesr1r2to_paddrmappingr#indexr<get_flags_listjoinrqinforopen)rCrrrrrr,rpage_obj page_vaddr page_paddrpage_mapping_addr page_indexpage_file_offset dump_safepage_flags_listx page_flagsrrs r(rzInodePages._generatorsV"kk(3,,&&':; ++G,>,>? ;;w DKK$7 LLG H  ;;v ** $7+K(==DKK$77$NNE( [[ !NN7DKK,@4NPE LL@ A || LL: ; \\ ~~ LL0$++g2F G )H!,,J!**,J ( 0 0 X^^,J)M,C,CC (:5I&557O"QA199UB#7"QRJ! FV)O%*( ;;v {{6*H KK;UYY=M=Mx X  , ,UHdii W #RsCJ8EJ8J3 3BJ8cdtjfdtjfdtjfdtfdtfdtfg}t j |tj||jS)N PageVAddr PagePAddr MappingAddrIndexDumpSafeFlags) r rr#boolr%r rrOrrrs r(rzInodePages.runsw ,** + ,** + L,, - cN   cN  !! U55gt?PQ  r')rr r!r"rrrrr rrrkrrJrKr%rr FileHandlerInterfacerLrMrrrr&r'r(rr|s/"+H j&>&>&S&S!T  6*J!!11*J*J*,,AAB*J"((BB *J  *J*JX9Xv  r'r)!r8loggingr dataclassesrrtypingrrrrvolatility3.frameworkr r volatility3.framework.renderersr volatility3.framework.interfacesr #volatility3.framework.configurationr volatility3.pluginsrvolatility3.plugins.linuxr getLoggerrrrr*PluginInterfaceTimeLinerInterfacerOrr&r'r(rs  *,,784<)/   8 $  ( 88 8vS G # #Y%A%AS lW ((W r'