
    $f(                         d Z ddlZddlmZmZmZmZ ddlmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ  ej        e          Z G d
 dej                  ZdS )zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)Callable	GeneratorTypeOptional)	renderers
interfaces
exceptions)requirements)plugins)utility)format_hints)pslistc                   j   e Zd ZdZdZdZdZed             Zed fde	j
        j        dee	j
        j        gef         d	ee	j
        j        d
d
f         fd            Zeefde	j        j        de	j
        j        dededee	j        j                 ded	ee	j        j                 fd            Zd Zd Zd
S )Mapsz(Lists all memory maps for all processes.   r   r   )   r   r   i   @c                 L   t          j        ddg d          t          j        dt          j        d          t          j        dd	t          d
          t          j        dddd
          t          j        ddt          d
          t          j        dd| j	        d
          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptionaldumpzExtract listed memory segmentsF)r   r   defaultr    addresszProcess virtual memory addresses to include (all other VMA sections are excluded). This can be any virtual address within the VMA section.maxsizezNMaximum size for dumped VMA sections (all the bigger sections will be ignored))
r
   ModuleRequirementPluginRequirementr   PsListListRequirementintBooleanRequirementIntRequirementMAXSIZE_DEFAULT)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/proc.pyget_requirementszMaps.get_requirements   s     **???  
 *fmY   (< 	   +<	   (: !   '<+  ;$
 $	
    c                     dS NT _s    r.   <lambda>zMaps.<lambda>J   s    d r0   taskfilter_funcreturnNc              #     K   |j         r_|j                                         D ]C} ||          r|V  t                              d|j        j        dd|j         d           DdS t                              d|j         d           dS )aJ  Lists the Virtual Memory Areas of a specific process.

        Args:
            task: task object from which to list the vma
            filter_func: Function to take a vma and return False if it should be filtered out

        Returns:
            Yields vmas based on the task and filtered based on the filter function
        zExcluded vma at offset #x	 for pid z due to filter_funczExcluded pid z8 as there is no mm member. It is likely a kernel thread.N)mmget_vma_itervollogdebugvoloffsetr   )r-   r7   r8   vmas       r.   	list_vmaszMaps.list_vmasD   s      " 7 	w++--  ;s## IIIILLk#'.kkkdhkkk   	  LLbbbb    r0   contextvm_startvm_endopen_methodr$   c                 :   |j         }	 |                                }nV# t          j        $ rD}	t                              d                    ||	j        |	j                             Y d}	~	dS d}	~	ww xY w||z
  }
|
dk     r+t          	                    d| d|dd|dd|
 d		           dS ||
k    r-t          	                    d| d|dd|dd|
 d
| 
           dS |j
        |         }d| d|dd|dd}	  ||          }d}|}|||
z   k     rQt          |||
z   |z
            }|                    ||d          }|                    |           ||z  }|||
z   k     Qn8# t          $ r+}	t                              d| d|	            Y d}	~	dS d}	~	ww xY w|S )at  Extracts the complete data for VMA as a FileInterface.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task: an task_struct instance
            vm_start: The start virtual address from the vma to dump
            vm_end: The end virtual address from the vma to dump
            open_method: class to provide context manager for opening the file
            maxsize: Max size of VMA section (default MAXSIZE_DEFAULT)

        Returns:
            An open FileInterface object containing the complete data for the task or None in the case of failure
        z*Process {}: invalid address {} in layer {}Nr   z!Skip virtual memory dump for pid z	 between r;   -z as z is negative.z! is larger than maxsize limit of zpid.z.vma.z.dmpi   T)padzUnable to dump virtual memory z: )r   add_process_layerr	   InvalidAddressExceptionr?   r@   formatinvalid_address
layer_namewarninglayersminreadwrite	Exception)r-   rE   r7   rF   rG   rH   r$   r   proc_layer_nameexcpvm_size
proc_layer	file_namefile_handle
chunk_sizerB   to_readdatas                     r.   vma_dumpzMaps.vma_dumpb   s   . h	"4466OO1 	 	 	LL<CC-t   
 44444	 8# Q;;NNuCuu(uuuPVuuu_fuuu   4gNN SC  S  S(  S  S  SPV  S  S  S_f  S  S  JQ  S  S   4^O4
B3BBXBBB6BBBB		%+i00K)JF8g---j(W*<v*EFF!vwDAA!!$''''!	 8g---
  	 	 	LLM)MMtMMNNN44444	 s-    A19A,,A19A)E# #
F- FFc              #   ^  K   | j                             dd           sd }n dt          j        j        dt
          ffd}|}|D ]}|j        st          j        |j	                  }| 
                    ||          D ]}|                                }|                                }d}	d}
d}|j        dk    rE|j                                        }|dk    r&|j        }|j        j        }	|j        j        }
|j        }|                    | j        |          }d}| j         d	         rd
}	 |j        }|j        }nD# t0          $ r7 t2                              d|j        j        dd|j                    d }d }Y nw xY w|rN|rL|                     | j        |||| j        | j         d                   }|r|                                  |j!        }d|j        |tE          j#        |j                  tE          j#        |j                  |tE          j#        |          |	|
|||ffV  d S )Nr#   c                     dS r2   r3   r4   s    r.   r6   z!Maps._generator.<locals>.<lambda>   s     r0   xr9   c                 .      fdD             }|rdS dS )Nc                 H    g | ]}j         |cxk    rj        k    n n|S r3   )rF   rG   ).0addrrc   s     r.   
<listcomp>z@Maps._generator.<locals>.vma_filter_function.<locals>.<listcomp>   sE          !QZ45S5S5S5S185S5S5S5S5SD5S5S5Sr0   TFr3   )rc   addrs_in_vmaaddress_lists   ` r.   vma_filter_functionz,Maps._generator.<locals>.vma_filter_function   s@           %1     
   !4 5r0   r8   r   Disabledr!   zError outputting filez2Unable to find the vm_start and vm_end for vma at r;   r<   r$   )$configgetr   objectsObjectInterfaceboolr=   r   array_to_stringcommrD   get_protectionget_page_offsetvm_file
get_dentryd_inodei_sbmajorminori_inoget_namerE   rF   rG   AttributeErrorr?   r@   rA   rB   r   r`   openclosepreferred_filenamer   Hex)selftasksvma_filter_funcrk   r7   r   rC   flagspage_offsetr{   r|   inodedentryinode_objectpathfile_outputrF   rG   r\   rj   s                      @r.   
_generatorzMaps._generator   s     {y$77 	2,nOO	!z'9'I 	!d 	! 	! 	! 	! 	! 	! 2O >	 >	D7 *4955D~~d~HH 9 9**,,!1133;!## [3355F{{'-~ , 1 7 , 1 7 , 2||DL$77(;v& I"9K&#&<!$) & & &wQTQXQ_wwwmqmuww   $(!%&   IF I&*mm L $" I K	2' ' ' I'--///*5*HK$(66$(44$(55#    U9>	 >	s   0D??>F ?F c                    t           j                            | j                            dd                     }t          j        dt          fdt          fdt          j
        fdt          j
        fdt          fdt          j
        fdt          fd	t          fd
t          fdt          fdt          fg|                     t           j                            | j        | j        d         |                              S )Nr   PIDProcessStartEndFlagsPgOffMajorMinorInodez	File PathzFile outputr   rl   )r   r'   create_pid_filterrn   ro   r   TreeGridr)   strr   r   r   
list_tasksrE   )r   r8   s     r.   runzMaps.run   s    m55dkooeT6R6RSS!C ,*+()#,*+###c"$ OO((L$+h"7[ )   
 
 	
r0   )__name__
__module____qualname____doc___required_framework_version_versionr,   classmethodr/   r   rp   rq   r   rr   r   rD   rE   ContextInterfacer)   r   r   FileHandlerInterfacer   r`   r   r   r3   r0   r.   r   r      sm       22"+H(O&
 &
 [&
P  N  0 /0$6
 
:%5tTA	B   [:  '= =#4=  0= 	=
 = *,AB= = 
*$9	:= = = [=~R R Rh
 
 
 
 
r0   r   )r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.linuxr   	getLoggerr   r?   PluginInterfacer   r3   r0   r.   <module>r      s	  ' '  6 6 6 6 6 6 6 6 6 6 6 6 C C C C C C C C C C < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 , , , , , ,		8	$	$x
 x
 x
 x
 x
7" x
 x
 x
 x
 x
r0   