
    $f(                         d Z ddlZddlmZmZmZmZ ddlmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ  ej*                  e      Z G d
 dej0                        Zy)zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)Callable	GeneratorTypeOptional)	renderers
interfaces
exceptions)requirements)plugins)utility)format_hints)pslistc                      e Zd ZdZdZdZdZed        Zed fde	j                  j                  dee	j                  j                  gef   d	ee	j                  j                  d
d
f   fd       Zeefde	j                   j"                  de	j                  j                  dededee	j(                  j*                     ded	ee	j(                  j*                     fd       Zd Zd Zy
)Mapsz(Lists all memory maps for all processes.   r   r   )   r   r   i   @c                 f   t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dd	t        d
      t        j                  dddd
      t        j
                  ddt        d
      t        j                  dd| j                  d
      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptionaldumpzExtract listed memory segmentsF)r   r   defaultr    addresszProcess virtual memory addresses to include (all other VMA sections are excluded). This can be any virtual address within the VMA section.maxsizezNMaximum size for dumped VMA sections (all the bigger sections will be ignored))
r
   ModuleRequirementPluginRequirementr   PsListListRequirementintBooleanRequirementIntRequirementMAXSIZE_DEFAULT)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/proc.pyget_requirementszMaps.get_requirements   s     ***?
 **fmmY ((< 	 ++<	 ((: ! ''<++;$
 $	
    c                      yNT _s    r.   <lambda>zMaps.<lambda>J       r0   taskfilter_funcreturnNc              #   :  K   |j                   rh|j                   j                         D ]J  } ||      r| t        j                  d|j                  j
                  dd|j                   d       L yt        j                  d|j                   d       yw)aJ  Lists the Virtual Memory Areas of a specific process.

        Args:
            task: task object from which to list the vma
            filter_func: Function to take a vma and return False if it should be filtered out

        Returns:
            Yields vmas based on the task and filtered based on the filter function
        zExcluded vma at offset #x	 for pid z due to filter_funczExcluded pid z8 as there is no mm member. It is likely a kernel thread.N)mmget_vma_itervollogdebugvoloffsetr   )r-   r8   r9   vmas       r.   	list_vmaszMaps.list_vmasD   s     " 77ww++- s#ILL1#''..1DIdhhZWjk	 LLz)abs   BBcontextvm_startvm_endopen_methodr$   c                    |j                   }	 |j                         }||z
  }
|
dk  r%t        j                  d| d|dd|dd|
 d		       y||
k  r't        j                  d| d|dd|dd|
 d
| 
       y|j                  |   }d| d|dd|dd}	  ||      }d}|}|||
z   k  rEt        |||
z   |z
        }|j                  ||d      }|j                  |       ||z  }|||
z   k  rE|S # t        j                  $ rD}	t        j                  dj                  ||	j                  |	j                               Y d}	~	yd}	~	ww xY w# t        $ r%}	t        j                  d| d|	        Y d}	~	yd}	~	ww xY w)at  Extracts the complete data for VMA as a FileInterface.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task: an task_struct instance
            vm_start: The start virtual address from the vma to dump
            vm_end: The end virtual address from the vma to dump
            open_method: class to provide context manager for opening the file
            maxsize: Max size of VMA section (default MAXSIZE_DEFAULT)

        Returns:
            An open FileInterface object containing the complete data for the task or None in the case of failure
        z*Process {}: invalid address {} in layer {}Nr   z!Skip virtual memory dump for pid z	 between r<   -z as z is negative.z! is larger than maxsize limit of zpid.z.vma.z.dmpi   T)padzUnable to dump virtual memory z: )r   add_process_layerr	   InvalidAddressExceptionr@   rA   formatinvalid_address
layer_namewarninglayersminreadwrite	Exception)r-   rF   r8   rG   rH   rI   r$   r   proc_layer_nameexcpvm_size
proc_layer	file_namefile_handle
chunk_sizerC   to_readdatas                     r.   vma_dumpzMaps.vma_dumpb   s   . hh	"446O 8# Q;NN3C5	(2aPVWY{Z^_f^ggtu gNN3C5	(2aPVWY{Z^_f^g  hI  JQ  IR  S ^^O4
3%uXbM6"+TB		%i0K)JF8g--j(W*<v*EF!vwDA!!$''!	 8g-- G 11 	LL<CC--t
 	@  	LL9)BtfMN	s0   C2 AE 2E	:EE		E:E55E:c              #     K   | j                   j                  dd       sd }n(dt        j                  j                  dt
        ffd}|}|D ]  }|j                  st        j                  |j                        }| j                  ||      D ]  }|j                         }|j                         }d}	d}
d}|j                  dk7  rc|j                  j                         }|dk7  rD|j                  }|j                   j"                  }	|j                   j$                  }
|j&                  }|j)                  | j*                  |      }d}| j                   d	   rtd
}	 |j,                  }|j.                  }|rW|rU| j=                  | j*                  |||| j>                  | j                   d         }|r|jA                          |jB                  }d|j:                  |tE        jF                  |j,                        tE        jF                  |j.                        |tE        jF                  |      |	|
|||ff   y # t0        $ rB t2        j5                  d|j6                  j8                  dd|j:                          d }d }Y w xY ww)Nr#   c                      yr2   r3   r4   s    r.   r6   z!Maps._generator.<locals>.<lambda>   r7   r0   xr:   c                 z    D cg c]'  }| j                   |cxk  r| j                  k  s#n n|) }}|ryyc c}w )NTF)rG   rH   )rd   addraddrs_in_vmaaddress_lists      r.   vma_filter_functionz,Maps._generator.<locals>.vma_filter_function   sA    %1 !QZZ45S1885SD   
    s   $88r9   r   Disabledr!   zError outputting filez2Unable to find the vm_start and vm_end for vma at r<   r=   r$   )$configgetr   objectsObjectInterfaceboolr>   r   array_to_stringcommrE   get_protectionget_page_offsetvm_file
get_dentryd_inodei_sbmajorminori_inoget_namerF   rG   rH   AttributeErrorr@   rA   rB   rC   r   ra   openclosepreferred_filenamer   Hex)selftasksvma_filter_funcri   r8   r   rD   flagspage_offsetry   rz   inodedentryinode_objectpathfile_outputrG   rH   r]   rh   s                      @r.   
_generatorzMaps._generator   s`    {{y$7,O	!z'9'9'I'I 	!d 	! 2O >	D77**4995D~~d~H 9**,!113;;!# [[335F{'-~~ , 1 1 7 7 , 1 1 7 7 , 2 2||DLL$7(;;v&"9K&#&<<!$  F&*mm LL $" II KK	2' ''--/*5*H*HK$((6$((4$((5# U9>	6 * &PQTQXQXQ_Q_`bPcclmqmumulvw $(!%&s,   EJH?7CJ?AJ
J	J

Jc                    t         j                  j                  | j                  j	                  dd             }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        fdt        j                  fdt        fd	t        fd
t        fdt        fdt        fg| j                  t         j                  j                  | j                  | j                  d   |                  S )Nr   PIDProcessStartEndFlagsPgOffMajorMinorInodez	File PathzFile outputr   rj   )r   r'   create_pid_filterrl   rm   r   TreeGridr)   strr   r   r   
list_tasksrF   )r   r9   s     r.   runzMaps.run   s    mm55dkkooeT6RS!!C ,**+(()#,**+###c"$ OO((LL$++h"7[ ) 
 	
r0   )__name__
__module____qualname____doc___required_framework_version_versionr,   classmethodr/   r   rn   ro   r   rp   r   rE   rF   ContextInterfacer)   r   r   FileHandlerInterfacer   ra   r   r   r3   r0   r.   r   r      sA   2"+H(O&
 &
P    00 //0$6
 
:%%55tTA	B :  '=##44=   00= 	=
 = *,,AAB= = 
*$$99	:= =~Rh
r0   r   )r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.linuxr   	getLoggerr   r@   PluginInterfacer   r3   r0   r.   <module>r      sP   '  6 6 C C < 4 1 8 ,			8	$x
7"" x
r0   