
    *1f#$                         d dl mZmZmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZmZmZ d dlZ ej        e          Z G d d	ej        j                  ZdS )
    )	renderers
interfaces
exceptions)requirements)utility)format_hints)pslist)Callable	GeneratorTypeOptionalNc                   j   e Zd ZdZdZdZdZed             Zed fde	j
        j        dee	j
        j        gef         d	ee	j
        j        d
d
f         fd            Zeefde	j        j        de	j
        j        dededee	j        j                 ded	ee	j        j                 fd            Zd Zd Zd
S )MapszCLists process memory ranges that potentially contain injected code.)   r   r   )   r   r   i   @c                 L   t          j        ddddg          t          j        dt          j        d          t          j        d	d
t          d          t          j        dddd          t          j        ddt          d          t          j        dd| j	        d          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr	   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptionaldumpzExtract listed memory segmentsF)r   r   defaultr   addresszProcess virtual memory addresses to include (all other VMA sections are excluded). This can be any virtual address within the VMA section. Virtual addresses must be separated by a space.maxsizezNMaximum size for dumped VMA sections (all the bigger sections will be ignored))
r   ModuleRequirementPluginRequirementr	   PsListListRequirementintBooleanRequirementIntRequirementMAXSIZE_DEFAULT)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/proc_maps.pyget_requirementszMaps.get_requirements   s     *6()4  
 *fmY   (< 	   +<	   (0 !   '<+  =%
 %	
    c                     dS NT _s    r,   <lambda>zMaps.<lambda>F   s    d r.   taskfilter_funcreturnNc              #      K   |                                 D ]C} ||          r|V  t                              d|j        j        dd|j         d           DdS )aJ  Lists the Virtual Memory Areas of a specific process.

        Args:
            task: task object from which to list the vma
            filter_func: Function to take a vma and return False if it should be filtered out

        Returns:
            Yields vmas based on the task and filtered based on the filter function
        zExcluded vma at offset #x	 for pid z due to filter_funcN)get_map_itervollogdebugvoloffsetp_pid)r+   r5   r6   vmas       r,   	list_vmaszMaps.list_vmas@   s      " $$&& 	 	C{3 				icgniii$*iii   		 	r.   contextvm_startvm_endopen_methodr"   c                 :   |j         }	 |                                }nV# t          j        $ rD}	t                              d                    ||	j        |	j                             Y d}	~	dS d}	~	ww xY w||z
  }
|
dk     r+t          	                    d| d|dd|dd|
 d		           dS ||
k    r-t          	                    d| d|dd|dd|
 d
| 
           dS |j
        |         }d| d|dd|dd}	  ||          }d}|}|||
z   k     rQt          |||
z   |z
            }|                    ||d          }|                    |           ||z  }|||
z   k     Qn8# t          $ r+}	t                              d| d|	            Y d}	~	dS d}	~	ww xY w|S )at  Extracts the complete data for VMA as a FileInterface.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task: an task_struct instance
            vm_start: The start virtual address from the vma to dump
            vm_end: The end virtual address from the vma to dump
            open_method: class to provide context manager for opening the file
            maxsize: Max size of VMA section (default MAXSIZE_DEFAULT)

        Returns:
            An open FileInterface object containing the complete data for the task or None in the case of failure
        z*Process {}: invalid address {} in layer {}Nr   z!Skip virtual memory dump for pid z	 between r9   -z as z is negative.z! is larger than maxsize limit of zpid.z.vma.z.dmpi   T)padzUnable to dump virtual memory z: )r@   add_process_layerr   InvalidAddressExceptionr<   r=   formatinvalid_address
layer_namewarninglayersminreadwrite	Exception)r+   rC   r5   rD   rE   rF   r"   r   proc_layer_nameexcpvm_size
proc_layer	file_namefile_handle
chunk_sizer?   to_readdatas                     r,   vma_dumpzMaps.vma_dumpY   s   . j	"4466OO1 	 	 	LL<CC-t   
 44444	 8# Q;;NNuCuu(uuuPVuuu_fuuu   4gNN SC  S  S(  S  S  SPV  S  S  S_f  S  S  JQ  S  S   4^O4
B3BBXBBB6BBBB		%+i00K)JF8g---j(W*<v*EFF!vwDAA!!$''''!	 8g---
  	 	 	LLM)MMtMMNNN44444	 s-    A19A,,A19A)E# #
F- FFc              #     K   | j                             dd           sd }n dt          j        j        dt
          ffd}|}|D ]}t          j        |j                  }|j	        }| 
                    ||          D ]M}	 |j        j        }|j        j        }	n;# t          $ r. t                              d|j        j        dd	|            Y Tw xY w|                    | j        | j        j        | j         d
                  j                  }
|
dk    r|                                }
d}| j         d         rNd}|                     | j        |||	| j        | j         d                   }|r|                                 |j        }d||t9          j        |          t9          j        |	          |                                |
|ffV  Od S )Nr!   c                     dS r0   r1   r2   s    r,   r4   z!Maps._generator.<locals>.<lambda>   s     r.   r5   r7   c                 @      fdD             }t          |          S )Nc                 \    g | ](}j         j        |cxk    rj         j        k    #n n|)S r1   )linksstartend).0addrr5   s     r,   
<listcomp>z@Maps._generator.<locals>.vma_filter_function.<locals>.<listcomp>   sN          z'4AAAA4:>AAAAA AAAr.   )bool)r5   addrs_in_vmaaddress_lists   ` r,   vma_filter_functionz,Maps._generator.<locals>.vma_filter_function   s<            ,      L)))r.   r6   z2Unable to find the vm_start and vm_end for vma at r9   r:   r    Disabledr   zError outputting filer"   r   )configgetr   objectsObjectInterfaceri   r   array_to_stringp_commr@   rB   rc   rd   re   AttributeErrorr<   r=   r>   r?   get_pathrC   modulessymbol_table_nameget_special_pathr^   openclosepreferred_filenamer   Hex	get_perms)selftasksvma_filter_funcrl   r5   process_nameprocess_pidrA   rD   rE   pathfile_outputrZ   rk   s                @r,   
_generatorzMaps._generator   s<     {y$77 	2,nOO***<*L *QU * * * * * * 2O 0	 0	D"24;??L*K~~d~HH , ,"yH Y]FF%   LLvSW^vvvitvv   H	 ||LL(X)>?Q  2:://11D(;v& E"9K"&-- 	I.# #K # E#))+++&1&D #$$(22$(00#    C,	0	 0	s   B5CCc           
         t           j                            | j                            dd                     }t           j                            | j                            dt           j        j        d                             }t          j        dt          fdt          fdt          j        fdt          j        fdt          fd	t          fd
t          fg|                      || j        | j        d         |                              S )Nr   pslist_methodr   PIDProcessStartEnd
ProtectionzMap NamezFile outputr   rm   )r	   r%   create_pid_filterrp   rq   get_list_taskspslist_methodsr   TreeGridr'   strr   r~   r   rC   )r   r6   
list_taskss      r,   runzMaps.run   s    m55dkooeT6R6RSS]11KOOOV]-I!-LMM
 

 !C ,*+()s#S!$ OO
4<X)>KXXX 
 
 	
r.   )__name__
__module____qualname____doc___required_framework_version_versionr*   classmethodr-   r   rr   rs   r
   ri   r   rB   rC   ContextInterfacer'   r   pluginsFileHandlerInterfacer   r^   r   r   r1   r.   r,   r   r      sm       MM"+H(O&
 &
 [&
P  N  0 /0$6
 
:%5tTA	B   [0  '= =#4=  0= 	=
 = *,AB= = 
*$9	:= = = [=~C C CJ
 
 
 
 
r.   r   )volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.macr	   typingr
   r   r   r   logging	getLoggerr   r<   r   PluginInterfacer   r1   r.   r,   <module>r      s   
 D C C C C C C C C C < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 * * * * * * 6 6 6 6 6 6 6 6 6 6 6 6 		8	$	$a
 a
 a
 a
 a
:- a
 a
 a
 a
 a
r.   