
    *1f#$                         d dl mZmZmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZmZmZ d dlZ ej$                  e      Z G d d	ej*                  j,                        Zy)
    )	renderers
interfaces
exceptions)requirements)utility)format_hints)pslist)Callable	GeneratorTypeOptionalNc                      e Zd ZdZdZdZdZed        Zed fde	j                  j                  dee	j                  j                  gef   d	ee	j                  j                  d
d
f   fd       Zeefde	j                   j"                  de	j                  j                  dededee	j(                  j*                     ded	ee	j(                  j*                     fd       Zd Zd Zy
)MapszCLists process memory ranges that potentially contain injected code.)   r   r   )   r   r   i   @c                 f   t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      t        j                  dddd      t        j
                  ddt        d      t        j                  dd| j                  d      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr	   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptionaldumpzExtract listed memory segmentsF)r   r   defaultr   addresszProcess virtual memory addresses to include (all other VMA sections are excluded). This can be any virtual address within the VMA section. Virtual addresses must be separated by a space.maxsizezNMaximum size for dumped VMA sections (all the bigger sections will be ignored))
r   ModuleRequirementPluginRequirementr	   PsListListRequirementintBooleanRequirementIntRequirementMAXSIZE_DEFAULT)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/proc_maps.pyget_requirementszMaps.get_requirements   s     **6()4
 **fmmY ((< 	 ++<	 ((0 ! ''<++=%
 %	
    c                      yNT _s    r,   <lambda>zMaps.<lambda>F       r.   taskfilter_funcreturnNc              #      K   |j                         D ]J  } ||      r| t        j                  d|j                  j                  dd|j
                   d       L yw)aJ  Lists the Virtual Memory Areas of a specific process.

        Args:
            task: task object from which to list the vma
            filter_func: Function to take a vma and return False if it should be filtered out

        Returns:
            Yields vmas based on the task and filtered based on the filter function
        zExcluded vma at offset #x	 for pid z due to filter_funcN)get_map_itervollogdebugvoloffsetp_pid)r+   r6   r7   vmas       r,   	list_vmaszMaps.list_vmas@   s[     " $$& 	C3	-cggnnR-@	$**Uhi		s   AA!contextvm_startvm_endopen_methodr"   c                    |j                   }	 |j                         }||z
  }
|
dk  r%t        j                  d| d|dd|dd|
 d		       y||
k  r't        j                  d| d|dd|dd|
 d
| 
       y|j                  |   }d| d|dd|dd}	  ||      }d}|}|||
z   k  rEt        |||
z   |z
        }|j                  ||d      }|j                  |       ||z  }|||
z   k  rE|S # t        j                  $ rD}	t        j                  dj                  ||	j                  |	j                               Y d}	~	yd}	~	ww xY w# t        $ r%}	t        j                  d| d|	        Y d}	~	yd}	~	ww xY w)at  Extracts the complete data for VMA as a FileInterface.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task: an task_struct instance
            vm_start: The start virtual address from the vma to dump
            vm_end: The end virtual address from the vma to dump
            open_method: class to provide context manager for opening the file
            maxsize: Max size of VMA section (default MAXSIZE_DEFAULT)

        Returns:
            An open FileInterface object containing the complete data for the task or None in the case of failure
        z*Process {}: invalid address {} in layer {}Nr   z!Skip virtual memory dump for pid z	 between r:   -z as z is negative.z! is larger than maxsize limit of zpid.z.vma.z.dmpi   T)padzUnable to dump virtual memory z: )rA   add_process_layerr   InvalidAddressExceptionr=   r>   formatinvalid_address
layer_namewarninglayersminreadwrite	Exception)r+   rD   r6   rE   rF   rG   r"   r   proc_layer_nameexcpvm_size
proc_layer	file_namefile_handle
chunk_sizer@   to_readdatas                     r,   vma_dumpzMaps.vma_dumpY   s   . jj	"446O 8# Q;NN3C5	(2aPVWY{Z^_f^ggtu gNN3C5	(2aPVWY{Z^_f^g  hI  JQ  IR  S ^^O4
3%uXbM6"+TB		%i0K)JF8g--j(W*<v*EF!vwDA!!$''!	 8g-- G 11 	LL<CC--t
 	@  	LL9)BtfMN	s0   C2 AE 2E	:EE		E:E55E:c              #   (  K   | j                   j                  dd       sd }n(dt        j                  j                  dt
        ffd}|}|D ]}  }t        j                  |j                        }|j                  }| j                  ||      D ]8  }	 |j                  j                  }|j                  j                  }	|j'                  | j(                  | j(                  j*                  | j                   d
      j,                        }
|
dk(  r|j/                         }
d}| j                   d   rWd}| j1                  | j(                  |||	| j2                  | j                   d         }|r|j5                          |j6                  }d||t9        j:                  |      t9        j:                  |	      |j=                         |
|ff ;  y # t        $ r4 t        j!                  d|j"                  j$                  dd	|        Y |w xY ww)Nr!   c                      yr0   r1   r2   s    r,   r4   z!Maps._generator.<locals>.<lambda>   r5   r.   r6   r8   c                     D cg c]:  }| j                   j                  |cxk  r| j                   j                  k  rn n|< }}t        |      S c c}w )N)linksstartendbool)r6   addraddrs_in_vmaaddress_lists      r,   vma_filter_functionz,Maps._generator.<locals>.vma_filter_function   sS     !- zz''4A4::>>A     L)) s   ?Ar7   z2Unable to find the vm_start and vm_end for vma at r:   r;   r    Disabledr   zError outputting filer"   r   )configgetr   objectsObjectInterfacerf   r   array_to_stringp_commrA   rC   rc   rd   re   AttributeErrorr=   r>   r?   r@   get_pathrD   modulessymbol_table_nameget_special_pathr_   openclosepreferred_filenamer   Hex	get_perms)selftasksvma_filter_funcrj   r6   process_nameprocess_pidrB   rE   rF   pathfile_outputr[   ri   s                @r,   
_generatorzMaps._generator   s    {{y$7,O***<*<*L*L *QU * 2O 0	D"224;;?L**K~~d~H ,"yyH YY]]F ||LLLL((X)>?QQ 2://1D(;;v&"9K"&-- 		I.#K ##))+&1&D&D #$$((2$((0# C,	0	 & LLLSWW^^\^L__hithuv 	s+   BH,GDH9HHHHc           
      0   t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  j	                  dt         j                  j                  d               }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        fd	t        fd
t        fg| j                   || j                  | j                  d   |                  S )Nr   pslist_methodr   PIDProcessStartEnd
ProtectionzMap NamezFile outputr   rk   )r	   r%   create_pid_filterrn   ro   get_list_taskspslist_methodsr   TreeGridr'   strr   r|   r   rD   )r~   r7   
list_taskss      r,   runzMaps.run   s    mm55dkkooeT6RS]]11KKOOOV]]-I-I!-LM

 !!C ,**+(()s#S!$ OO4<<X)>KX
 	
r.   )__name__
__module____qualname____doc___required_framework_version_versionr*   classmethodr-   r   rp   rq   r
   rf   r   rC   rD   ContextInterfacer'   r   pluginsFileHandlerInterfacer   r_   r   r   r1   r.   r,   r   r      sA   M"+H(O&
 &
P    00 //0$6
 
:%%55tTA	B 0  '=##44=   00= 	=
 = *,,AAB= = 
*$$99	:= =~CJ
r.   r   )volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.macr	   typingr
   r   r   r   logging	getLoggerr   r=   r   PluginInterfacer   r1   r.   r,   <module>r      sO   
 D C < 1 8 * 6 6 			8	$a
:-- a
r.   