
    Xf~                         d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 dej        j                  ZdS )    N)ListOptionalTupleIterator)
interfaces	renderers
exceptionssymbols)requirements)configuration)format_hints)intermed)
extensions)versionsc                       e Zd ZdZdZdZedeej	        j
                 fd            Ze	 	 ddej        j        d	ed
edee         def
d            Zdeeeeeef         f                  fdZd ZdS )BigPoolszList big page pools.)   r   r   )   r   r   returnc                     t          j        ddddg          t          j        dddd 	          t          j        d
ddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturestagsz:Comma separated list of pool tags to filter pools returnedT)r   r   optionaldefault	show-freez;Show freed regions (otherwise only show allocations in use)F)r   r   r   r   )r   ModuleRequirementStringRequirementBooleanRequirement)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/bigpools.pyget_requirementszBigPools.get_requirements   sw     *,()4  
 *X	   + Y	  
 	
    NFcontext
layer_namesymbol_tabler   	show_freec           
   #   J  K   |j         |         j        d         }|                    |||          }|                    d          j        }|                    d|          }	|                    d          j        }
|                    d|
          }	 |                    d          }n# t          j        $ r t          j
        ||          }t          j        ||          }|rd	}n|rd
}nd}t          j        ||          r|dz  }n|dz  }t          j                            |t#          j        |j        |         j        d          t*          j                            dd          |d|idt0          j        j        i          }|                    ||d          }|                    d          }Y nw xY w|                    d|	||d          }|D ]H}|                                r2||                                |v r|s|                                s|V  IdS )a  Returns the big page pool objects from the kernel PoolBigPageTable array.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols
            tags: An optional list of pool tags to filter big page pool tags by

        Yields:
            A big page pool object
        kernel_virtual_offset)r)   offsetPoolBigPageTablezunsigned long long)object_typer.   PoolBigPageTableSizezunsigned long_POOL_TRACKER_BIG_PAGESzbigpools-win10zbigpools-vistabigpoolsz-x64z-x86windows
nt_symbols)r(   config_pathsub_pathfilenametable_mappingclass_typesr   )r.   arrayT)r0   r.   subtypecountabsoluteN)layersconfigmodule
get_symboladdressobjectget_typer	   SymbolErrorr   is_vista_or_lateris_win10r
   symbol_table_is_64bitr   IntermediateSymbolTablecreater   	path_joinsymbol_spacer6   ospathjoinr   poolPOOL_TRACKER_BIG_PAGESis_validget_keyis_free)r$   r(   r)   r*   r   r+   kvontkrnlmpbig_page_table_offsetbig_page_tablebig_page_table_size_offsetbig_page_table_sizebig_page_table_typerG   rH   big_pools_json_filenamenew_table_namerA   	big_poolsbig_pools                       r%   list_big_poolszBigPools.list_big_pools1   s     ( nZ(/0GH>>,:c>RR ( 3 34F G G O!,5J ) 
 
 &.%8%89O%P%P%X"&oo'0J . 
 
	M"*"3"34M"N"N% 	M 	M 	M ( :7L Q Q(,??H 5*:''" 5*:''*4',WlCC 2'61'''61'%=DD)3(6BJ  i<<0+\:-z/U E  N ^^NJq^IIF"(//2K"L"L;	M> OO!'% $ 
 
	 " 	# 	#H  "" #LH$4$4$6$6$$>$> %?%-%5%5%7%7 %? #NNN	# 	#s   B- -DF;:F;c           	   #     K   | j                             d          r+d | j         d                             d          D             }nd }| j        j        | j         d                  }|                     | j        |j        |j        || j                             d                    D ]}|                                }t          |t          j        j                  st          j        |          }|                                rd}nd}d	t          j        |j                  |                                |                                ||ffV  d S )
Nr   c                     g | ]}|S  rd   ).0tags     r%   
<listcomp>z'BigPools._generator.<locals>.<listcomp>   s    BBBCCBBBr'   ,r   r    )r(   r)   r*   r   r+   Free	Allocatedr   )r@   getsplitr(   modulesra   r)   symbol_table_nameget_number_of_bytes
isinstancer   r   BaseAbsentValuer   HexrU   VarT   get_pool_type)selfr   r   r`   	num_bytesstatuss         r%   
_generatorzBigPools._generator   sf     ;??6"" 	BB4;v#6#<#<S#A#ABBBDDD%dk(&;<++L(1kook22 , 
 
 	 	H !4466Ii)=)MNN 8(,Y77	!! %$  $X[11$$&&**,,	 	 	 	 	!	 	r'   c                     t          j        dt          j        fdt          fdt          fdt          j        fdt          fg|                                           S )N
AllocationTagPoolTypeNumberOfBytesStatus)r   TreeGridr   rr   strrx   )ru   s    r%   runzBigPools.run   sW    !|/0S! ,"233 OO	
 	
 		
r'   )NF)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   RequirementInterfacer&   r(   ContextInterfacer   r   listboolra   r   r   intrx   r   rd   r'   r%   r   r      s	       "+H
j&>&S!T 
 
 
 [
,   $N# N##4N# N# 	N#
 tnN# N# N# N# [N#` HU3c3h+?%@A        D

 

 

 

 

r'   r   )loggingrN   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.framework.symbolsr   %volatility3.framework.symbols.windowsr   r   	getLoggerr   vollogpluginsPluginInterfacer   rd   r'   r%   <module>r      s#  
  				 2 2 2 2 2 2 2 2 2 2 2 2 L L L L L L L L L L L L < < < < < < : : : : : : 8 8 8 8 8 8 2 2 2 2 2 2 < < < < < < : : : : : :		8	$	$Z
 Z
 Z
 Z
 Z
z!1 Z
 Z
 Z
 Z
 Z
r'   