
    Xf~                         d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j.                  e      Z G d
 dej4                  j6                        Zy)    N)ListOptionalTupleIterator)
interfaces	renderers
exceptionssymbols)requirements)configuration)format_hints)intermed)
extensions)versionsc                       e Zd ZdZdZdZedeej                  j                     fd       Ze	 	 ddej                  j                  ded	ed
ee   def
d       Zdeeeeeef   f      fdZd Zy)BigPoolszList big page pools.)   r   r   )   r   r   returnc                     t        j                  ddddg      t        j                  dddd 	      t        j                  d
ddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturestagsz:Comma separated list of pool tags to filter pools returnedT)r   r   optionaldefault	show-freez;Show freed regions (otherwise only show allocations in use)F)r   r   r   r   )r   ModuleRequirementStringRequirementBooleanRequirement)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/bigpools.pyget_requirementszBigPools.get_requirements   sb     **,()4
 **X	 ++ Y	
 	
    Ncontext
layer_namesymbol_tabler   	show_freec           
   #   B  K   |j                   |   j                  d   }|j                  |||      }|j                  d      j                  }|j                  d|      }	|j                  d      j                  }
|j                  d|
      }	 |j                  d      }|j                  d|	||d      }|D ]?  }|j7                         s||j9                         |v s)|s|j;                         r<| A y# t        j                  $ r t        j                  ||      }t        j                  ||      }|rd	}n|rd
}nd}t        j                  ||      r|dz  }n|dz  }t        j                  j!                  |t#        j$                  |j&                  |   j(                  d      t*        j,                  j/                  dd      |d|idt0        j2                  j4                  i      }|j                  ||d      }|j                  d      }Y zw xY ww)a  Returns the big page pool objects from the kernel PoolBigPageTable array.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols
            tags: An optional list of pool tags to filter big page pool tags by

        Yields:
            A big page pool object
        kernel_virtual_offset)r)   offsetPoolBigPageTablezunsigned long long)object_typer.   PoolBigPageTableSizezunsigned long_POOL_TRACKER_BIG_PAGESzbigpools-win10zbigpools-vistabigpoolsz-x64z-x86windows
nt_symbols)r(   config_pathsub_pathfilenametable_mappingclass_typesr   )r.   arrayT)r0   r.   subtypecountabsoluteN)layersconfigmodule
get_symboladdressobjectget_typer	   SymbolErrorr   is_vista_or_lateris_win10r
   symbol_table_is_64bitr   IntermediateSymbolTablecreater   	path_joinsymbol_spacer6   ospathjoinr   poolPOOL_TRACKER_BIG_PAGESis_validget_keyis_free)r$   r(   r)   r*   r   r+   kvontkrnlmpbig_page_table_offsetbig_page_tablebig_page_table_size_offsetbig_page_table_sizebig_page_table_typerG   rH   big_pools_json_filenamenew_table_namerA   	big_poolsbig_pools                       r%   list_big_poolszBigPools.list_big_pools1   s5    ( nnZ(//0GH>>,:c>R ( 3 34F G O O!,5J ) 
 &.%8%89O%P%X%X"&oo'0J . 
	M"*"3"34M"N@ OO!'% $ 
	 " 	#H  "LH$4$4$6$$>X%5%5%7"N	#O %% 	M ( : :7L Q((,?H*:'"*:'*4',,WlC'61''61'%==DD)33((6BBJ i<0+\:-z/U/U E N ^^NJq^IF"(//2K"L;	Ms=   BHC< !+HH"H5H<DHHHHc           	   #     K   | j                   j                  d      r,| j                   d   j                  d      D cg c]  }| }}nd }| j                  j                  | j                   d      }| j                  | j                  |j                  |j                  || j                   j                  d            D ]  }|j                         }t        |t        j                  j                        st        j                  |      }|j                         rd}nd}dt        j                  |j                         |j#                         |j%                         ||ff  y c c}w w)	Nr   ,r   r    )r(   r)   r*   r   r+   Free	Allocatedr   )r@   getsplitr(   modulesra   r)   symbol_table_nameget_number_of_bytes
isinstancer   r   BaseAbsentValuer   HexrU   VarT   get_pool_type)selftagr   r   r`   	num_bytesstatuss          r%   
_generatorzBigPools._generator   s@    ;;??6"#';;v#6#<#<S#ABCCBDBD%%dkk(&;<++LL((11kkook2 , 
 	H !446Ii)=)=)M)MN(,,Y7	!$  $$X[[1$$&**,	 	!	 Cs   <E,	E'D%E,c                     t        j                  dt        j                  fdt        fdt        fdt        j                  fdt        fg| j                               S )N
AllocationTagPoolTypeNumberOfBytesStatus)r   TreeGridr   rm   strrt   )rp   s    r%   runzBigPools.run   sX    !!|//0S! ,"2"233 OO	
 		
r'   )NF)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r   RequirementInterfacer&   r(   ContextInterfacer|   r   listboolra   r   r   intrt   r}    r'   r%   r   r      s    "+H
j&>&>&S&S!T 
 
,   $N###44N# N# 	N#
 tnN# N# N#` HU3c3h+?%@A  D

r'   r   )loggingrN   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.renderersr   volatility3.framework.symbolsr   %volatility3.framework.symbols.windowsr   r   	getLoggerr~   vollogpluginsPluginInterfacer   r   r'   r%   <module>r      sW   
  	 2 2 L L < : 8 2 < :			8	$Z
z!!11 Z
r'   