X f[BddlZddlZddlmZmZmZmZmZddlm Z m Z m Z m Z m Z ddlmZddlmZddlmZddlmZddlmZejeZGd d e jjZdS) N)ListIterableTupleOptionalUnion) constants exceptions renderers interfacessymbols) requirements) format_hints)intermed)versions)ssdtceZdZdZdZdZedeej j fdZ e dej jdededefd Zedej jd eded edeeeeeeff d Zedej jd eded edeeeed ff dZedej jd eded edeeeeeeff dZedej jd eded edeeeeeeff dZedej jd eded edeeeeeff dZedej jd eded edeeeeeff dZdZdZd S) Callbacksz1Lists kernel callbacks and notification routines.)rrrrreturncvtjddddgtjdtjdgS) NkernelzWindows kernelIntel32Intel64)name description architecturesrr)rpluginversion)r ModuleRequirementPluginRequirementrSSDT)clss a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/callbacks.pyget_requirementszCallbacks.get_requirementssQ  *,()4     *DIy     context symbol_table config_pathc|j|j}tj||}d|i}|rd}nd}tj||d|||S)aCreates a symbol table for a set of callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the kernel symbols config_path: The configuration path within the context of the symbol table to create Returns: The name of the constructed callback table nt_symbolsz callbacks-x64z callbacks-x86windows) native_types table_mapping) symbol_spacenativesr symbol_table_is_64bitrIntermediateSymbolTablecreate)r(r)r*r.is_64bitr/symbol_filenames r%create_callback_tablezCallbacks.create_callback_table&sv +L9A 0,GG%|4  .-OO-O/66    %' 7   r' layer_namecallback_table_namec#K|j|jd}||||}tj||}|t jzdz}gd} | D]\} } || j} n2#tj $r t d| YOwxYw|r| rd} nd} | d | |d | }|D]W} ||}n#tj$rY>,:c>RR$6,   -y~=@SS   +7 ? ? &K  ( 3 3K @ @ H )    9K99::: ! ]  #$ )).99 (I& ? ?'3355::>JJHH!9H$))%x'8$>>>> ?' ? ?s$'B,B10B1.'DD('D(Nc#@K|j|jd}||||}|tjzdz}|dj}|dj} |d| } | dkrd S|d ||d | } | D]W} | |} n#tj $rY>,:c>RR ). 03O O !++,?@@H &112DEEM!&/B)   Q  4OO %%n55 $  " D DH #//1166~FF5     A%%*H,=tCCCC D Ds 'C11DDc#:K|j|jd}||||}|tjzdz}|dj}|dj} |d| } | dkrd S|d |} | |d D]U} d } tj tj 5| j j} d d d n #1swxYwYd | jd | fVVd S)zH Lists all registry callbacks via the CallbackListHead. r;r<_CM_CALLBACK_ENTRYCallbackListHeadrhrirjrN _LIST_ENTRYLinkCmRegisterCallbackExz Altitude: )rJrKrLrrNrOrPrTto_list contextlibsuppressr rXAltitudeStringrl)r$r(r8r)r9rZr[r\r`rmrn callback_listrcaltitudes r%_list_registry_callbacks_newz&Callbacks._list_registry_callbacks_newsnZ(/0GH>>,:c>RR,y~=@TT ++,>??G &112DEEM!&/B)   Q  4 M-XX %--nfEE U UHH$Z%GHH 4 4#,3 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4((*;=T(=T=TT T T T T  U Us' DD D c#LK|j|jd}||||}|dr5|dr |||||Ed{VdS|dr5|dr |||||Ed{VdSgd}t d|D]<}d } ||rd } t d |d | d =dS)aLists all registry callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string r;r<rgrhNrr)rgrhrrz!Failed to get registry callbacks!zdoes not existexistszsymbol  .)rJrKrL has_symbolror}rRrS) r$r(r8r)r9rZr[symbols_to_checkr^ symbol_statuss r%list_registry_callbacksz!Callbacks.list_registry_callbackss(nZ(/0GH>>,:c>RR   2 3 3 8K8K 9 9  ::\3F          !3 4 4 9L9L : :  77\3F              LL< = = =/ G G 0 &&{33-$,M E{EE]EEEFFFF4r'c#hK|j|jd}||||} |dj}n0#t j$rtdYdSwxYw|tj zdz}| |||z|} | j D]~} |j| | jds) | d d | jdd } n(#t j$rt#j} YnwxYwd| j| fVdS) aLists all kernel bugcheck reason callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string r;r< KeBugCheckReasonCallbackListHeadz,Cannot find KeBugCheckReasonCallbackListHeadN!_KBUGCHECK_REASON_CALLBACK_RECORD)rGr=r8rBstringTreplace)absoluter= max_lengtherrorsrJrKrLrOrPr rQrRrSrrNrTEntryis_validCallbackRoutine ComponentrXr UnreadableValue r$r(r8r)r9rZr[ list_offsetr\callback_recordrc components r%list_bugcheck_reason_callbacksz(Callbacks.list_bugcheck_reason_callbackss(nZ(/0GH>>,:c>RR "--2 K%    LLG H H H44  ). 03V V "..&s[/@Z)  (- Z ZH>*-66x7OQSTT  8OO!#-!$ $ 5 8 8 8%577  85h6NPYY Y Y Y Y% Z Zs#A)A<;A<C=="D"!D"c#K|j|jd}||||} |dj}n0#t j$rtdYdSwxYw|tj zdz}| |||z|} | j D]} |j| | jds) | |tj zd z|| jdd } n(#t j$rt#j} YnwxYwd| j| fVdS) aLists all kernel bugcheck callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string r;r<KeBugCheckCallbackListHeadz&Cannot find KeBugCheckCallbackListHeadN_KBUGCHECK_CALLBACK_RECORD)r=r8rBrr)r8r=rrrrs r%list_bugcheck_callbacksz!Callbacks.list_bugcheck_callbacks?s(nZ(/0GH>>,:c>RR "--.JKKSKK%    LLA B B B44  ). 03O O ".. 3#4)  (- T TH>*-66x7OQSTT  8#NN 9>1H<)#-!$ + 5 8 8 8%577  8/0H)S S S S S T Ts#A)A<;A</D  "D21D2c #xK|jj|jd}||j|j|j}t j|j|j |j}|j |j |j |j f}|D]&}||j|j |j|D]\}}}|tj} n|} t!||} | r| D]~\} } d} | D]D}d} d|t%j|| |t*jd| ffVE| s.d|t%j|| tj| ffVd|t%j|tjtj| ffV(dS)NrFTrr)r(modulesrKr7symbol_table_namer*rr#build_module_collectionr8rdrrrr NotApplicableValuelist'get_module_symbols_by_absolute_locationrHexsplitrrNNotAvailableValue)selfrr9 collectioncallback_methodscallback_method callback_typecallback_addresscallback_detaildetailmodule_symbols module_namesymbol_generator symbols_foundsymbols r% _generatorzCallbacks._generatortsM%dk(&;<"88 L&2D4D  Y66 L&+V-E   %  (  /  (   09 9 ODSO !(# EE8 8 @ / #*&9;;FF,F!%FFGWXX""")9G5 %5(- '7  F,0M !$1$0$45E$F$F$/$*LL$@$@$C$* !" #     -  !$1$0$45E$F$F$/$-$?$A$A$* !" #   '@)(,-=>>%799%799"      _8 9 9 r'ctjdtfdtjfdtfdtfdtfg|S)NTyperYModuleSymbolDetail)r TreeGridstrrrr)rs r%runz Callbacks.runsR! \-.333   OO     r')__name__ __module__ __qualname____doc___required_framework_version_version classmethodrr configurationRequirementInterfacer& staticmethodr(ContextInterfacerr7rrintrrdror}rrrrrr'r%rrs_;;"+H  j&>&S!T    [   #4       \ B;?#4;?;? ;? ! ;? %S(3-/0 1 ;?;?;?[;?z)D#4)D)D )D ! )D %S$' ( )D)D)D[)DVU#4UU U ! U %S(3-/0 1 UUU[U@/#4// / ! / %S(3-/0 1 ///[/b7Z#47Z7Z 7Z ! 7Z %S# & ' 7Z7Z7Z[7Zr2T#42T2T 2T ! 2T %S# & ' 2T2T2T[2ThKKKZ      r'r)loggingrwtypingrrrrrvolatility3.frameworkrr r r r #volatility3.framework.configurationr volatility3.framework.renderersrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsrvolatility3.plugins.windowsr getLoggerrrRpluginsPluginInterfacerrr'r%rs  99999999999999WWWWWWWWWWWWWW<<<<<<888888222222::::::,,,,,,  8 $ $x x x x x "2x x x x x r'