[ #glddlZddlZddlmZmZmZmZmZmZm Z ddl m Z m Z m Z mZmZmZddlmZddlmZddlmZddlmZddlmZdd lmZmZmZmZej@e!Z"Gd d e jFjHZ%y) N)DictIterableListOptionalTupleUnioncast) constants exceptions interfacesobjects rendererssymbols) requirements) format_hints)intermed)versions) callbacks) driverirphandles poolscannerssdtceZdZdZdZdZedeejjfdZ edejjdededeej"fdZedejjdedeej"fd Zededeej"fd Zedejjd ed edefd Zedejjded ededeeeeej4j6feeeej4j6fff dZedej>de eefdeeeej4j6feeeej4j6fffdZ!edejjdedededeeeee"eff dZ#edejjdedededeeeedff dZ$edejjdedededeeeee"eff dZ%edejjdedededeeeee"eff dZ&edejjdedededeeeeej4j6ff dZ'edejjdedededeeeeeej<jPejRfff dZ*dZ+dZ,y) Callbacksz1Lists kernel callbacks and notification routines.)rrreturnc `tjddddgtjdtjdtjd t j dtjd tjdtjd tjdgS) NkernelzWindows kernelIntel32Intel64)name description architecturesr)rr)r!pluginversionrrr) rModuleRequirementPluginRequirementrSSDTr PoolScannerr DriverIrprHandles)clss a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/callbacks.pyget_requirementszCallbacks.get_requirements!s  * *,()4   * *DIIy   * *";+B+BI   * * )<)r?r@indexsCbrb) symbol_spaceget_typer BANGr?rPoolConstraintPoolTypeNONPAGEDPAGEDFREE)r1r2shutdown_packet_sizegeneric_callback_sizenotification_packet_sizes r.r5z*Callbacks._create_default_scan_constraintsMs '33<< 9>> ),> > $ !( 4 4 = = 9>> ),? ?! $ $+#7#7#@#@ 9>> ),B B$ $ !  & &&7:PP.5%..77&&,,-&&++,    & &&7:LL*D1%..77&&,,-&&++,   & &&7:MM+T2%..77&&,,-&&++,  %  r0c tjd|tjzdzdtjj tjj ztjjztjd|tjzdzdtjj tjj ztjjzd tjd |tjzdzd tjj tjj ztjjzd tjd |tjzdzd tjj tjj ztjjzd gS)aWCreates a list of Pool Tag Constraints for callback objects. Args: context: The context to retrieve required elements (layers, symbol tables) from symbol_table: The name of an existing symbol table containing the symbols / types Returns: The list containing the built constraints. sDbCb_DBGPRINT_CALLBACK) @r=sPnp9_NOTIFY_ENTRY_HEADER)0N)r$r$rAsPnpD)rQNsPnpC)8N)rrFr rErGrHrIrJ)r2s r.r6z2Callbacks._create_scan_constraints_vista_and_abovexs  & &&7:NN!%..77&&,,-&&++,    & &&7:PP!%..77&&,,-&&++,   & &&7:PP!%..77&&,,-&&++,   & &&7:PP!%..77&&,,-&&++, 7$ $ r0nt_symbol_table config_pathc |j|j}tj||}d|i}|rd}nd}tj j ||d||stjnd||S)aCreates a symbol table for kernel callback objects. Args: context: The context to retrieve required elements (layers, symbol tables) from nt_symbol_table: The name of the table containing the kernel symbols config_path: The config path where to find symbol files Returns: The name of the constructed symbol table nt_symbolsz callbacks-x64z callbacks-x86windowsN) class_types native_types table_mapping) rCnativesrsymbol_table_is_64bitrIntermediateSymbolTablecreaterclass_types_x86)r-r1rUrVr[is_64bitr\symbol_filenames r.create_callback_symbol_tablez&Callbacks.create_callback_symbol_tables"++O<DD 00/J%7 -O-O//66    9A 11t%'7  r0 layer_namecallback_symbol_tablec#Ktj||}tjj |||}|j |||}t jj||||D]8\}} } t| dr| js%|j| |:y#tj$rYQwxYww)aFScans for callback objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate nt_symbol_table: The name of the table containing the kernel symbols callback_symbol_table: The name of the table containing the callback object symbols (_SHUTDOWN_PACKET etc.) Returns: A list of callback objects found by scanning the `layer_name` layer for callback pool signatures r1r2is_validN)ris_vista_or_laterrr, get_type_mapr8rr*generate_pool_scanhasattrri_process_scanned_callbackr InvalidAddressException) r-r1rerUrfrjtype_mapr7 _constraint mem_object_headers r.scanzCallbacks.scans2%66/ ??//_U:: *,=  $ $ 7 7 Z+     :z2:;N;N;P33JII 55  s6A5C8B,CB,)C,C?CCC memory_objectrpcx|j}|jj}t|tj s||t jzdzk(rud} |jj}tjjd}|j|}|jjxst!j"} n||t jzdzk(r$d}|j,}t!j*} n||t jzdzk(r|jj/r|jj1nd}|r[|j3} | j5|dk(r!| j6j8j} nt!j*} nt!j:} |j<j>r|j<j@nt!j"}|jB}n||t jzdzk(r#d }|jD}t!j*} nJ||t jzd zk(r#d }|jF}t!j*} ntId |||t| tJj jLs| fS| fS#t$j&$r-|jj(}t!j*} YkwxYw#t$j&$rt!j:} YlwxYw) Nr:IoRegisterShutdownNotificationIRP_MJ_SHUTDOWNr<IoRegisterFsRegistrationChangerRDriverr;GenericKernelCallbackrODbgSetDebugPrintCallbackzUnexpected object type )'get_symbol_table_namevolr> isinstancerr:r rE DeviceObject DriverObjectrMAJOR_FUNCTIONSrB MajorFunction DriverNameStringrUnparsableValuer rooffsetNotApplicableValueNotificationRoutine is_readable dereferenceget_object_headerget_object_typeNameInfoNameUnreadableValue EventCategoryis_valid_choicer"CallbackRoutineCallbackFunction ValueErrorr BaseAbsentValue) r-rurpr2r> callback_typedriverrBcallback_addressdetailsheaders r.rnz#Callbacks._process_scanned_callbacks%::< !%%// mY%?%? @  69KK K  ++22Qi6O6O6Q ,7:PP P">"@$335!..>>++77..0  -<<  ,7:MM M3M,55 224G ,7:NN N6M,55 224G6ykBC C  "':+?+?+O+OP      g55 9#0#4#4#;#; #668 92"99:'779G:s&A0K .A L =L  L 'L98L9callback_table_namec #K|j|jd}|j|||}tj||}|t j zdz}gd} | D]\} } |j| j} |r| rd} nd} tttj |j#d | |j%d | }|D]C} |j'j|}|j*d k7s3| |j*d fEy #tj$rtjd| YwxYw#tj($rYwxYww)aLists all kernel notification routines. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string kernel_virtual_offsetrerrhr;))PspLoadImageNotifyRoutineF)PspCreateThreadNotifyRoutineT)PspCreateProcessNotifyRoutineTz Cannot find rQarray _EX_FAST_REF object_typersubtypecountrN)layersconfigmodulerrjr rE get_symboladdressr SymbolErrorvollogdebugr rr PointerobjectrDrror)r-r1rer2rkvontkrnlmprjfull_type_name symbol_names symbol_name extended_list symbol_offsetr fast_refsfast_refcallbacks r.list_notify_routineszCallbacks.list_notify_routinesTsv(nnZ(//0GH>>,:c>R$66, -y~~=@SS +7 &K  ( 3 3K @ H H !]W__% '($--n=  I&'335::>JH$$)%x'8'8$>>&-+7))  |K=9: ,"99sUA*E)-DAE)E9E) E)+E  E) E  E)E&#E)%E&&E)Nc #~K|j|jd}|j|||}|tjzdz}|j dj }|j dj } |jd| } | dk(ry tttj|jd ||jd | } | D]C} | jj|} | j dk7s3d | j d fEy #tj$rY\wxYww)z] Lists all registry callbacks from the old format via the CmpCallBackVector. rr_EX_CALLBACK_ROUTINE_BLOCKCmpCallBackVectorCmpCallBackCount unsigned intrrrNrrrCmRegisterCallback)rrrr rErrrr rr rrDrr ror)r-r1rer2rrrrrsymbol_count_offsetcallback_countrrrs r._list_registry_callbacks_legacyz)Callbacks._list_registry_callbacks_legacysHnnZ(//0GH>>,:c>R ).. 03O O !++,?@HH &112DEMM!&/B)  Q   ! OO#$ )).9$   "H #//166~F  A%*H,=,=tCC"55  s0CD=!D$D=D=$D:7D=9D::D=c#RK|j|jd}|j|||}|tjzdz}|j dj }|j dj } |jd| } | dk(ry |jd |} | j|d D]Z} d } tjtj5| jj} d d d d | jd | f\y #1swY xYww)zH Lists all registry callbacks via the CallbackListHead. rr_CM_CALLBACK_ENTRYCallbackListHeadrrrrN _LIST_ENTRYLinkCmRegisterCallbackExz Altitude: )rrrr rErrrto_list contextlibsuppressr roAltituderr)r-r1rer2rrrrrrr callback_listraltitudes r._list_registry_callbacks_newz&Callbacks._list_registry_callbacks_news!nnZ(//0GH>>,:c>R,y~~=@TT ++,>?GG &112DEMM!&/B)  Q  M-X %--nfEHH$$Z%G%GH 4#,,33 4((*;*;z(=TT T F 4 4sC#D'%D<D'D$ D'c#K|j|jd}|j|||}|jdr.|jdr|j ||||Ed{y|jdr.|jdr|j ||||Ed{ygd}t jd|D]3}d } |j|rd } t jd |d | d 5y77Yw)aLists all registry callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string rrrrNr)rrrz!Failed to get registry callbacks!zdoes not existexistszsymbol  .)rrr has_symbolrrrr) r-r1rer2rrrsymbols_to_checkr symbol_statuss r.list_registry_callbacksz!Callbacks.list_registry_callbackss"(nnZ(//0GH>>,:c>R   2 38K8K 9 ::\3F   !3 49L9L : 77\3F     LL< =/ 0 &&{3$,M w{m1]O1EF 0 -   s%A*D,D->D+D,ADDc#K|j|jd}|j|||} |jdj}|tjzdz}|j|||z|} | jD]^} |j|j| jds- |jd d | jdd } d| j| f`y#t j $rtjdYywxYw#t j $rt#j$} YkwxYww) aLists all kernel bugcheck reason callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string rr KeBugCheckReasonCallbackListHeadz,Cannot find KeBugCheckReasonCallbackListHeadN!_KBUGCHECK_REASON_CALLBACK_RECORD)rrrerQstringTreplace)absoluter max_lengtherrorsrrrrrr rrrr rErEntryrir Componentrorr r-r1rer2rrr list_offsetrcallback_recordr components r.list_bugcheck_reason_callbacksz(Callbacks.list_bugcheck_reason_callbackssW4nnZ(//0GH>>,:c>R "--2g  ).. 03V V "..&s[/@Z) (--H>>*-66x7O7OQST 8OO!#--!$ $5h6N6NPYY Y%.%%  LLG H 455 8%557  8sM1EC*A&E6 DE*(DEDE'E?EEEc#K|j|jd}|j|||} |jdj}|tjzdz}|j|||z|} | jD]r} |j|j| jds- |j|tjzd z|| jdd } d| j| fty#t j $rtjdYywxYw#t j $rt#j$} YkwxYww) aLists all kernel bugcheck callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string rrKeBugCheckCallbackListHeadz&Cannot find KeBugCheckCallbackListHeadN_KBUGCHECK_CALLBACK_RECORD)rrerQrr)rerrrrrs r.list_bugcheck_callbacksz!Callbacks.list_bugcheck_callbacksWs[4nnZ(//0GH>>,:c>R "--.JKSSK ).. 03O O ".. 3#4) (--H>>*-66x7O7OQST 8#NN 9>>1H<)#--!$ + /0H0H)S S.%%  LLA B .55 8%557  8sM1EC>A&E64D,*E>(D)&E(D))E,'EEEEc # K|jj|jd}|j|j|j|j }t jj|j|j|j}|j|j|j|j|jf}|D]5}||j|j|j|D]\}}}|tj } n|} t#|j%|} | r| D]\} } d} | D]B}d} d|t'j(|| |j+t,j.d| ffD| rRd|t'j(|| tj0| ffd|t'j(|tj0tj0| ff8yw)NrFTrr$)r1modulesrrdsymbol_table_namerVrr)build_module_collectionrerrrrrtrrlist'get_module_symbols_by_absolute_locationrHexsplitr rENotAvailableValue)selfrrf collectioncallback_methodscallback_methodrrcallback_detaildetailmodule_symbols module_namesymbol_generator symbols_foundsymbols r. _generatorzCallbacks._generators %%dkk(&;< $ A A LL&22D4D4D! YY66 LL&++V-E-E  % %  ( (  / /  ( ( II   0ODS !!((% E@ / #*&99;F,F!%FFGWX""9G5 %5(- '7F,0M !$1$0$4$45E$F$/$*LL$@$C$* !" # '7 - !$1$0$4$45E$F$/$-$?$?$A$* !" # ':H@)(,,-=>%779%779"   _E 0s FHA&>&S&S!T  *##44  k(( ) *( ##44( DG( k(( )( ( T1 1 k(( )1 1 f! ##44! !  ! ! ! F/##44// / # /  #z++;;; <  #z++;;; < >   //bO #..O :>sCx.O  c:''7778  c:''7778 : O O b>?##44>?>? >? ! >? %S(3-/0 1 >?>?@,D##44,D,D ,D ! ,D %S$' ( ,D,D\U##44UU U ! U %S(3-/0 1 UU@/##44// / ! / %S(3-/0 1 //b=Z##44=Z=Z =Z ! =Z     0 0 2   =Z=Z~8T##448T8T 8T ! 8T    *$$44i6O6OO P R   8T8TtL\  r0r)&rloggingtypingrrrrrrr volatility3.frameworkr r r r rr#volatility3.framework.configurationrvolatility3.framework.renderersrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr0volatility3.framework.symbols.windows.extensionsrvolatility3.plugins.windowsrrrr getLoggerrrpluginsPluginInterfacerrr0r.r,sc EEE=82:FMM   8 $O  ""22O  r0