
    Xf>                         d dl Z d dlZd dlZd dlmZmZmZmZmZ d dl	m
Z
mZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ  e j        e          ZdZd	Zd
dddZ G d de
j        j                  ZdS )    N)ListTupleTypeOptional	Generator)
interfaces	renderers
exceptions	constants)requirements)format_hintsUnreadableValue)handles)pslist      DataSectionObjectImageSectionObjectSharedCacheMap)datimgvacbc                      e Zd ZdZdZdZedeej	        j
                 fd            Zedej        j        dej        j        deej        j                 d	ej        j        d
edeej        j                 fd            Zedej        j        dedeej        j                 dej        j        deeddf         f
d            ZdedefdZd ZdS )	DumpFilesz7Dumps cached file contents from Windows memory samples.   r   r      r   r   returnc                    t          j        ddddg          t          j        ddd	          t          j        d
dd	          t          j        ddd	          t          j        ddd	          t          j        dddd          t          j        dt          j        d          t          j        dt          j	        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidz8Process ID to include (all other processes are excluded)T)r$   r%   optionalvirtaddrz2Dump a single _FILE_OBJECT at this virtual addressphysaddrz3Dump a single _FILE_OBJECT at this physical addressfilterz-Dump files matching regular expression FILTERignore-casezIgnore case in filter matchF)r$   r%   defaultr(   r   r   )r$   	componentversionr   r   )
r   ModuleRequirementIntRequirementStringRequirementBooleanRequirementVersionRequirementr   PsListr   Handles)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/dumpfiles.pyget_requirementszDumpFiles.get_requirements!   s    *,()4  
 'V  
 'P  
 'Q  
 *K  
 +"9	   +	   +'/9  G&
 &	
    file_objectmemory_objectopen_methodlayerdesired_file_namec                     ||          }d}	 |                                 D ]Z\  }}	}
|                    ||
d          }|t          |          z  }|                    |	           |                    |           [n># t
          j        $ r, t                              d|j	        j
        d           Y dS w xY w|s*t                              d|j	        j
        d           dS t                              d|j                    |S )	a  Produce a file from the memory object's get_available_pages() interface.

        :param file_object: the parent _FILE_OBJECT
        :param memory_object: the _CONTROL_AREA or _SHARED_CACHE_MAP
        :param open_method: class for constructing output files
        :param layer: the memory layer to read from
        :param desired_file_name: name of the output file
        :return: result status
        r   T)padzUnable to dump file at #xNz"No data is cached for the file at zStored )get_available_pagesreadlenseekwriter
   InvalidAddressExceptionvollogdebugvoloffsetpreferred_filename)r7   r;   r<   r=   r>   r?   filedatabytes_written	memoffset
fileoffsetdatasizedatas               r8   dump_file_producerzDumpFiles.dump_file_producerL   s<   $ ;011 	3@3T3T3V3V % %/	:xzz)X4z@@T*j)))t$$$$	%
 1 	 	 	LLN;?3INNNOOO44	  	LLP[_5KPPP   4<x:<<===s   A/A? ?7B:9B:contextprimary_layer_namefile_objNc           	   #     K   |j         j        t          t          fvr6t                              t          j        d|j        j	        dd           dS |j
        |         j        d         }|j
        |         }|j
        |         }|                                }t                      }	dD ]\  }
}	 t          |j        |
          }|                                                    d          }|                                r|	                    |||f           o# t(          j        $ r8 t                              t          j        |
 d|j        j	        d           Y w xY w	 |j        j        }|                                                    d	          }|                                r|	                    ||d
f           nH# t(          j        $ r6 t                              t          j        d|j        j	        d           Y nw xY w|	D ]\  }}}t.          |         }d                    |j        j	        |j        j	        |t3          j        |          |          }|                     |||||          }d}|r|                                 |j        }|t=          j        |j        j	                  t3          j        |          |fV  dS )aA  Given a FILE_OBJECT, dump data to separate files for each of the three file caches.

        :param context: the context to operate upon
        :param primary_layer_name: primary/virtual layer to operate on
        :param open_method: class for constructing output files
        :param file_obj: the FILE_OBJECT
        zThe file object at rB   z is not a file on diskNmemory_layer))r   r   )r   r   _CONTROL_AREAz is unavailable for file _SHARED_CACHE_MAPr   z'SharedCacheMap is unavailable for file zfile.{0:#x}.{1:#x}.{2}.{3}.{4}zError dumping file) DeviceObject
DeviceTypeFILE_DEVICE_DISKFILE_DEVICE_NETWORK_FILE_SYSTEMrI   logr   LOGLEVEL_VVVrK   rL   layersconfigfile_name_with_devicelistgetattrSectionObjectPointerdereferencecastis_validappendr
   rH   r   EXTENSION_CACHE_MAPformatntpathbasenamerT   closerM   r   Hex)r7   rU   rV   r=   rW   memory_layer_namerY   primary_layerobj_namedump_parametersmember_name	extensionsection_objcontrol_areascm_pointershared_cache_mapr<   r>   
cache_namer?   file_handlefile_outputs                         r8   process_file_objectzDumpFiles.process_file_objectx   s=     "  ++4
 
 
 JJ&Thl&9TTTT   4 $N+=>EnU~&78'9:1133 &&'
 	 	"K	%h&C[QQ*6688==oNN((** T#**L,	+RSSS5   

*"UUX\=PUUU    		"7FK*6688==>QRR((** R&&(8-'PQQQ1 	 	 	JJ&R(,:MRRR    	 0? 	 	+M5),Y7J @ G G#!())! ! 00-e=N K /K =!!###)<  !455      '	 	s(   /A(DAEE#AG AHHprocsoffsetsc           	   #   ,	  K   | j         j        | j        d                  }d }| j        d         r;| j        d         rt          j        nd}t          j        | j        d         |          }|rNt          j        | j         | j                  }|	                    | j         |j
        |j                  }|                    | j         |j
        |j                  }|D ]}		 |	j        }
nH# t          j        $ r6 t                               t$          j        d|	j        j        d           Y Pw xY w|                    |
          D ]}	 |                    ||          }|d	k    r|j                            d
          }|r@|                                }t5          |t6                    re|                    |          s{|                     | j         |j
        | j        |          D ]}d|fV  	# t          j        $ r6 t                               t$          j        d|j        j        d           Y w xY w|	                                                                 D ]U}	 |!                    d          r|j"        j#        $                                }nM|!                    d          r7|j%        j"        j#        $                                                    d
          }n|&                                s|r@|                                }t5          |t6                    r|                    |          s|                     | j         |j
        | j        |          D ]}d|fV  	# t          j        $ r7 t                               t$          j        d|j        j        d           Y Sw xY wd S |r|D ]\  }}	 |j
        }|s| j         j'        |         j        d         }| j         (                    |j        t$          j)        z   d
z   ||j
        |          }|                     | j         |j
        | j        |          D ]}d|fV  	# t          j        $ r, t                               t$          j        d|d           Y w xY wd S d S )Nr!   r+   r,   r   )rU   config_path)rU   
layer_namesymbol_tablez'Cannot access _EPROCESS.ObjectTable at rB   File_FILE_OBJECTz+Cannot extract file from _OBJECT_HEADER at ControlArea
Subsectionz Cannot extract file from VAD at rY   )r   native_layer_namerL   zCannot extract file at )*rU   modulesrc   reIcompiler   r6   _config_pathget_type_mapr   symbol_table_namefind_cookieObjectTabler
   rH   rI   r`   r   ra   rK   rL   get_object_typeBodyri   rd   
isinstancer   searchr   openget_vad_roottraverse
has_memberr   FilePointerrh   r   rj   rb   objectBANG)selfr   r   r!   file_reflagshandles_plugintype_mapcookieprocobject_tableentryobj_typerW   r$   resultvadrL   
is_virtualr   s                       r8   
_generatorzDumpFiles._generator   s~     %dk(&;<;x  	? K6=BDDAEjX!6>>G p	
 %_$2C  N &22!,#5 3  H
 $//!,#5 0  F  C C#'#3LL!9   JJ!.V$(/VVV   H ,33LAA  E#(#8#86#J#J#v--',z~'F'FH& -'/'E'E'G'G#-dO#D#D !-$,'.~~d';'; !-$,*.*B*B $f.?H+ + 2 2 ()&k 1 1 1 1%=   

%2_%)JZ___      ,,..7799  C>>-88 	%'*'B'N'N'P'PHH ^^L99 %'*~'A'M'Y'Y'['['`'` .( (HH %'0022 %$" )#+#A#A#C#CD)$@@ ) (#*>>$#7#7 ) (&*&>&> L&*;TY' ' . .F $%f+----. &=   

%2Rsw~RRR    7IC CJ  	&-  "
!'!2J% %)\%8%D%K*&
  $|2209>ANR#-*0*;%	  3    H #'":":f&7H# # * *  !&k))))* "9   JJ!.0U&0U0U0U    +	 	 sr   !C))AD.-D.	A!G2+G20G22AH76H7$B M.%M.:+M.&M.<0M..AN43N4BQ8RRc                 J   t                      }t                      }| j        j        | j        d                  }| j        d         r)| j        d         s| j        d         rt	          d          | j                            dd           #|                    | j        d         df           n| j                            dd           #|                    | j        d         df           nkt          j        	                    | j                            dd           g          }t          j        
                    | j        |j        |j        |	          }t          j        d
t          fdt           j        fdt          fdt          fg|                     ||                    S )Nr!   r+   r)   r*   z+Cannot use filter flag with an address flagTFr'   )filter_funcCache
FileObjectFileNameResult)re   rU   r   rc   
ValueErrorgetrk   r   r5   create_pid_filterlist_processesr   r   r	   TreeGridstrr   rq   r   )r   r   r   r!   r   s        r8   runzDumpFiles.runV  s   &&%dk(&;<;x  	LK
#	L'+{:'>	L JKKK;??:t,,8NNDK
3T:;;;;[__Z..:NNDK
3U;<<<< -99--. K M00!('	 1  E !#|/0S!3	 OOE7++
 
 	
r:   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer9   objectsObjectInterfacer   pluginsFileHandlerInterfacerb   DataLayerInterfacer   r   rT   rU   ContextInterfacer   r   r   r   r    r:   r8   r   r      s       AA"+H(
j&>&S!T (
 (
 (
 [(
T )'7) ")9) *,AB	)
  3) ) 
*$9	:) ) ) [)V b#4b  b *,AB	b
 $4b 
5$$	%b b b [bHw wt w w w wr#
 #
 #
 #
 #
r:   r   )loggingrn   r   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r   volatility3.plugins.windowsr   r   	getLoggerr   rI   r^   r_   rl   r   PluginInterfacer   r   r:   r8   <module>r      s6  
   				 9 9 9 9 9 9 9 9 9 9 9 9 9 9 N N N N N N N N N N N N < < < < < < I I I I I I I I / / / / / / . . . . . .		8	$	$ "&   ^
 ^
 ^
 ^
 ^

"2 ^
 ^
 ^
 ^
 ^
r:   