
    vf8@                         d dl Z d dlZd dlZd dlmZmZmZmZmZ d dl	m
Z
mZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ  e j,                  e      ZdZd	Zd
dddZ G d de
j8                  j:                        Zy)    N)ListTupleTypeOptional	Generator)
interfaces	renderers
exceptions	constants)requirements)format_hintsUnreadableValue)handles)pslist      DataSectionObjectImageSectionObjectSharedCacheMap)datimgvacbc                       e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  dej                  j                  deej                  j                      d	ej"                  j$                  d
edeej                  j                      fd       Zedej,                  j.                  dedeej                  j                      dej                  j                  deeddf   f
d       ZdedefdZd Zy)	DumpFilesz7Dumps cached file contents from Windows memory samples.   r   r      r   r   returnc                    t        j                  ddddg      t        j                  ddd	      t        j                  d
dd	      t        j                  ddd	      t        j                  ddd	      t        j                  dddd      t        j
                  dt        j                  d      t        j
                  dt        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidz8Process ID to include (all other processes are excluded)T)r$   r%   optionalvirtaddrz2Dump a single _FILE_OBJECT at this virtual addressphysaddrz3Dump a single _FILE_OBJECT at this physical addressfilterz-Dump files matching regular expression FILTERignore-casezIgnore case in filter matchF)r$   r%   defaultr(   r   r   )r$   	componentversionr   r   )
r   ModuleRequirementIntRequirementStringRequirementBooleanRequirementVersionRequirementr   PsListr   Handles)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/dumpfiles.pyget_requirementszDumpFiles.get_requirements!   s     **,()4
 ''V
 ''P
 ''Q
 **K
 ++"9	 ++	 ++'//9G&
 &	
    file_objectmemory_objectopen_methodlayerdesired_file_namec                     ||      }d}	 |j                         D ]J  \  }}	}
|j                  ||
d      }|t        |      z  }|j                  |	       |j	                  |       L 	 |s.t        j                  d|j                  j                  d       yt        j                  d|j                          |S # t
        j                  $ r0 t        j                  d|j                  j                  d       Y yw xY w)	a  Produce a file from the memory object's get_available_pages() interface.

        :param file_object: the parent _FILE_OBJECT
        :param memory_object: the _CONTROL_AREA or _SHARED_CACHE_MAP
        :param open_method: class for constructing output files
        :param layer: the memory layer to read from
        :param desired_file_name: name of the output file
        :return: result status
        r   T)padzUnable to dump file at #xNz"No data is cached for the file at zStored )get_available_pagesreadlenseekwriter
   InvalidAddressExceptionvollogdebugvoloffsetpreferred_filename)r7   r;   r<   r=   r>   r?   filedatabytes_written	memoffset
fileoffsetdatasizedatas               r8   dump_file_producerzDumpFiles.dump_file_producerL   s    $ 01 	3@3T3T3V %/	:xzz)X4z@T*j)t$	% LL4[__5K5KB4OP wx::;<= 11 	LL2;??3I3I"2MNO	s   AB> >A D Dcontextprimary_layer_namefile_objNc           	   #     K   |j                   j                  t        t        fvr>t        j                  t        j                  d|j                  j                  dd       y|j                  |   j                  d   }|j                  |   }|j                  |   }|j                         }t               }	dD ]_  \  }
}	 t        |j                  |
      }|j!                         j#                  d      }|j%                         r|	j'                  |||f       a 	 |j                  j,                  }|j!                         j#                  d	      }|j%                         r|	j'                  ||d
f       |	D ]  \  }}}t.        |   }dj1                  |j                  j                  |j                  j                  |t3        j4                  |      |      }| j7                  |||||      }d}|r|j9                          |j:                  }|t=        j>                  |j                  j                        t3        j4                  |      |f  y# t(        j*                  $ rB t        j                  t        j                  |
 d|j                  j                  d       Y w xY w# t(        j*                  $ r@ t        j                  t        j                  d|j                  j                  d       Y w xY ww)aA  Given a FILE_OBJECT, dump data to separate files for each of the three file caches.

        :param context: the context to operate upon
        :param primary_layer_name: primary/virtual layer to operate on
        :param open_method: class for constructing output files
        :param file_obj: the FILE_OBJECT
        zThe file object at rB   z is not a file on diskNmemory_layer))r   r   )r   r   _CONTROL_AREAz is unavailable for file _SHARED_CACHE_MAPr   z'SharedCacheMap is unavailable for file zfile.{0:#x}.{1:#x}.{2}.{3}.{4}zError dumping file) DeviceObject
DeviceTypeFILE_DEVICE_DISKFILE_DEVICE_NETWORK_FILE_SYSTEMrI   logr   LOGLEVEL_VVVrK   rL   layersconfigfile_name_with_devicelistgetattrSectionObjectPointerdereferencecastis_validappendr
   rH   r   EXTENSION_CACHE_MAPformatntpathbasenamerT   closerM   r   Hex)r7   rU   rV   r=   rW   memory_layer_namerY   primary_layerobj_namedump_parametersmember_name	extensionsection_objcontrol_areascm_pointershared_cache_mapr<   r>   
cache_namer?   file_handlefile_outputs                         r8   process_file_objectzDumpFiles.process_file_objectx   s    "   +++4
 
 JJ&&%hll&9&9"%==ST  $NN+=>EEnU~~&78'9:113 &'
 	"K	%h&C&C[Q*668==oN((*#**L,	+RS	"		"77FFK*668==>QR((*&&(8-'PQ 0? 	+M5),Y7J @ G G##!!(()! 00-e=NK /K!!#)<<   !4!45  '	' 55 

**"m#<X\\=P=PQS<TU 11 	JJ&&9(,,:M:Mb9QR	sS   B=K? AIK?AJ) 5CK?AJ&"K?%J&&K?)AK<8K?;K<<K?procsoffsetsc           	   #   H  K   | j                   j                  | j                  d      }d }| j                  d   rD| j                  d   rt        j                  nd}t        j
                  | j                  d   |      }|rt        j                  | j                   | j                        }|j                  | j                   |j                  |j                        }|j                  | j                   |j                  |j                        }t               }	|D ]v  }
	 |
j                  }|j                  |      D ]  }	 |j/                  ||      }|d	k(  r|j0                  j3                  d
      }|r3|j5                         }t7        |t8              rY|j;                  |      sk|j*                  j,                  |	v r|	j=                  |j*                  j,                         | j?                  | j                   |j                  | j@                  |      D ]  }d|f 
  |
jC                         jE                         D ]K  }	 |jG                  d      r%|jH                  jJ                  jM                         }nP|jG                  d      r>|jN                  jH                  jJ                  jM                         j3                  d
      }n|jQ                         s|r3|j5                         }t7        |t8              r|j;                  |      s|j*                  j,                  |	v r|	j=                  |j*                  j,                         | j?                  | j                   |j                  | j@                  |      D ]  }d|f 
 N y y |r|D ]  \  }}	 |j                  }|s&| j                   jR                  |   j                  d   }| j                   jU                  |j                  t&        jV                  z   d
z   ||j                  |      }| j?                  | j                   |j                  | j@                  |      D ]  }d|f 
  y y # t        j                   $ r@ t"        j%                  t&        j(                  d|
j*                  j,                  d       Y w xY w# t        j                   $ r@ t"        j%                  t&        j(                  d|j*                  j,                  d       Y w xY w# t        j                   $ r@ t"        j%                  t&        j(                  d|j*                  j,                  d       Y w xY w# t        j                   $ r, t"        j%                  t&        j(                  d|d       Y w xY ww)Nr!   r+   r,   r   )rU   config_path)rU   
layer_namesymbol_tablez'Cannot access _EPROCESS.ObjectTable at rB   File_FILE_OBJECTz+Cannot extract file from _OBJECT_HEADER at ControlArea
Subsectionz Cannot extract file from VAD at rY   )r   native_layer_namerL   zCannot extract file at ),rU   modulesrc   reIcompiler   r6   _config_pathget_type_mapr   symbol_table_namefind_cookiesetObjectTabler
   rH   rI   r`   r   ra   rK   rL   get_object_typeBodyri   rd   
isinstancer   searchaddr   openget_vad_roottraverse
has_memberr   FilePointerrh   r   rj   rb   objectBANG)selfr   r   r!   file_reflagshandles_plugintype_mapcookiedumped_filesprocobject_tableentryobj_typerW   r$   resultvadrL   
is_virtualr   s                        r8   
_generatorzDumpFiles._generator   s    %%dkk(&;<;;x  KK6BDDAEjjX!6>G
 %__$2C2CN &22!,,#55 3 H
 $//!,,#55 0 F 5L K#'#3#3L ,33LA E#(#8#86#J#v-',zz~'FH&'/'E'E'G#-dO#D$,'.~~d';$,'||22lB ((,,X\\-@-@A*.*B*B $f.?.?H+ 2 ()&k 12#<  ,,.779 #C">>-8'*'B'B'N'N'PH ^^L9'*~~'A'A'M'M'Y'Y'['`'` .(H %'002$"#+#A#A#CD)$@ (#*>>$#7 (#<<..,>$$(()<)<=&*&>&> LL&*;*;TYY' .F $%f+-.7#QKZ &- "
!'!2!2J%%)\\%8%8%D%K%K*&
  $||22009>>ANR#-*0*;*;%	  3  H #'":":f&7&7H# *  !&k)* U "99 JJ!..A$((//RTAUV 8 &== 

%22I%))JZJZ[]I^_P &== 

%22>sww~~b>QR6 "99 JJ!..2I&QS0Us   DV"!Q-V"AR4V"R4(V")R4V"A"R4$$V"	BT
V"T
V" "T
V"T
V"T
-V".A"T
V""B8U V"AR1-V"0R11V"4ATV"TV"
AUV"UV" ;VV"VV"c                 h   t               }t               }| j                  j                  | j                  d      }| j                  d   r)| j                  d   s| j                  d   rt	        d      | j                  j                  dd       !|j                  | j                  d   df       n| j                  j                  dd       !|j                  | j                  d   df       n{t        j                  j                  | j                  j                  dd       g      }t        j                  j                  | j                  |j                  |j                  |	      }t        j                  d
t        fdt         j"                  fdt        fdt        fg| j%                  ||            S )Nr!   r+   r)   r*   z+Cannot use filter flag with an address flagTFr'   )filter_funcCache
FileObjectFileNameResult)re   rU   r   rc   
ValueErrorgetrk   r   r5   create_pid_filterlist_processesr   r   r	   TreeGridstrr   rq   r   )r   r   r   r!   r   s        r8   runzDumpFiles.run`  sh   &%%dkk(&;<;;x KK
#t{{:'>JKK;;??:t,8NNDKK
3T:;[[__Z.:NNDKK
3U;< --99-.K MM00!!(('	 1 E !!#|//0S!3	 OOE7+
 	
r:   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer9   objectsObjectInterfacer   pluginsFileHandlerInterfacerb   DataLayerInterfacer   r   rT   rU   ContextInterfacer   r   r   r   r    r:   r8   r   r      sm   A"+H(
j&>&>&S&S!T (
 (
T )''77) "))99) *,,AAB	)
   33) ) 
*$$99	:) )V b##44b  b *,,AAB	b
 $$44b 
5$$	%b bHA At AF#
r:   r   )loggingrn   r   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r   volatility3.plugins.windowsr   r   	getLoggerr   rI   r^   r_   rl   r   PluginInterfacer   r   r:   r8   <module>r      sq   
   	 9 9 N N < I / .			8	$ "&  h

""22 h
r:   