
    *1fb@                         d dl Z d dlmZmZmZ d dlmZmZmZm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZ  e j        e          Z	 d dlZdZn# e$ r d	ZY nw xY w G d
 de	j        j                  ZdS )    N)ListOptionalDict)	constants
exceptions	renderers
interfacessymbols)requirements)utility)format_hints)pslistpsscanTFc                   :    e Zd ZdZdZdZ fdZedee	j
        j                 fd            Zd Zd Zd	 Zed
e	j        j        dededeeef         fd            Zed
e	j        j        dededee	j        j                 fd            ZddZd Zd Zd Z xZS )HandleszLists process open handles.   r   r   )   r   r   c                 r     t                      j        |i | d | _        d | _        d | _        d| _        d S )N   )super__init__
_sar_value	_type_map_cookie_level_mask)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/handles.pyr   zHandles.__init__   sB    $)&)))    returnc           	         t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          t          j        dt          dd          t          j
        ddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r(   pluginversionr   )r   r   r   )r(   	componentr,   pidz9Process IDs to include (all other processes are excluded)T)r(   element_typer)   optionaloffsetz,Process offset in the physical address space)r(   r)   r0   )r   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   PsScanListRequirementintIntRequirement)clss    r!   get_requirementszHandles.get_requirements%   s     *,()4  
 *fmY   +	   ( W	   'J  %
 	
r"   c                     |dz  }||z	  }|S )zWindows encodes pointers to objects and decodes them on the fly
        before using them.

        This function mimics the decoding routine so we can generate the
        proper pointer values as well.
        l     )r   valuemagics      r!   _decode_pointerzHandles._decode_pointerA   s     ** r"   c                 6   | j         j        | j        d                  }|j        }	 | j         j        |                             |j                  sdS |j                            d          }|                                                    d          }|j	        |_	        n# t          $ r t          j        | j         |j                  }|rk|j        dk    rY dS |                                 }|+t           rt          d          t#          j        dd          |                     |j        |          }	n|j        dk    rY dS |j        d	z  }	| j                             |j        t,          j        z   dz   ||	
          }|j        |_	        Y nw xY w||_        |S )zGiven  a handle table entry (_HANDLE_TABLE_ENTRY) structure from a
        process' handle table, determine where the corresponding object's
        _OBJECT_HEADER can be found.r%   N_EX_FAST_REF_OBJECT_HEADERr   z?Unable to find the SAR value for decoding handle table pointerscapstonezJRequires capstone to find the SAR value for decoding handle table pointersir1   )contextmodulesconfig
layer_namelayersis_validObjectcastdereferenceGrantedAccessAttributeErrorr
   symbol_table_is_64bitsymbol_table_nameLowValuefind_sar_valuehas_capstoner   MissingModuleExceptionr@   	InfoTableobjectr   BANGGrantedAccessBitsHandleValue)
r   handle_table_entryhandle_valuer%   virtualfast_refobject_headeris_64bitr?   r1   s
             r!   	_get_itemzHandles._get_itemP   s   
 %dk(&;<#,	O<&w/889K9RSS t)055nEEH$0022778HIIM*<*JM'' %	O %	O %	O4f6 H  ;%.!3344++-- =# ,]   )?&h  
 --.@.I5QQ%/14444+5: !L//(9>9<LL 0  M
 +=*NM'''K%	ON %1!s&   *B  AB   6FA(FAFFc                    | j         gt          sdS | j        j        | j        d                  }|j        }| j        j        |         j        d         }| j                            |j        ||          }	 |	                    d          j
        }n# t          j        $ r Y dS w xY w| j        j                            |||z   d          }|dS t          j        t          j        t          j                  }|                    |||z             D ]^\  }}	}
}|
                    d          rBt)          |                    d          d	                                         d
          | _          n_| j         S )zLocate ObpCaptureHandleInformationEx if it exists in the sample.

        Once found, parse it for the SAR value that we need to decode
        pointers in the _HANDLE_TABLE_ENTRY which allows us to find the
        associated _OBJECT_HEADER.
        Nr%   kernel_virtual_offsetrI   r1   ObpCaptureHandleInformationExi   sar,r      )r   rU   rF   rG   rH   rI   rJ   modulerR   
get_symboladdressr   SymbolErrorreadrD   CsCS_ARCH_X86
CS_MODE_64disasm_lite
startswithr8   splitstrip)r   r%   virtual_layer_namekvontkrnlmp	func_addrdatamdrl   sizemnemonicop_strs               r!   rT   zHandles.find_sar_value   s    ?" t\)$+h*?@F!'!2,%&89@'C |**(5GPS +  H$//0OPPX		)   tt <&++,>iQVWWD|tX183FGGB35>>cIo4 4 	 	/x
 &&u--  '*&,,s*;*;A*>*D*D*F*F&K&KDOE	 s   6B B$#B$rF   rI   symbol_tablec                    i }|j         |         j        d         }|                    |||          }	 |                    d          j        }n/# t
          j        $ r |                    d          j        }Y nw xY w|j         |         }|                    ||z             s|S |                    d||	                    d          d          }	t          |	          D ]\  }
}|
d	k    r|d	k    r n	 |                                                    |t          j        z   d
z             }|j        j        }nH# t
          j        $ r6 t$                              t          j        d|j        j        d           Y w xY w|||
<   |S )a  List the executive object types (_OBJECT_TYPE) using the
        ObTypeIndexTable or ObpObjectTypes symbol (differs per OS). This method
        will be necessary for determining what type of object we have given an
        object header.

        Note:
            The object type index map was hard coded into profiles in previous versions of volatility.
            It is now generated dynamically.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A mapping of type indices to type names
        rd   re   ObTypeIndexTableObpObjectTypesarraypointerd   )object_typer1   subtypecountr   _OBJECT_TYPEz%Cannot access _OBJECT_HEADER Name at #x)rJ   rH   rj   rk   rl   r   rm   rK   rX   get_type	enumeraterN   rM   r   rY   NameStringInvalidAddressExceptionvolloglogLOGLEVEL_VVVvolr1   )r:   rF   rI   r   type_maprw   rx   
table_addrtrans_layerptrsiptrobjt	type_names                 r!   get_type_mapzHandles.get_type_map   s   2 $&nZ(/0GH>>,:c>RR	G!,,-?@@HJJ% 	G 	G 	G!,,-=>>FJJJ	G nZ0##C*$455 	O%%i00	  
 
  oo 	$ 	$FAs 1uu
((-- 9>1NB  !I,		5   

*PDHOPPP    $HQKKs%   A )A;:A;4AD88AE=<E=c                    	 |j                             |t          j        z   dz             j        }n# t
          j        $ r Y dS w xY w|j        |         j        d         }|	                    |t          j        z   dz   |||z             S )z,Find the ObHeaderCookie value (if it exists)ObHeaderCookieNrd   zunsigned intrE   )
symbol_spacerk   r   rY   rl   r   rm   rJ   rH   rX   )r:   rF   rI   r   r1   rw   s         r!   find_cookiezHandles.find_cookie   s    	)44y~-0@@  F % 	 	 	44	 nZ(/0GH~~9>)N:<  
 
 	
s   /2 AAr   c              #     K   | j         j        | j        d                  }|j        }| j         j        |         j        d         }| j                             |j        ||          }|dk    r |                    d          }d|j        z  }	n|                    d          }d|j        z  }	| j         j        |         	                    |          sdS |
                    d	||t          |	          d
          }
| j         j        |         }||j        z  }|
D ]}|dk    r'|                     ||dz
  |          D ]}|V  |dz  }/d}||	z  |z  }|j        j        |z
  |j        |z  z  |z   }|                     ||          }|o	 |j        dk    r|V  # t$          $ r |j        j        r|V  Y t*          j        $ r Y w xY wdS )zParse a process' handle table and yield valid handle table entries,
        going as deep into the table "levels" as necessary.r%   rd   re   r   r   i   _HANDLE_TABLE_ENTRYNr   T)r   r1   r   r   absoluter      )rF   rG   rH   rI   rJ   rj   rR   r   r|   rK   rX   r8   maximum_address_make_handle_arrayr   r1   rb   	TypeIndexrP   Typer   r   r   )r   r1   leveldepthr%   r^   rw   rx   r   r   tablelayer_objectmasked_offsetentryxhandle_multiplierhandle_level_baser]   items                      r!   r   zHandles._make_handle_array  sA      %dk(&;<#l!'*12IJ<&&$ ' 
 
 199''	22GW\)EE''(=>>GW\)E|"7+44V<< 	4e**   
 
 |*73!== 	 	Eqyy00	5II  AGGGG
$%!$)EM4E$E! Y%5|&779% &
 ~~e\::<~,,"


% # # #y~ #"


!9   H3	 	s   FG3GGc              #      K   	 |j         | j         z  }|j         | j        z  }n;# t          j        $ r) t                              t          j        d           Y d S w xY w|                     ||          D ]}|V  d S )NzDHandle table parsing was aborted due to an invalid address exception)		TableCoder   r   r   r   r   r   r   r   )r   handle_tabler   table_levelsr\   s        r!   handleszHandles.handlesQ  s      	$.$2B1BBI'1D4DDLL1 	 	 	JJ&V   44	 #'"9"9)\"R"R 	% 	%$$$$$	% 	%s   $ 4AAc              #     K   | j         j        | j        d                  }|                     | j         |j        |j                  }|                     | j         |j        |j                  }|D ]h}	 |j        }nH# t          j	        $ r6 t                              t          j        d|j        j        d           Y Pw xY wt!          j        |j                  }|                     |          D ]}	 |                    ||          }	|	|	dk    r/|j                            d          }
|
                                }n|	dk    r>|j                            d          }
t!          j        |
j                   d	|
j         }n|	d
k    r7|j                            d          }
d|
j        j         d	|
j        j         }nf|	dk    r/|j                            d          }
|
                                }n1	 |j        j        j        }n# t@          t          j	        f$ r d}Y nw xY wnI# t          j	        $ r7 t                              t          j        d|j        j        d           Y w xY wd|j        |tC          j"        |j        j        j                  tC          j"        |j#                  |	tC          j"        |j$                  |ffV  jd S )Nr%   )rF   rI   r   z&Cannot access _EPROCESS.ObjectType at r   File_FILE_OBJECTProcess	_EPROCESSz Pid Thread_ETHREADzTid Key_CM_KEY_BODY z Cannot access _OBJECT_HEADER at r   )%rF   rG   rH   r   rI   rR   r   ObjectTabler   r   r   r   r   r   r   r1   r   array_to_stringImageFileNamer   get_object_typeBodyrM   file_name_with_deviceUniqueProcessIdCidUniqueThreadUniqueProcessget_full_key_nameNameInfor   r   
ValueErrorr   Hexr[   rO   )r   procsr%   r   cookieprocobject_tableprocess_namer   obj_typer   obj_names               r!   
_generatorzHandles._generator_  s5     %dk(&;<$$L(1 % 
 
 !!L(1 " 
 
  7	 7	D#/5   

*QTX_QQQ    #243EFFLl33 + +$44XvFFH' 6))$z~>>#'#=#=#?#?!Y..$z{;;&-&=d>P&Q&Q#n#nX\Xl#n#n!X--$zz::W48#8WWtx?UWW ! "U**$z~>>#'#9#9#;#;*',~':'AHH *J,NO * * *')HHH* "9   JJ!.P59;KPPP   H ,$$()>??$():;; $()<==     A+7	 7	sQ   4A<<AC C6H,C+H,;HH,H(%H,'H((H,,AI21I2c                    t           j                            | j                            dd                     }| j        j        | j        d                  }| j        d         rgt          j        	                    | j        |j
        |j        t          j                            | j        |j
        | j        d                             }n2t           j                            | j        |j
        |j        |          }t          j        dt           fdt"          fdt$          j        fd	t$          j        fd
t"          fdt$          j        fdt"          fg|                     |                    S )Nr.   r%   r1   )filter_func)rF   rI   r   r   PIDr   Offsetr[   r   rO   r   )r   )r   r4   create_pid_filterrH   getrF   rG   r   r6   scan_processesrI   rR   create_offset_filterlist_processesr   TreeGridr8   strr   r   r   )r   r   r%   r   s       r!   runzHandles.run  sD   m55dkooeT6R6RSS%dk(&;<;x  	M00!("M>>L%K) 	 1 	 	EE M00!,#5'	 1  E !C <+, 01 ,"23 OO%O((
 
 	
r"   )r   )__name__
__module____qualname____doc___required_framework_version_versionr   classmethodr   r	   configurationRequirementInterfacer;   r@   rb   rT   rF   ContextInterfacer   r   r8   r   r   objectsObjectInterfacer   r   r   r   r   __classcell__)r    s   @r!   r   r      s       %%"+H     
j&>&S!T 
 
 
 [
6  8 8 8t+ + +Z B#4B B 	B
 
c3hB B B [BH 
#4
 
 	

 
*$4	5
 
 
 [
,< < < <|% % %F F FP"
 "
 "
 "
 "
 "
 "
r"   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerr   r   rD   rU   ImportErrorpluginsPluginInterfacer   r=   r"   r!   <module>r      s5  
  ' ' ' ' ' ' ' ' ' ' W W W W W W W W W W W W W W < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 6 6 6 6 6 6 6 6		8	$	$OOOLL   LLLq
 q
 q
 q
 q
j 0 q
 q
 q
 q
 q
s   A AA