
    [
#g/F                         d dl Z d dlmZmZmZ d dlmZmZmZm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZ  e j(                  e      Z	 d dlZdZ G d
 de	j4                  j6                        Zy# e$ r d	ZY )w xY w)    N)ListOptionalDict)	constants
exceptions	renderers
interfacessymbols)requirements)utility)format_hints)pslistpsscanTFc                   f    e Zd ZdZdZdZ fdZedee	j                  j                     fd       Zd Zd Zd	 Zed
e	j                   j"                  dededeeef   fd       Zed
e	j                   j"                  dededee	j.                  j0                     fd       ZddZd Zd Zd Z xZS )HandleszLists process open handles.   r   r   )   r   r   c                 \    t        |   |i | d | _        d | _        d | _        d| _        y )N   )super__init__
_sar_value	_type_map_cookie_level_mask)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/handles.pyr   zHandles.__init__   s2    $)&)    returnc           	      2   t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      t        j                  dt        dd      t        j                  ddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r(   pluginversionr   )r   r   r   )r(   	componentr,   pidz9Process IDs to include (all other processes are excluded)T)r(   element_typer)   optionaloffsetz,Process offset in the physical address space)r(   r)   r0   )r   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   PsScanListRequirementintIntRequirement)clss    r!   get_requirementszHandles.get_requirements%   s     **,()4
 **fmmY ++	 (( W	 ''J%
 	
r"   c                     |dz  }||z	  }|S )zWindows encodes pointers to objects and decodes them on the fly
        before using them.

        This function mimics the decoding routine so we can generate the
        proper pointer values as well.
        l     )r   valuemagics      r!   _decode_pointerzHandles._decode_pointerA   s     ** r"   c                    | j                   j                  | j                  d      }|j                  }	 | j                   j                  |   j                  |j                        sy|j                  j                  d      }|j                         j                  d      }|j                  |_	        ||_        |S # t        $ r t        j                  | j                   |j                        }|rg|j                  dk(  rY y| j                         }|'t         rt        d      t#        j$                  dd      | j'                  |j                  |      }	n |j(                  dk(  rY y|j(                  d	z  }	| j                   j+                  |j                  t,        j.                  z   dz   ||	
      }|j0                  |_	        Y w xY w)zGiven  a handle table entry (_HANDLE_TABLE_ENTRY) structure from a
        process' handle table, determine where the corresponding object's
        _OBJECT_HEADER can be found.r%   N_EX_FAST_REF_OBJECT_HEADERr   z?Unable to find the SAR value for decoding handle table pointerscapstonezJRequires capstone to find the SAR value for decoding handle table pointersir1   )contextmodulesconfig
layer_namelayersis_validObjectcastdereferenceGrantedAccessAttributeErrorr
   symbol_table_is_64bitsymbol_table_nameLowValuefind_sar_valuehas_capstoner   MissingModuleExceptionr@   	InfoTableobjectr   BANGGrantedAccessBitsHandleValue)
r   handle_table_entryhandle_valuer%   virtualfast_refobject_headeris_64bitr?   r1   s
             r!   	_get_itemzHandles._get_itemP   s   
 %%dkk(&;<##,	O<<&&w/889K9R9RS)0055nEH$002778HIM*<*J*JM'P %1!Q  %	O44f66H %..!3++- =#,]  )??&h 
 --.@.I.I5Q%//14+55: !LL//((9>>9<LL 0 M
 +=*N*NM'K%	Os'   2B; 'AB; ;AG	A%G	)AG	G	c                    d}| j                   t        st        j                  d       y| j                  j
                  | j                  d      }|j                  }| j                  j                  |   j                  d   }| j                  j                  |j                  ||      }	 |j                  d      j                  }	 ||z   }d	}t        j                  d
t        |              | j                  j                  j!                  |||      }	t'        j(                  t&        j*                  t&        j,                        }
d}|
j/                  |	||z         D ]  \  }}}}|dz  }|j1                  d      st3        |j5                  d      d   j7                         d      | _         t        j                  dt        |       dt        | j                                  n | j                   +t        j%                  d| dt        |              || _         | j                   S # t        j                  $ r t        j                  d       Y yw xY w# t        j"                  $ rO t        j%                  dt               dt               dt        |              || _         | j                   cY S w xY w)zLocate ObpCaptureHandleInformationEx if it exists in the sample.

        Once found, parse it for the SAR value that we need to decode
        pointers in the _HANDLE_TABLE_ENTRY which allows us to find the
        associated _OBJECT_HEADER.
           NzYcapstone module is missing, unable to create disassembly of ObpCaptureHandleInformationExr%   kernel_virtual_offsetrI   r1   ObpCaptureHandleInformationExz5Unable to locate ObpCaptureHandleInformationEx symboli   z0ObpCaptureHandleInformationEx symbol located at zFailed to read z bytes at symbol z@. Unable to decode SAR value. Failing back to a common value of r   r   sar,zSAR located at z with value of z,Failed to to locate SAR value having parsed z1 instructions, failing back to a common value of )r   rU   vollogdebugrF   rG   rH   rI   rJ   modulerR   
get_symboladdressr   SymbolErrorhexreadInvalidAddressExceptionwarningrD   CsCS_ARCH_X86
CS_MODE_64disasm_lite
startswithr8   splitstrip)r   DEFAULT_SAR_VALUEr%   virtual_layer_namekvontkrnlmp	func_addrfunc_addr_to_readnum_bytes_to_readdatamdinstruction_countrn   sizemnemonicop_strs                   r!   rT   zHandles.find_sar_value   s    !??"o \\))$++h*?@F!'!2!2,,%%&89@@'C ||**((5GPS + H$//0OPXX	
'$')O!$)!FsK\G]F^_ ||**//&(9;L X1183F3FGB !35>>cIo4/x "Q&!&&u- '*&,,s*;A*>*D*D*F&KDOLL)#g,s4??G[F\] 4 &BCTBU  VG  HK  L]  H^  G_  ` #4W )) TU 55 '%c*;&<%==NsSdOeNf  gg  hk  l}  h~  g  @ #4&'s&   -H. 	AI .(IIAJ>=J>rF   rI   symbol_tablec                 $   i }|j                   |   j                  d   }|j                  |||      }	 |j                  d      j                  }|j                   |   }|j                  ||z         s|S |j                  d||j                  d      d      }	t        |	      D ]a  \  }
}|
d	kD  r|d	k(  r |S 	 |j                         j                  |t        j                  z   d
z         }|j                  j                   }|||
<   c |S # t
        j                  $ r |j                  d      j                  }Y w xY w# t
        j"                  $ r? t$        j'                  t        j(                  dj*                  j,                  d       Y w xY w)a  List the executive object types (_OBJECT_TYPE) using the
        ObTypeIndexTable or ObpObjectTypes symbol (differs per OS). This method
        will be necessary for determining what type of object we have given an
        object header.

        Note:
            The object type index map was hard coded into profiles in previous versions of volatility.
            It is now generated dynamically.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A mapping of type indices to type names
        re   rf   ObTypeIndexTableObpObjectTypesarraypointerd   )object_typer1   subtypecountr   _OBJECT_TYPEz%Cannot access _OBJECT_HEADER Name at #x)rJ   rH   rl   rm   rn   r   ro   rK   rX   get_type	enumeraterN   rM   r   rY   NameStringrr   rj   logLOGLEVEL_VVVvolr1   )r:   rF   rI   r   type_mapr}   r~   
table_addrtrans_layerptrsiptrobjt	type_names                 r!   get_type_mapzHandles.get_type_map   s   2 $&nnZ(//0GH>>,:c>R	G!,,-?@HHJ nnZ0##C*$45O%%i0	  
  oFAs 1u  
(-- 9>>1NB !II,,	 $HQK% &( G %% 	G!,,-=>FFJ	G4 55 

**;DHHOOB;OP s%   D	 7A	D=	.D:9D:=AFFc                 6   	 |j                   j                  |t        j                  z   dz         j                  }|j                  |   j                  d   }|j                  |t        j                  z   dz   |||z         S # t
        j                  $ r Y yw xY w)z,Find the ObHeaderCookie value (if it exists)ObHeaderCookieNre   zunsigned intrE   )
symbol_spacerm   r   rY   rn   r   ro   rJ   rH   rX   )r:   rF   rI   r   r1   r}   s         r!   find_cookiezHandles.find_cookie  s    	))44y~~-0@@g  nnZ(//0GH~~9>>)N:<  
 	
	 %% 		s   9B BBc              #     K   | j                   j                  | j                  d      }|j                  }| j                   j                  |   j                  d   }| j                   j                  |j                  ||      }|dkD  r!|j                  d      }d|j                  z  }	n |j                  d      }d|j                  z  }	| j                   j                  |   j                  |      sy|j                  d	||t        |	      d
      }
| j                   j                  |   }||j                  z  }|
D ]  }|dkD  r%| j                  ||dz
  |      D ]  }|  |dz  }-d}||	z  |z  }|j                  j                  |z
  |j                  |z  z  |z   }| j!                  ||      }|x	 |j"                  dk7  r|  y# t$        $ r |j&                  j(                  r| Y t*        j,                  $ r Y w xY ww)zParse a process' handle table and yield valid handle table entries,
        going as deep into the table "levels" as necessary.r%   re   rf   r   r   i   _HANDLE_TABLE_ENTRYNr   T)r   r1   r   r   absoluter      )rF   rG   rH   rI   rJ   rl   rR   r   r   rK   rX   r8   maximum_address_make_handle_arrayr   r1   rb   	TypeIndexrP   Typer   r   rr   )r   r1   leveldepthr%   r^   r}   r~   r   r   tablelayer_objectmasked_offsetentryxhandle_multiplierhandle_level_baser]   items                      r!   r   zHandles._make_handle_array.  s     %%dkk(&;<##ll!!'*112IJ<<&&$$ ' 
 19''	2GW\\)E''(=>GW\\)E||""7+44V<e*   
 ||**73!=!==Eqy00	5IAG J
$%!$)EM4E$E! YY%%5||&779% &
 ~~e\:<~~,"
+ , & #yy~~"
!99 s6   F1H4G
H
#H-H/HHHHc              #   $  K   	 |j                   | j                   z  }|j                   | j                  z  }| j                  ||      D ]  }|  y # t        j                  $ r' t        j                  t        j                  d       Y y w xY ww)NzDHandle table parsing was aborted due to an invalid address exception)		TableCoder   r   rr   rj   r   r   r   r   )r   handle_tabler   table_levelsr\   s        r!   handleszHandles.handlesl  s     	$..$2B2B1BBI'11D4D4DDL #'"9"9)\"R$$ #S 11 	JJ&&V 	s'   B3A B7B
BBBc              #     K   | j                   j                  | j                  d      }| j                  | j                   |j                  |j
                        }| j                  | j                   |j                  |j
                        }|D ]  }	 |j                  }t!        j"                  |j$                        }| j'                  |      D ]  }	 |j)                  ||      }	|	|	dk(  r,|j*                  j-                  d      }
|
j/                         }n|	dk(  rJ|j*                  j-                  d      }
t!        j"                  |
j$                         d	|
j0                   }n|	d
k(  rL|j*                  j-                  d      }
d|
j2                  j4                   d	|
j2                  j6                   }nR|	dk(  r,|j*                  j-                  d      }
|
j9                         }n!	 |j:                  j<                  j>                  }d|j0                  |tC        jD                  |j*                  j                  j                        tC        jD                  |jF                        |	tC        jD                  |jH                        |ff   y # t        j                  $ r@ t        j                  t        j                  d|j                  j                  d       Y Yw xY w# t@        t        j                  f$ r d}Y w xY w# t        j                  $ r@ t        j                  t        j                  d|j                  j                  d       Y w xY ww)Nr%   )rF   rI   r   z&Cannot access _EPROCESS.ObjectType at r   File_FILE_OBJECTProcess	_EPROCESSz Pid Thread_ETHREADzTid Key_CM_KEY_BODY z Cannot access _OBJECT_HEADER at r   )%rF   rG   rH   r   rI   rR   r   ObjectTabler   rr   rj   r   r   r   r   r1   r   array_to_stringImageFileNamer   get_object_typeBodyrM   file_name_with_deviceUniqueProcessIdCidUniqueThreadUniqueProcessget_full_key_nameNameInfor   r   
ValueErrorr   Hexr[   rO   )r   procsr%   r   cookieprocobject_tableprocess_namer   obj_typer   obj_names               r!   
_generatorzHandles._generatorz  s    %%dkk(&;<$$LL((11 % 
 !!LL((11 " 
 D#// #2243E3EFLl3$44XvFH' 6)$zz~>#'#=#=#?!Y.$zz{;&-&=&=d>P>P&Q%RRWX\XlXlWm#n!X-$zzz:"488#8#8"9txx?U?U>VW ! "U*$zz~>#'#9#9#;*',~~':':'A'AH ,,$$(()>)>?$(():):; $(()<)<=  A 4  55 

**<TXX__R<PQ > !+J,N,NO *')H* "99 JJ!..:599;K;KB:OP s|   BM#J 4M#L)M#*DL- K,B	M#AK)%M#(K))M#,L
L	L

LAM M#M  M#c                 N   t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }| j                  d   rt        j                  j                  | j
                  |j                  |j                  t        j                  j                  | j
                  |j                  | j                  d               }nAt         j                  j                  | j
                  |j                  |j                  |      }t        j                  dt         fdt"        fdt$        j&                  fd	t$        j&                  fd
t"        fdt$        j&                  fdt"        fg| j)                  |            S )Nr.   r%   r1   )filter_func)rF   rI   r   r   PIDr   Offsetr[   r   rO   r   )r   )r   r4   create_pid_filterrH   getrF   rG   r   r6   scan_processesrI   rR   create_offset_filterlist_processesr   TreeGridr8   strr   r   r   )r   r   r%   r   s       r!   runzHandles.run  sV   mm55dkkooeT6RS%%dkk(&;<;;x MM00!!(("MM>>LL%%KK)	 1 	E MM00!,,#55'	 1 E !!C <++, 0 01 ,"2"23 OO%O(
 	
r"   )r   )__name__
__module____qualname____doc___required_framework_version_versionr   classmethodr   r	   configurationRequirementInterfacer;   r@   rb   rT   rF   ContextInterfacer   r   r8   r   r   objectsObjectInterfacer   r   r   r   r   __classcell__)r    s   @r!   r   r      s   %"+H 
j&>&>&S&S!T 
 
68tFP B##44B B 	B
 
c3hB BH 
##44
 
 	

 
*$$44	5
 
,<|%FP"
r"   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerr   rj   rD   rU   ImportErrorpluginsPluginInterfacer   r=   r"   r!   <module>r     sq   
  ' ' W W < 1 8 6			8	$L
L
j  00 L
	  Ls   
A0 0A:9A: