
    *1fu$                         d dl Z d dlmZmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ  e j        e          Z G d	 d
ej        j                  ZdS )    N)IterableTuple)
interfacessymbols
exceptions)	renderers)requirements)utility)format_hints)pslistvadinfoc                       e Zd ZdZdZed             Zed             Zedej	        j
        dededej        j        d	eeej        j        ef                  f
d
            Zd Zd ZdS )MalfindzCLists process memory ranges that potentially contain injected code.)      r   c           	         t          j        ddddg          t          j        dt          dd	          t          j        d
ddd          t          j        dt          j        d          t          j        dt          j	        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optionaldumpzExtract injected VADsF)r   r   defaultr   r   )r   r   r   )r   	componentversionr   )
r	   ModuleRequirementListRequirementintBooleanRequirementVersionRequirementr   PsListr   VadInfo)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/malfind.pyget_requirementszMalfind.get_requirements   s     *,()4  
 ( W	   +3	   +	   +'/9  +
 	
    c                     d}d|z  }d}|                                 }||k     rT|                                |z   }|                    ||          r|                    ||          |k    rdS ||z  }||k     TdS )a  Check if a VAD region is either entirely unavailable due to paging,
        entirely consisting of zeros, or a combination of the two. This helps
        ignore false positives whose VAD flags match task._injection_filter
        requirements but there's no data and thus not worth reporting it.

        Args:
            proc_layer: the process layer
            vad: the MMVAD structure to test

        Returns:
            A boolean indicating whether a vad is empty or not
        i       r   FT)get_size	get_startis_validread)r'   
proc_layervad
CHUNK_SIZEall_zero_pageoffset
vad_length	next_addrs           r(   is_vad_emptyzMalfind.is_vad_empty3   s     
*,\\^^
z!!&0I##Iz::OOIz::mKKuj F z!! tr*   contextkernel_layer_namesymbol_tableprocreturnc              #     K   d}	 |j         }|                                }nV# t          j        $ rD}t                              d                    ||j        |j                             Y d}~dS d}~ww xY w|j	        |         }|
                                                                D ]}	|	                    t          j                            |||          t          j                  }
d|
v od|
v }|sL|	                                dk    r|	                                dk    s|	                                dk    rM|
d	k    rG|                     ||	          r|                    |	                                d
d          }|	|fV  dS )a  Generate memory regions for a process that may contain injected
        code.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            kernel_layer_name: The name of the kernel layer from which to read the VAD protections
            symbol_table: The name of the table containing the kernel symbols
            proc: an _EPROCESS instance

        Returns:
            An iterable of VAD instances and the first 64 bytes of data containing in that region
        Unknownz*Process {}: invalid address {} in layer {}NEXECUTEWRITE   VadSr   PAGE_EXECUTE_WRITECOPY@   T)pad)UniqueProcessIdadd_process_layerr   InvalidAddressExceptionvollogdebugformatinvalid_address
layer_namelayersget_vad_roottraverseget_protectionr   r&   protect_valueswinnt_protectionsget_private_memoryget_tagr8   r0   r.   )r'   r9   r:   r;   r<   proc_idproc_layer_nameexcpr1   r2   protection_string
write_execdatas                r(   list_injectionszMalfind.list_injectionsS   s     ( 		*G"4466OO1 	 	 	LL<CCT14?   
 44444	 ^O4
$$&&//11 	  	 C # 2 2...  )	! ! #&77XGGX<XJ  &&((A--#++--62I2I&&((A--%)AAA##J44 !s}}EE4i+	  	 s   " A59A00A5c              #     K   | j         j        | j        d                  }ddddd}t          j        | j         |j                   }|D ]~}t          j                    }t          j	        |j
                  }|                     | j         |j        |j        |          D ]&\  }}	|	dd         |v r||	dd                  }|s|                                rd}
nd	}
t          j                            |	|                                |
          }d
}| j        d         rd}	 t"          j                            | j         ||| j                  }|                                 |j        }ni# t.          j        t2          f$ rP}t4                              d                    |j        |                                |                     Y d }~nd }~ww xY wd|j        |t=          j        |                                          t=          j        |                                           |!                                |"                    t"          j        #                    | j         |j        |j                  t"          j$                  |%                                |&                                ||t=          j'        |	          |ffV  (d S )Nr   z	MZ headerz	PE headerzFunction prologue)s   MZs   Us   UHs   Ur   r   intelintel64Disabledr   zError outputting to filez*Unable to dump PE with pid {0}.{1:#x}: {2})(r9   modulesconfigr   symbol_table_is_64bitsymbol_table_namer   NotApplicableValuer
   array_to_stringImageFileNamer]   rN   get_is_wow64r   Disassemblyr.   r   r&   vad_dumpopenclosepreferred_filenamer   rI   OverflowErrorrJ   rK   rL   rG   r   Hexget_endrV   rR   rS   rT   get_commit_chargerU   HexBytes)selfprocsr   refined_criteriais_32bit_archr<   notesprocess_namer2   r\   architecturedisasmfile_outputfile_handlerY   s                  r(   
_generatorzMalfind._generator   s      %dk(&;< $,,	
 
 $9L&2
 
 
  =	 =	D022E"243EFFL!11f/1I4  8 8	T !9 000,T!A#Y7E ! -D$5$5$7$7 -#*LL#,L#-99#--//<  );v& "<K&-o&>&> L$TY' ' $))+++&1&D&>N   HOO $ 4cmmoot         ,$$(99$(77**#O:: $ & 1 & 8 
 $5  --//..00#$-d33'    C8=	 =	s   !AE))G?AG

Gc                 N   t           j                            | j                            dd                     }| j        j        | j        d                  }t          j        dt          fdt          fdt          j        fdt          j        fdt          fdt          fd	t          fd
t          fdt          fdt          fdt          j        fdt          j        j        fg|                     t           j                            | j        |j        |j        |                              S )Nr   r   PIDProcessz	Start VPNzEnd VPNTag
ProtectionCommitChargePrivateMemoryzFile outputNotesHexdumpDisasm)r9   rN   r;   filter_func)r   r%   create_pid_filterrc   getr9   rb   r   TreeGridr"   strr   rp   rs   r   rj   r~   list_processesrN   re   )rt   r   r   s      r(   runzMalfind.run   s   m55dkooeT6R6RSS%dk(&;<!C l./L,-s#% #&$#L12:/;< OO,, L%0!'!9 +	 -   
 
 	
r*   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr)   r8   r   r9   ContextInterfacer   objectsObjectInterfacer   r   bytesr]   r~   r    r*   r(   r   r      s        MM"+
 
 [
8   [> 6 #46  6  	6 
  06  
%
*:EAB	C6  6  6  [6 pM M M^
 
 
 
 
r*   r   )loggingtypingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerr   rJ   pluginsPluginInterfacer   r   r*   r(   <module>r      s     " " " " " " " " A A A A A A A A A A + + + + + + < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 7 7 7 7 7 7 7 7		8	$	$e
 e
 e
 e
 e
j 0 e
 e
 e
 e
 e
r*   