
    vfy$                         d dl Z d dlmZmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ  e j$                  e      Z G d	 d
ej*                  j,                        Zy)    N)IterableTuple)
interfacessymbols
exceptions)	renderers)requirements)utility)format_hints)pslistvadinfoc                       e Zd ZdZdZed        Zed        Zedej                  j                  dededej                  j                  d	eeej                  j                  ef      f
d
       Zd Zd Zy)MalfindzCLists process memory ranges that potentially contain injected code.)      r   c           	      4   t        j                  ddddg      t        j                  dt        dd	      t        j                  d
ddd      t        j
                  dt        j                  d      t        j
                  dt        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optionaldumpzExtract injected VADsF)r   r   defaultr   r   )r   r   r   )r   	componentversionr   )
r	   ModuleRequirementListRequirementintBooleanRequirementVersionRequirementr   PsListr   VadInfo)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/malfind.pyget_requirementszMalfind.get_requirements   s     **,()4
 (( W	 ++3	 ++	 ++'//9+
 	
    c                     d}d|z  }d}|j                         }||k  rF|j                         |z   }|j                  ||      r|j                  ||      |k7  ry||z  }||k  rFy)a  Check if a VAD region is either entirely unavailable due to paging,
        entirely consisting of zeros, or a combination of the two. This helps
        ignore false positives whose VAD flags match task._injection_filter
        requirements but there's no data and thus not worth reporting it.

        Args:
            proc_layer: the process layer
            vad: the MMVAD structure to test

        Returns:
            A boolean indicating whether a vad is empty or not
        i       r   FT)get_size	get_startis_validread)r'   
proc_layervad
CHUNK_SIZEall_zero_pageoffset
vad_length	next_addrs           r(   is_vad_emptyzMalfind.is_vad_empty3   sz     
*,\\^
z!&0I##Iz:OOIz:mKj F z! r*   contextkernel_layer_namesymbol_tableprocreturnc              #     K   d}	 |j                   }|j                         }|j                  |   }|j                         j                         D ]  }	|	j                  t        j                  j                  |||      t        j                         }
d|
v xr d|
v }|sO|	j#                         dk(  r|	j%                         dk(  s|	j#                         dk(  s|
d	k7  s| j'                  ||	      r|j)                  |	j+                         d
d      }|	|f  y# t        j                  $ rD}t        j                  dj                  ||j                  |j                               Y d}~yd}~ww xY ww)a  Generate memory regions for a process that may contain injected
        code.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            kernel_layer_name: The name of the kernel layer from which to read the VAD protections
            symbol_table: The name of the table containing the kernel symbols
            proc: an _EPROCESS instance

        Returns:
            An iterable of VAD instances and the first 64 bytes of data containing in that region
        Unknownz*Process {}: invalid address {} in layer {}NEXECUTEWRITE   VadSr   PAGE_EXECUTE_WRITECOPY@   T)pad)UniqueProcessIdadd_process_layerr   InvalidAddressExceptionvollogdebugformatinvalid_address
layer_namelayersget_vad_roottraverseget_protectionr   r&   protect_valueswinnt_protectionsget_private_memoryget_tagr8   r0   r.   )r'   r9   r:   r;   r<   proc_idproc_layer_nameexcpr1   r2   protection_string
write_execdatas                r(   list_injectionszMalfind.list_injectionsS   sg    ( 		**G"446O ^^O4
$$&//1 	 C # 2 2... ))	! #&77XGGX<XJ &&(A-#++-62I&&(A-%)AA##J4!s}}E4i+	  11 	LL<CCT114??
 	s:   E6D B5E6E6>E6E3/:E.)E6.E33E6c              #     K   | j                   j                  | j                  d      }ddddd}t        j                  | j                   |j
                         }|D ]#  }t        j                  |j                        }| j                  | j                   |j                  |j
                  |      D ]  \  }}t        j                         }	|dd |v r||dd    }	|s|j                         rd}
nd	}
t        j                  j                  ||j!                         |
      }d
}| j                  d   rUd}	 t"        j$                  j'                  | j                   ||| j(                        }|j+                          |j,                  }d|j:                  |t=        j>                  |j!                               t=        j>                  |jA                               |jC                         |jE                  t"        j$                  jG                  | j                   |j                  |j
                        t"        jH                        |jK                         |jM                         ||	t=        jN                  |      |ff  & y # t.        j0                  t2        f$ rI}t4        j7                  dj9                  |j:                  |j!                         |             Y d }~Zd }~ww xY ww)Nr   z	MZ headerz	PE headerzFunction prologue)s   MZs   Us   UHs   Ur   r   intelintel64Disabledr   zError outputting to filez*Unable to dump PE with pid {0}.{1:#x}: {2})(r9   modulesconfigr   symbol_table_is_64bitsymbol_table_namer
   array_to_stringImageFileNamer]   rN   r   NotApplicableValueget_is_wow64r   Disassemblyr.   r   r&   vad_dumpopenclosepreferred_filenamer   rI   OverflowErrorrJ   rK   rL   rG   r   Hexget_endrV   rR   rS   rT   get_commit_chargerU   HexBytes)selfprocsr   refined_criteriais_32bit_archr<   process_namer2   r\   notesarchitecturedisasmfile_outputfile_handlerY   s                  r(   
_generatorzMalfind._generator   s    %%dkk(&;< $,,	
 $99LL&22
 
  =	D"2243E3EFL!11f//1I1I4 9	T "446!9 00,T!AY7E !D$5$5$7#*L#,L#--99#--/< );;v&"<K&-oo&>&> LL$TYY' $))+&1&D&D ,,$$((9$((7**#OO:: $ & 1 1 & 8 8
 $55 --/..0#$--d3' E9	=	> '>>N HOO $ 4 4cmmot s2   D3K*6AJC=K*K'>K"K*"K''K*c                    t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }t        j                  dt        fdt        fdt        j                  fdt        j                  fdt        fdt        fd	t        fd
t        fdt        fdt        fdt        j                  fdt        j                  j                  fg| j!                  t         j                  j#                  | j
                  |j$                  |j&                  |                  S )Nr   r   PIDProcessz	Start VPNzEnd VPNTag
ProtectionCommitChargePrivateMemoryzFile outputNotesHexdumpDisasm)r9   rN   r;   filter_func)r   r%   create_pid_filterrc   getr9   rb   r   TreeGridr"   strr   rp   rs   r   rj   r~   list_processesrN   re   )rt   r   r   s      r(   runzMalfind.run   s   mm55dkkooeT6RS%%dkk(&;<!!C l../L,,-s#% #&$#L112://;;< OO,, LL%00!'!9!9 +	 - 
 	
r*   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr)   r8   r   r9   ContextInterfacer   objectsObjectInterfacer   r   bytesr]   r~   r    r*   r(   r   r      s    M"+
 
8  > 6 ##446  6  	6 
   006  
%
**::EAB	C6  6 pM^
r*   r   )loggingtypingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   	getLoggerr   rJ   pluginsPluginInterfacer   r   r*   r(   <module>r      sN     " A A + < 1 8 7			8	$e
j  00 e
r*   