
    Xfq-                         d dl Z d dlZd dlmZmZmZ d dlmZmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ  e j        e          Z G d	 d
e	j        j                  ZdS )    N)IteratorListTuple)	constants
exceptions
interfaces	rendererssymbols)requirements)scanners)format_hints)intermed)mbrc                       e Zd ZdZdZdZedeej	        j
                 fd            Zededefd            Zdee         fdZdej        fd	Zd
S )MBRScanz9Scans for and parses potential Master Boot Records (MBRs))   r      )r   r   r   returnc                 d    t          j        ddddg          t          j        dddd	
          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesfullzIt analyzes and provides all the information in the partition entry and bootcode hexdump. (It returns a lot of information, so we recommend you render it in CSV.)FT)r   r   defaultoptional)r   ModuleRequirementBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/mbrscan.pyget_requirementszMBRScan.get_requirements   sW     *,()4  
 + A	  
 	
    datac                 N    t          j        |                                          S )N)hashlibmd5	hexdigest)r!   r%   s     r"   get_hashzMBRScan.get_hash*   s    {4  **,,,r$   c              #   4  K   | j         j        | j        d                  }| j         j        |j                 j                            dd           }| j         j        |         }t          j        | j         |j                  sdnd}t          j
                            | j         | j        ddt          j        t          j        d          }|t           j        z   d	z   }d
}d}d}	|                    | j         t'          j        |g                    D ]\  }
}	 |
|t+          |          z
  z
  }| j                             |||j                  }|                    ||d          }|d |	         }d }|r&|                    d          t+          |          k    }|s|j        |j        |j        |j        g}| j                            dd          sdt=          j        |
          |                                 | !                    |          | !                    |          tE          j#                    tE          j#                    tE          j#                    tE          j#                    tH          j"        %                    |d|          f	fV  nqdt=          j        |
          |                                 | !                    |          | !                    |          tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tE          j#                    tH          j"        %                    |d|          t=          j&        |          ffV  tO          |d          D ]l\  }}| j                            dd          sdt=          j        |
          |                                 | !                    |          | !                    |          ||(                                |)                                t=          j        |*                                          tE          j#                    f	fV  dt=          j        |
          |                                 | !                    |          | !                    |          ||(                                t=          j        |+                                          |)                                t=          j        |j,                  t=          j        |-                                          |.                                |/                                |0                                |1                                |2                                |3                                t=          j        |*                                          tE          j#                    tE          j#                    ffV  nn<th          5                    t           j6        dt=          j        |
                      # tn          j8        $ rE}th          5                    t           j6        dts          |j:                              Y d }~d }~ww xY wd S )Nr   memory_layerintelintel64windowsr   )PARTITION_TABLEPARTITION_ENTRY)contextconfig_pathsub_pathfilenameclass_typesr0   s   Ui   i  )patterns)r2   scanner)offset
layer_nameT)pad    r   r   r   )startz'Not a valid MBR: Data all zeroed out : z+Invalid address identified in guessed MBR: );r2   modulesconfiglayersr:   getr
   symbol_table_is_64bitsymbol_table_namer   IntermediateSymbolTablecreater3   r   r0   r1   r   BANGscanr   MultiStringScannerlenobjectr   readcount
FirstEntrySecondEntry
ThirdEntryFourthEntryr   Hexget_disk_signaturer*   r	   NotApplicableValuer   DisassemblyHexBytes	enumerateis_bootableget_partition_typeget_size_in_sectorsget_bootable_flagPartitionTypeget_starting_lbaget_starting_cylinderget_starting_chsget_starting_sectorget_ending_cylinderget_ending_chsget_ending_sectorvolloglogLOGLEVEL_VVVVr   PagedInvalidAddressExceptionhexinvalid_address)selfr   physical_layer_namelayerarchitecturesymbol_tablepartition_table_objectmbr_signature
mbr_lengthbootcode_lengthr9   _valuembr_start_offsetpartition_tablefull_mbrbootcode	all_zerospartition_entriespartition_indexpartition_entry_objectexcps                        r"   
_generatorzMBRScan._generator.   s     %dk(&;<"l1&2CDKOOD
 

 #$78 0v?WXXGG 	  7>>L(#&#6#&#6  ? 	
 	
 ".	!>AR!R $
 $jjL/-III ) 
 
 K	 K	NFFG#)Z#m:L:L-L#M "&,"5"5*+$z #6 # # !::&6
:MM#$4_$45 	 I (w 7 73x== HI  o'2'3'2'3	)%  ;??6488 + , 0 8 8 / B B D D $h 7 7 $h 7 7 ) < > > ) < > > ) < > > ) < > > * 4 @ @$,a!" !"    $  , 0 8 8 / B B D D $h 7 7 $h 7 7 ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > ) < > > * 4 @ @$,a!" !" !- 5h ? ?+   6 DM)D D D 4 4?)?  ${vt<< 1 !$0$4V$<$<$3$F$F$H$H$(MM($;$;$(MM($;$;$3$:$F$F$H$H$:$M$M$O$O$0$4(>(R(R(T(T%& %& %.$@$B$B!"#    $ !"$0$4V$<$<$3$F$F$H$H$(MM($;$;$(MM($;$;$3$:$F$F$H$H$0$4(>(P(P(R(R%& %& %;$M$M$O$O$0$4(>(L%& %& %1$4(>(O(O(Q(Q%& %& %;$P$P$R$R$:$K$K$M$M$:$N$N$P$P$:$N$N$P$P$:$I$I$K$K$:$L$L$N$N$0$4(>(R(R(T(T%& %& %.$@$B$B$-$@$B$B7!"#    +4l JJ!/\,BRSYBZBZ\\   u4x :   

+]#dFZB[B[]]   MK	 K	s   V$[\:\\c                    | j                             dd          st          j        dt          j        fdt          fdt          fdt          fdt          fdt          fd	t          fd
t          j        fdt          j        j
        fg	|                                           S t          j        dt          j        fdt          fdt          fdt          fdt          fdt          fdt          j        fd	t          fdt          j        fdt          j        fdt          fdt          fdt          fdt          fdt          fdt          fd
t          j        fdt          j        j
        fdt          j        fg|                                           S )Nr   Tz Potential MBR at Physical OffsetzDisk SignaturezBootcode MD5zFull MBR MD5PartitionIndexBootabler[   SectorInSizeDisasmBootFlagPartitionTypeRawStartingLBAStartingCylinderStartingCHSStartingSectorEndingCylinder	EndingCHSEndingSectorBootcode)r?   rA   r	   TreeGridr   rQ   strintboolr   rT   r|   rU   )ri   s    r"   runzMBRScan.run   sr   {vt,, '	%79IJ%s+#S)#S)%s+&$c*#\%56z3?@
 !!   %79IJ%s+#S)#S)%s+&!12$c*')9:"L$45'-"C(%s+%s+ #&#S)#\%56z3?@!67'* !!-  r$   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer#   bytesr   r*   r   r   r|   r	   r   r    r$   r"   r   r      s        CC"+H
j&>&S!T 
 
 
 [
 -E -c - - - [-mHUO m m m m^(Y' ( ( ( ( ( (r$   r   )loggingr'   typingr   r   r   volatility3.frameworkr   r   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr   rc   pluginsPluginInterfacer   r   r$   r"   <module>r      s  
   ( ( ( ( ( ( ( ( ( ( W W W W W W W W W W W W W W < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 2 2 2 2 2 2 @ @ @ @ @ @		8	$	$q q q q qj 0 q q q q qr$   