
    Xfq-                         d dl Z d dlZd dlmZmZmZ d dlmZmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ  e j,                  e      Z G d	 d
e	j2                  j4                        Zy)    N)IteratorListTuple)	constants
exceptions
interfaces	rendererssymbols)requirements)scanners)format_hints)intermed)mbrc                       e Zd ZdZdZdZedeej                  j                     fd       Zededefd       Zdee   fdZdej&                  fd	Zy
)MBRScanz9Scans for and parses potential Master Boot Records (MBRs))   r      )r   r   r   returnc                 h    t        j                  ddddg      t        j                  dddd	
      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesfullzIt analyzes and provides all the information in the partition entry and bootcode hexdump. (It returns a lot of information, so we recommend you render it in CSV.)FT)r   r   defaultoptional)r   ModuleRequirementBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/mbrscan.pyget_requirementszMBRScan.get_requirements   sI     **,()4
 ++ A	
 	
    datac                 H    t        j                  |      j                         S )N)hashlibmd5	hexdigest)r!   r%   s     r"   get_hashzMBRScan.get_hash*   s    {{4 **,,r$   c              #   @  K   | j                   j                  | j                  d      }| j                   j                  |j                     j                  j                  dd       }| j                   j                  |   }t        j                  | j                   |j                        sdnd}t        j                  j                  | j                   | j                  ddt        j                  t        j                  d      }|t         j"                  z   d	z   }d
}d}d}	|j%                  | j                   t'        j(                  |g            D ]l  \  }
}	 |
|t+        |      z
  z
  }| j                   j-                  |||j.                        }|j1                  ||d      }|d |	 }d }|r|j3                  d      t+        |      k(  }|s|j4                  |j6                  |j8                  |j:                  g}| j                  j                  dd      sdt=        j>                  |
      |jA                         | jC                  |      | jC                  |      tE        jF                         tE        jF                         tE        jF                         tE        jF                         tH        jD                  jK                  |d|      f	f ntdt=        j>                  |
      |jA                         | jC                  |      | jC                  |      tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tE        jF                         tH        jD                  jK                  |d|      t=        jL                  |      ff tO        |d      D ],  \  }}| j                  j                  dd      sdt=        j>                  |
      |jA                         | jC                  |      | jC                  |      ||jQ                         |jS                         t=        j>                  |jU                               tE        jF                         f	f dt=        j>                  |
      |jA                         | jC                  |      | jC                  |      ||jQ                         t=        j>                  |jW                               |jS                         t=        j>                  |jX                        t=        j>                  |j[                               |j]                         |j_                         |ja                         |jc                         |je                         |jg                         t=        j>                  |jU                               tE        jF                         tE        jF                         ff / n<th        jk                  t         jl                  dt=        j>                  |
              mo y # tn        jp                  $ rE}th        jk                  t         jl                  dts        |jt                                Y d }~d }~ww xY ww)Nr   memory_layerintelintel64windowsr   )PARTITION_TABLEPARTITION_ENTRY)contextconfig_pathsub_pathfilenameclass_typesr0   s   Ui   i  )patterns)r2   scanner)offset
layer_nameT)pad    r   r   r   )startz'Not a valid MBR: Data all zeroed out : z+Invalid address identified in guessed MBR: );r2   modulesconfiglayersr:   getr
   symbol_table_is_64bitsymbol_table_namer   IntermediateSymbolTablecreater3   r   r0   r1   r   BANGscanr   MultiStringScannerlenobjectr   readcount
FirstEntrySecondEntry
ThirdEntryFourthEntryr   Hexget_disk_signaturer*   r	   NotApplicableValuer   DisassemblyHexBytes	enumerateis_bootableget_partition_typeget_size_in_sectorsget_bootable_flagPartitionTypeget_starting_lbaget_starting_cylinderget_starting_chsget_starting_sectorget_ending_cylinderget_ending_chsget_ending_sectorvolloglogLOGLEVEL_VVVVr   PagedInvalidAddressExceptionhexinvalid_address)selfr   physical_layer_namelayerarchitecturesymbol_tablepartition_table_objectmbr_signature
mbr_lengthbootcode_lengthr9   _valuembr_start_offsetpartition_tablefull_mbrbootcode	all_zerospartition_entriespartition_indexpartition_entry_objectexcps                        r"   
_generatorzMBRScan._generator.   s    %%dkk(&;<"ll11&2C2CDKKOOD

 ##$78 00v?W?WX  	  77>>LL((#&#6#6#&#6#6 ? 	
 ".	!>AR!R $
 $jjLL//-I ) 
 K	NFFG#)Z#m:L-L#M "&,,"5"5*+$zz #6 # !::&6
:M#$4_5 	 (w 73x= HI '22'33'22'33	)%  ;;??648 , 0 0 8 / B B D $h 7 $h 7 ) < < > ) < < > ) < < > ) < < > * 4 4 @ @$,a!" $  , 0 0 8 / B B D $h 7 $h 7 ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > ) < < > * 4 4 @ @$,a!" !- 5 5h ?+ 6 DM)D 4?)?  ${{vt< !$0$4$4V$<$3$F$F$H$(MM($;$(MM($;$3$:$F$F$H$:$M$M$O$0$4$4(>(R(R(T%& %.$@$@$B!"# $ !"$0$4$4V$<$3$F$F$H$(MM($;$(MM($;$3$:$F$F$H$0$4$4(>(P(P(R%& %;$M$M$O$0$4$4(>(L(L%& %1$4$4(>(O(O(Q%& %;$P$P$R$:$K$K$M$:$N$N$P$:$N$N$P$:$I$I$K$:$L$L$N$0$4$4(>(R(R(T%& %.$@$@$B$-$@$@$B7!"# +4l JJ!//A,BRBRSYBZA[\ u4UK	L :: 

++A#dFZFZB[A\] s1   E\U#[=\\:\\\\c                 B   | j                   j                  dd      st        j                  dt        j
                  fdt        fdt        fdt        fdt        fdt        fd	t        fd
t        j
                  fdt        j                  j                  fg	| j                               S t        j                  dt        j
                  fdt        fdt        fdt        fdt        fdt        fdt        j
                  fd	t        fdt        j
                  fdt        j
                  fdt        fdt        fdt        fdt        fdt        fdt        fd
t        j
                  fdt        j                  j                  fdt        j                  fg| j                               S )Nr   Tz Potential MBR at Physical OffsetzDisk SignaturezBootcode MD5zFull MBR MD5PartitionIndexBootabler[   SectorInSizeDisasmBootFlagPartitionTypeRawStartingLBAStartingCylinderStartingCHSStartingSectorEndingCylinder	EndingCHSEndingSectorBootcode)r?   rA   r	   TreeGridr   rQ   strintboolr   rT   r|   rU   )ri   s    r"   runzMBRScan.run   s   {{vt,%%79I9IJ%s+#S)#S)%s+&$c*#\%5%56z33??@
 !  %%79I9IJ%s+#S)#S)%s+&!1!12$c*')9)9:"L$4$45'-"C(%s+%s+ #&#S)#\%5%56z33??@!6!67'* !- r$   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer#   bytesr   r*   r   r   r|   r	   r   r    r$   r"   r   r      s    C"+H
j&>&>&S&S!T 
 
 -E -c - -mHUO m^(Y'' (r$   r   )loggingr'   typingr   r   r   volatility3.frameworkr   r   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr   rc   pluginsPluginInterfacer   r   r$   r"   <module>r      sT   
   ( ( W W < 1 8 2 @			8	$qj  00 qr$   