
    *1fu6                        d dl Z d dlZd dlZd dlmZmZmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ  ej        e          Z G d d	ej        j        ej                  Z G d
 dej        j                  ZdS )    N)	constants
exceptions
interfaces	renderers)requirements)
conversionformat_hints)intermed)mft)	timelineryarascanc                   >    e Zd ZdZdZed             Zd Zd Zd Z	dS )MFTScanzHScans for MFT FILE objects present in a particular windows memory image.   r   r   c                 v    t          j        ddddg          t          j        dt          j        d          gS 	NprimaryzMemory layer for the kernelIntel32Intel64)namedescriptionarchitecturesyarascannerr   )r   	componentversionr   TranslationLayerRequirementVersionRequirementr   YaraScannerclss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/mftscan.pyget_requirementszMFTScan.get_requirements   R     49()4  
 +"h.BI  	
 		
    c              #   	  K   | j         j        | j        d                  }t          j                            ddi          }t          j                            | j         | j	        ddt          j        t          j        d          }|t          j        z   dz   }|t          j        z   d	z   }|t          j        z   d
z   }|t          j        z   dz   }|                    | j         t          j        |                    D ]\  }}	}
}t#          j        t&          j                  5  | j                             |||j                  }|j        }| j                             |||z   |j                  }|j        j        j        rAt6                              d|j        j                                                    	 |j                                        }n$# t>          $ r tA          |j                  }Y nw xY w|j        j                                        dk    r|j!        "                    |          }dtG          j$        |j%        j&                  |'                                |j(        |j)        |tU          j+                    |j        j                                        tY          j-        |j.                  tY          j-        |j/                  tY          j-        |j0                  tY          j-        |j1                  tU          j+                    ffV  |j        j                                        dk    r/|j!        "                    |          }|2                                }	 |j                                        }n$# t>          $ r tA          |j                  }Y nw xY wdtG          j$        |j%        j&                  |'                                |j(        |j)        |||j        j                                        tY          j-        |j.                  tY          j-        |j/                  tY          j-        |j0                  tY          j-        |j1                  |ffV  |j        j3        dk    rnF||j        j3        z  }| j                             |||z   |j                  }|j        j        j        Ad d d            n# 1 swxY w Y   d S )Nr   
yara_rules/FILE0|FILE\*|BAAD/windowsr   )FILE_NAME_ENTRY	MFT_ENTRYcontextconfig_pathsub_pathfilenameclass_typesr,   	ATTRIBUTESTANDARD_INFORMATION_ENTRYr+   rulesr.   scanneroffset
layer_namezAttr Type: STANDARD_INFORMATIONr   	FILE_NAME   )4r.   layersconfigr   YaraScanprocess_yara_optionsr
   IntermediateSymbolTablecreater/   r   MFTFileNameMFTEntryr   BANGscanr    
contextlibsuppressr   PagedInvalidAddressExceptionobjectr   FirstAttrOffsetAttr_HeaderAttrTypeis_valid_choicevollogdebuglookupFlags
ValueErrorhex	Attr_Datacastr	   Hexvolr:   get_signatureRecordNumber	LinkCountr   NotApplicableValuer   wintime_to_datetimeCreationTimeModifiedTimeUpdatedTimeAccessedTimeget_full_nameLength)selflayerr6   symbol_table
mft_objectattribute_object	si_object	fn_objectr:   
_rule_name_name_value
mft_recordattr_base_offsetattrmft_flag	attr_data	file_namepermissionss                      r#   
_generatorzMFTScan._generator$   s     #DK	$:; !6612
 

  7>>L(,/O#,WW ? 
 
 "IN2[@
').8;F 9>14PP	 9>14EE	 27L(*>U*K*K*K 2< 2
 2
 R	 R	-FJv $Z%LMM O O!\00v%* 1  
 $.#= |**$!$44$z +   &/? @LL!St/?/H/O/O/Q/Q!S!STTT9#-#3#:#:#<#<% 9 9 9#&z'7#8#89 '07799=SSS$(N$7$7	$B$B	(,Y]-ABB&4466&3&0$%8:: ,5<<>>&:9;QRR&:9;QRR&:9;PQQ&:9;QRR%8::"      '07799[HH$(N$7$7	$B$B	$-$;$;$=$=	?*3/*@*@*B*BKK) ? ? ?*-io*>*>KKK?  (,Y]-ABB&4466&3&0$' ,5<<>>&:9;QRR&:9;QRR&:9;PQQ&:9;QRR%"      '.!33 %(8(??$<..(%(88#(: /  Dy &/? @O O O O O O O O O O O O O O OR	 R	s]   #BS>GSG96S8G99E4S.NSN)&S(N))DSS	S	c              #   T  K   |                                  D ]}|\  }}|d         dk    r}|d         }d| }|t          j        j        |d         fV  |t          j        j        |d         fV  |t          j        j        |d         fV  |t          j        j        |d         fV  d S )	N   r=   zMFT FILE_NAME entry for       	   
   )rw   r   TimeLinerTypeCREATEDMODIFIEDCHANGEDACCESSED)rf   row_depthrow_datar1   r   s         r#   generate_timelinezMFTScan.generate_timeline   s      ??$$ 
	T 
	TC"FH {k))#B<CCC"I$;$CXa[QQQQ"I$;$DhqkRRRR"I$;$CXa[QQQQ"I$;$DhrlSSSS
	T 
	Tr&   c                 B   t          j        dt          j        fdt          fdt
          fdt
          fdt          fdt          fdt          fdt          j        fd	t          j        fd
t          j        fdt          j        fdt          fg|                                           S )NOffsetRecord TypeRecord Numberz
Link CountMFT TypePermissionszAttribute TypeCreatedModifiedUpdatedAccessedFilename)r   TreeGridr	   rY   strintdatetimerw   rf   s    r#   runzMFTScan.run   s    !<+,$ #&s#S!$!3'H-.X./H-.X./S! OO
 
 	
r&   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr$   rw   r   r    r&   r#   r   r      sm        RR"+

 

 [

j j jXT T T
 
 
 
 
r&   r   c                   8    e Zd ZdZdZed             Zd Zd ZdS )ADSzScans for Alternate Data Streamr   c                 v    t          j        ddddg          t          j        dt          j        d          gS r   r   r!   s    r#   r$   zADS.get_requirements   r%   r&   c              #   t  K   | j         j        | j        d                  }t          j                            ddi          }t          j                            | j         | j	        ddt          j        t          j        t          j        d          }|t          j        z   dz   }|t          j        z   d	z   }|t          j        z   d
z   }|                    | j         t          j        |                    D ]\  }}}	}
t%          j        t(          j                  5  | j                             |||j                  }|j        }| j                             |||z   |j                  }d}t2          j        }|j        j        j        r|j        j                                        dk    r.|j                             |          }|!                                }|j        j                                        dk    rJ|rE|j        j"        s7|j        j#        dk    r&|$                                }|st2          j        }|%                                }|rbtL          j        j'        }|j(        )                    dd           }|r3tL          j        *                    |d|+                                          }nt2          j        }tL          j        j'        }dtY          j-        |j.        j/                  |0                                |j1        |j        j                                        ||tY          j2        |          |ffV  nd}|j        j3        dk    rnF||j        j3        z  }| j                             |||z   |j                  }|j        j        j        d d d            n# 1 swxY w Y   d S )Nr   r(   r)   r*   r   )r,   r+   r3   r-   r,   r3   r+   r5   r7   r9   Fr=   DATAr   architectureT)4r.   r?   r@   r   rA   rB   r
   rC   rD   r/   r   rF   rE   MFTAttributer   rG   rH   r    rI   rJ   r   rK   rL   r   rM   r   NotAvailableValuerN   rO   rP   rS   rW   rX   rd   NonResidentFlag
NameLengthget_resident_filenameget_resident_filecontentr   BaseAbsentValuemetadatagetDisassemblylowerr	   rY   rZ   r:   r[   r\   HexBytesre   )rf   rg   r6   rh   ri   rj   rl   r:   rm   rn   ro   rp   rq   rr   is_adsru   rt   ads_namecontentdisasmr   s                        r#   rw   zADS._generator   s!     #DK	$:; !6612
 

  7>>L( \#&? -  ? 

 

 "IN2[@
').8;F 9>14EE	 27L(*>U*K*K*K 2< 2
 2
 I	 I	-FJv $Z%LMM F F!\00v%* 1  
 $.#= |**$!$44$z +   %7	&/? 4'07799[HH$(N$7$7	$B$B	$-$;$;$=$=	'07799VCC! "*#'#3#C &#'#3#>#B#B/3/I/I/K/KH+3 %O3<3N.2.K.K.M.MG'. %V1;1E1U7<~7I7I,:D8* 8* ,8 ).5?5I5U5U07L<N<N<P<P6. 6.F 3<2M1;1E1U*+(4(89M(N(N(2(@(@(B(B(2(?(,(8(A(H(H(J(J(1(0(4(=g(F(F(.	.& 	+& 	%& 	%& 	%& &*F '.!33 %(8(??$<..(%(88#(: /  Da &/? 4%F F F F F F F F F F F F F F FI	 I	s   JN++N/	2N/	c                     t          j        dt          j        fdt          fdt
          fdt          fdt          fdt          fdt          j        fdt          j         j        fg| 	                                          S )	Nr   r   r   r   r   zADS FilenameHexdumpDisasm)
r   r   r	   rY   r   r   r   r   r   rw   r   s    r#   r   zADS.run)  sw    !<+,$ #&S!S!%L12:/;<	 OO
 
 	
r&   N)	r   r   r   r   r   r   r$   rw   r   r   r&   r#   r   r      s[        ))"+

 

 [

d d dL
 
 
 
 
r&   r   )rI   r   loggingvolatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r	   volatility3.framework.symbolsr
   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   r   	getLoggerr   rQ   pluginsPluginInterfaceTimeLinerInterfacer   r   r   r&   r#   <module>r      sC         N N N N N N N N N N N N < < < < < < D D D D D D D D 2 2 2 2 2 2 @ @ @ @ @ @ 3 3 3 3 3 3 3 3		8	$	$\
 \
 \
 \
 \
j 0)2N \
 \
 \
~E
 E
 E
 E
 E
*

, E
 E
 E
 E
 E
r&   