
    [
#g6                     .   d dl Z d dlZd dlZd dlmZmZmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ  ej(                  e      Z G d d	ej.                  j0                  ej2                        Z G d
 dej.                  j0                        Zy)    N)	constants
exceptions
interfaces	renderers)requirements)
conversionformat_hints)intermed)mft)	timelineryarascanc                   6    e Zd ZdZdZed        Zd Zd Zd Z	y)MFTScanzHScans for MFT FILE objects present in a particular windows memory image.   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NprimaryMemory layer for the kernelIntel32Intel64namedescriptionarchitecturesyarascanner)r      r   r   	componentversionr   TranslationLayerRequirementVersionRequirementr   YaraScannerclss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/mftscan.pyget_requirementszMFTScan.get_requirements   G     449()4
 ++"h.B.BI	
 		
    c              #     K   | j                   j                  | j                  d      }t        j                  j                  ddi      }t        j                  j                  | j                   | j                  ddt        j                  t        j                  d      }|t        j                  z   dz   }|t        j                  z   d	z   }|t        j                  z   d
z   }|t        j                  z   dz   }|j                  | j                   t        j                   |            D ]@  \  }}	}
}t#        j$                  t&        j(                        5  | j                   j+                  |||j,                        }|j.                  }| j                   j+                  |||z   |j,                        }|j0                  j2                  j4                  rt6        j9                  d|j0                  j2                  j;                                 	 |j<                  j;                         }|j0                  j2                  j;                         dk(  r0|jB                  jE                  |      }dtG        jH                  |jJ                  jL                        |jO                         |jP                  |jR                  |tU        jV                         |j0                  j2                  j;                         tY        jZ                  |j\                        tY        jZ                  |j^                        tY        jZ                  |j`                        tY        jZ                  |jb                        tU        jV                         ff |j0                  j2                  j;                         dk(  r7|jB                  jE                  |      }|je                         }	 |j<                  j;                         }dtG        jH                  |jJ                  jL                        |jO                         |jP                  |jR                  |||j0                  j2                  j;                         tY        jZ                  |j\                        tY        jZ                  |j^                        tY        jZ                  |j`                        tY        jZ                  |jb                        |ff |j0                  jf                  dk(  rnf||j0                  jf                  z  }| j                   j+                  |||z   |j,                        }|j0                  j2                  j4                  rd d d        C y # t>        $ r tA        |j<                        }Y dw xY w# t>        $ r tA        |j<                        }Y w xY w# 1 sw Y   xY ww)Nr   yara_string/FILE0|FILE\*|BAAD/windowsr   )FILE_NAME_ENTRY	MFT_ENTRYcontextconfig_pathsub_pathfilenameclass_typesr/   	ATTRIBUTESTANDARD_INFORMATION_ENTRYr.   rulesr1   scanneroffset
layer_namezAttr Type: STANDARD_INFORMATIONr   	FILE_NAMEr   )4r1   layersconfigr   YaraScanprocess_yara_optionsr
   IntermediateSymbolTablecreater2   r   MFTFileNameMFTEntryr   BANGscanr#   
contextlibsuppressr   PagedInvalidAddressExceptionobjectr   FirstAttrOffsetAttr_HeaderAttrTypeis_valid_choicevollogdebuglookupFlags
ValueErrorhex	Attr_Datacastr	   Hexvolr=   get_signatureRecordNumber	LinkCountr   NotApplicableValuer   wintime_to_datetimeCreationTimeModifiedTimeUpdatedTimeAccessedTimeget_full_nameLength)selflayerr9   symbol_table
mft_objectattribute_object	si_object	fn_objectr=   
_rule_name_name_value
mft_recordattr_base_offsetattrmft_flag	attr_data	file_namepermissionss                      r&   
_generatorzMFTScan._generator$   s    ##DKK	$:; !!6623

  77>>LL((,/OO#,,W ? 
 "INN2[@
')..8;F 9>>14PP	 9>>14EE	 27LL(*>*>U*K 2< 2
-FJv $$Z%L%LM O!\\00v%** 1 
 $.#=#= ||**$!$44$zz +  &&//??LL;t/?/?/H/H/O/O/Q.R!ST9#-#3#3#:#:#<
 ''00779=SS$(NN$7$7	$B	(,,Y]]-A-AB&446&33&00$%88: ,,55<<>&::9;Q;QR&::9;Q;QR&::9;P;PQ&::9;Q;QR%88:"    ''00779[H$(NN$7$7	$B	$-$;$;$=	?*3//*@*@*BK  (,,Y]]-A-AB&446&33&00$' ,,55<<>&::9;Q;QR&::9;Q;QR&::9;P;PQ&::9;Q;QR%"    ''..!3 %(8(8(?(??$<<..(%(88#(:: / Dy &&//??O O2
2 & 9#&z'7'7#89:  * ?*-ioo*>K?gO Osi   EWB;V9U/,F+V9V2E/V9#W/VV9VV9V62V95V66V99W	>Wc              #   v  K   | j                         D ]  }|\  }}|d   dk(  s|d   }d| }|t        j                  j                  |d   f |t        j                  j                  |d   f |t        j                  j
                  |d   f |t        j                  j                  |d   f  y w)	N   r@   zMFT FILE_NAME entry for       	   
   )ry   r   TimeLinerTypeCREATEDMODIFIEDCHANGEDACCESSED)rh   row_depthrow_datar4   r   s         r&   generate_timelinezMFTScan.generate_timeline   s     ??$C"FH {k)#B< 8
C"I$;$;$C$CXa[QQ"I$;$;$D$DhqkRR"I$;$;$C$CXa[QQ"I$;$;$D$DhrlSS %s   !B9BB9c                 V   t        j                  dt        j                  fdt        fdt
        fdt
        fdt        fdt        fdt        fdt        j                  fd	t        j                  fd
t        j                  fdt        j                  fdt        fg| j                               S )NOffsetRecord TypeRecord Numberz
Link CountMFT TypePermissionszAttribute TypeCreatedModifiedUpdatedAccessedFilename)r   TreeGridr	   r[   strintdatetimery   rh   s    r&   runzMFTScan.run   s    !!<++,$ #&s#S!$!3'H--.X../H--.X../S! OO
 	
r)   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr'   ry   r   r    r)   r&   r   r      s/    R"+

 

jXT
r)   r   c                   0    e Zd ZdZdZed        Zd Zd Zy)ADSzScans for Alternate Data Streamr   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	Nr   r   r   r   r   r   r   r   r    r$   s    r&   r'   zADS.get_requirements   r(   r)   c              #    	  K   | j                   j                  | j                  d      }t        j                  j                  ddi      }t        j                  j                  | j                   | j                  ddt        j                  t        j                  t        j                  d      }|t        j                  z   dz   }|t        j                  z   d	z   }|t        j                  z   d
z   }|j!                  | j                   t        j"                  |            D ]I  \  }}}	}
t%        j&                  t(        j*                        5  | j                   j-                  |||j.                        }|j0                  }| j                   j-                  |||z   |j.                        }d}t2        j4                  }|j6                  j8                  j:                  r|j6                  j8                  j=                         dk(  r+|j>                  jA                  |      }|jC                         }|j6                  j8                  j=                         dk(  r|r|j6                  jD                  so|j6                  jF                  dkD  rU|jI                         }|st2        j4                  }|jK                         }|r}tL        j2                  jN                  }|jP                  jS                  dd       }|r/tL        j2                  jU                  |d|jW                               }tY        jZ                  |      }n2t3        j4                         }tL        j2                  jO                         }dtY        j\                  j^                  j`                        |jc                         |jd                  |j6                  j8                  j=                         ||||ff nd}|j6                  jf                  dk(  rnf||j6                  jf                  z  }| j                   j-                  |||z   |j.                        }|j6                  j8                  j:                  rd d d        L y # 1 sw Y   XxY ww)Nr   r+   r,   r-   r   )r/   r.   r6   r0   r/   r6   r.   r8   r:   r<   Fr@   DATAr   architectureT)4r1   rA   rB   r   rC   rD   r
   rE   rF   r2   r   rH   rG   MFTAttributer   rI   rJ   r#   rK   rL   r   rM   rN   r   rO   r   NotAvailableValuerP   rQ   rR   rU   rY   rZ   rf   NonResidentFlag
NameLengthget_resident_filenameget_resident_filecontentr   BaseAbsentValuemetadatagetDisassemblylowerr	   HexBytesr[   r\   r=   r]   r^   rg   )rh   ri   r9   rj   rk   rl   rn   r=   ro   rp   rq   rr   rs   rt   is_adsrw   rv   ads_namecontentdisasmr   s                        r&   ry   zADS._generator   s    ##DKK	$:; !!6623

  77>>LL(( \\#&?? -- ? 

 "INN2[@
')..8;F 9>>14EE	 27LL(*>*>U*K 2< 2
-FJv $$Z%L%LM G!\\00v%** 1 
 $.#=#= ||**$!$44$zz +  %77	&&//??''00779[H$(NN$7$7	$B	$-$;$;$=	''00779VC!#'#3#3#C#C#'#3#3#>#>#B/3/I/I/KH+33<3N3N.2.K.K.MG'.1;1E1E1U1U7<~~7I7I,:D8* ,85?5I5I5U5U07L<N<N<P6.F 3?2G2G2P2;2M2M2O1;1E1E1U1U1W*+(4(8(89M9M(N(2(@(@(B(2(?(?(,(8(8(A(A(H(H(J(1(0(/(.	.& 	+& 	%& &*F ''..!3 %(8(8(?(??$<<..(%(88#(:: / Dc &&//??%G G2
G Gs   EQ>LQ1%Q>1Q;	6Q>c                 
   t        j                  dt        j                  fdt        fdt
        fdt        fdt        fdt        fdt        j                  fdt        j                   j                  fg| j                               S )	Nr   r   r   r   r   zADS FilenameHexdumpDisasm)
r   r   r	   r[   r   r   r   r   r   ry   r   s    r&   r   zADS.run*  s~    !!<++,$ #&S!S!%L112://;;<	 OO
 	
r)   N)	r   r   r   r   r   r   r'   ry   r   r   r)   r&   r   r      s)    )"+

 

eN
r)   r   )rK   r   loggingvolatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   r	   volatility3.framework.symbolsr
   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   r   	getLoggerr   rS   pluginsPluginInterfaceTimeLinerInterfacer   r   r   r)   r&   <module>r      st       N N < D 2 @ 3			8	$\
j  00)2N2N \
~F
*


,
, F
r)   