
    [
#g!                         d dl Z d dlZd dlmZmZmZ d dlmZmZm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZ  e j(                  e      Z G d d	e	j.                  j0                        Zy)
    N)ListTypeOptional)	constants
exceptions
interfaces	renderers)requirements)intermed)pe)pslistmodulesc                   X   e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  deded	eej                   j"                     d
ededee   fd       Ze	 	 ddej                  j                  dedej*                  j,                  d	eej                   j"                     dededee   fd       Zedej                  j                  deded	eej                   j"                     dedededee   fd       Zed        Zed        Zd Zd Zy)PEDumpzNAllows extracting PE Files from a specific address in a specific address space   r   r   )   r   r   returnc           
         t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        d
d      t        j                  ddd      t        j                  dddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   	componentversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optionalbasez%Base address to reconstruct a PE fileF)r   r   r    kernel_modulez"Extract from kernel address space.)r   r   defaultr    )	r
   ModuleRequirementVersionRequirementr   PsListListRequirementintIntRequirementBooleanRequirement)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/pedump.pyget_requirementszPEDump.get_requirements   s     **,()4
 ++	 (( W	 ''C
 ++$@	)
 	
    contextpe_table_name
layer_nameopen_method	file_namer!   c                    	  ||      }|j                  |t        j                  z   dz   ||      }|j                         D ]'  \  }	}
|j	                  |	       |j                  |
       ) 	 |j                          |j                  S # t        t        j                  t        t        f$ r5}t        j                  d| d|        Y d}~j                          yd}~ww xY w# j                          w xY w)z?
        Returns the filename of the dump file or None
        _IMAGE_DOS_HEADER)offsetr1   z!Unable to dump PE file at offset z: N)objectr   BANGreconstructseekwriteIOErrorr   VolatilityExceptionOverflowError
ValueErrorvollogdebugclosepreferred_filename)r+   r/   r0   r1   r2   r3   r!   file_handle
dos_headerr6   dataexcps               r,   dump_pezPEDump.dump_pe6   s    	 %i0K 	.1DD% ( J !+ 6 6 8  (!!$' !9 --- **	
 	 LL<TF"TFKL	 s*   A*B	 	#C!,CC$ C!!C$ $C6N	ldr_entryprefixc                 h   	 |j                   j                         }||j                  j
                  }dj                  |t        j                  |      |j                  j                  |j                        }| j                  ||||||j                        S # t        j                  $ r d}Y w xY w)a7  Extracts the PE file referenced an LDR_DATA_TABLE_ENTRY (DLL, kernel module) instance

        Args:
            context: the context to operate upon
            pe_table_name: the name for the symbol table containing the PE format symbols
            ldr_entry: the object representing the module
            open_method: class for constructing output files
            layer_name: the layer that the DLL lives within
            prefix: optional string to prepend to filename
        Returns:
            The output file name or None in the case of failure
        UnreadableDLLNamez{}{}.{:#x}.{:#x}.dmp)FullDllName
get_stringr   InvalidAddressExceptionvolr1   formatntpathbasenamer6   DllBaserH   )	r+   r/   r0   rI   r2   r1   rJ   r   r3   s	            r,   dump_ldr_entryzPEDump.dump_ldr_entry\   s    ,	'((335D "11J*11OOD!MM  	
	 {{
 	
 11 	'&D	's   B B10B1proc_offsetr   c                 \    dj                  |||      }t        j                  ||||||      S )NzPE.{:#x}.{:d}.{:#x}.dmp)rQ   r   rH   )	r+   r/   r0   r1   r2   rV   r   r!   r3   s	            r,   dump_pe_at_basezPEDump.dump_pe_at_base   s=     .44
	 ~~]JY
 	
r.   c           	   #   6  K   t         j                  j                  ||j                  |j                        }t         j                  j                  |||      }|r(d}t        j                  ||||d||      }	|	r|d|	f y y t        j                  d       y w)N   r   KernelzSUnable to find a session layer with the provided base address mapped in the kernel.)
r   Modulesget_session_layersr1   symbol_table_namefind_session_layerr   rX   r@   warning)
r+   r/   r   r0   r2   r!   session_layerssession_layer_name
system_pidfile_outputs
             r,   dump_kernel_pe_at_basezPEDump.dump_kernel_pe_at_base   s      ;;V&&(@(@
 %__??^T
 J 00"K  (K77  NNes   BBc           
   #     K   t         j                  j                  ||j                  |j                  |      D ]  }|j
                  }|j                  j                  d|j                  j                  j                  d      }	|j                         }
t        j                  |||
||j                  j                  ||      }|s||	|f  yw) )r/   r1   symbol_tablefilter_funcstringreplace)
max_lengtherrorsN)r   r&   list_processesr1   r^   UniqueProcessIdImageFileNamecastrP   countadd_process_layerr   rX   r6   )r+   r/   r   r0   r2   ri   r!   procr   	proc_nameproc_layer_namerd   s               r,   dump_processeszPEDump.dump_processes   s      MM00((11#	 1 
D &&C**//--1177  0 I
 #446O 00K 9k113
s   CC
Cc           	   #   H  K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  ddt        j                        }| j                  d   r%| j                  d   rt        j                  d       y | j                  d   s%| j                  d   st        j                  d       y | j                  d   r7| j                  | j                   ||| j                  | j                  d	         }npt        j                  j                  | j                  j!                  dd             }| j#                  | j                   ||| j                  || j                  d	         }|D ]  \  }}}d
|||ff  y w)Nr   windowsr   )class_typesr"   r   z5Only --kernel_module or --pid should be set. Not bothz$--kernel_module or --pid must be setr!   r   )r/   r   configr   IntermediateSymbolTablecreateconfig_pathr   rz   r@   errorre   openr   r&   create_pid_filtergetrw   )selfr   r0   pe_filesri   r   ru   rd   s           r,   
_generatorzPEDump._generator   sg    %%dkk(&;< 88??LL$**It @ 
 ;;'DKK,>LLPQ{{?+DKK4FLL?@;;'22fmTYYF@SH !--99$++//%QU:VWK**		F#H ,4'CK  ,4s   F F"c                 t    t        j                  dt        fdt        fdt        fg| j	                               S )NPIDProcesszFile output)r	   TreeGridr(   strr   )r   s    r,   runz
PEDump.run  s=    !!C $
 OO
 	
r.   )N )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer-   r/   ContextInterfacer   r   pluginsFileHandlerInterfacer(   r   rH   objectsObjectInterfacerU   rX   re   rw   r   r    r.   r,   r   r      s   X"+H
j&>&>&S&S!T 
 
< #.##44#. #. 	#.
 *,,AAB#. #. #. 
##. #.J  +
##44+
 +
 %%55	+

 *,,AAB+
 +
 +
 
#+
 +
Z 
##44
 
 	

 *,,AAB
 
 
 
 
#
 
(  : 2 2@&P
r.   r   )loggingrR   typingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   r   	getLoggerr   r@   r   PluginInterfacer   r   r.   r,   <module>r      sQ      ' ' N N < 2 ? 7			8	$}
Z// }
r.   