X f` ddlZddlZddlmZmZmZmZmZmZddl m Z m Z m Z m Z ddlmZddlmZmZmZddlmZddlmZejeZGdd e jjZdS) N)Dict GeneratorListSetTupleOptional) interfaces renderers exceptions constants) requirements)intel resourceslinear) format_hints)pslistcReZdZdZdZdZejdZe de e j j fdZdZdeeddffd Zd edeeeffd Ze dd e jjd ededejdee edeeeeeefff dZdS)Stringsz]Reads output from the strings command and indicates which process(es) each string belongs to.)rrrrs%^(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?returnctjddddgtjdtjdtjd t d d tjd dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)rpluginversionpidz8Process ID to include (all other processes are excluded)T)r element_typeroptional strings_filez Strings file)rr)r ModuleRequirementPluginRequirementrPsListListRequirementintURIRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/strings.pyget_requirementszStrings.get_requirementss  *,()4     *fmY     ( V      '#     ctjdtfdtjfdtfg|S)NStringzPhysical AddressResult)r TreeGridstrrHex _generator)selfs r-runz Strings.run0s@!_1<3CDxQTo V OO     r/Nc#Kg}tj}||jdd}|}d}|ry|dz } ||\}}|||fn-#t$r t d|YnwxYw|}|y|j j |jd}| |j |j |j|j|jd} d} d} t!|} |D]\}}| dz } d | |d z D} n#t"t$f$rd g} YnwxYwdt'|d t)j|d | ffV| | z dz}t/|d| kr&t/|d} ||ddS)z&Generates results from a strings file.r%rbrrz"Line in unrecognized format: line rr")progress_callbackpid_listc>g|]\}}|dzt|zS):)hex).0roffsets r- z&Strings._generator..Ws81?$D3JV,r/ z FREE MEMORYzlatin-1z, dzMatching strings in memoryN)rResourceAccessoropenconfigreadline _parse_lineappend ValueErrorvollogerrorcontextmodulesgenerate_mapping layer_namesymbol_table_name_progress_callbacklen IndexErrorKeyErrorr4rr5joinround)r7 string_listaccessor strings_fplinecountrAstringrrevmap last_prog line_count num_strings revmap_listprogs r-r6zStrings._generator6ss/1 -//]]4;~#>EE ""$$ ) QJE K!%!1!1$!7!7""FF#34444 K K K I%IIJJJJJ K&&((D )%dk(&;<&& L    $"5[' '    +&& ) L LNFF !OJ .CI&TV,CW ) . . .,o  . ** $V,,IIk**    +c1DT1~~ ))!$NN ''.JKKK' L Ls$/B'B10B1EE-,E-r\c|j|}|std|dd\}}t ||fS)zParses a single line from a strings file. Args: line: bytes of the line of a strings file (an offset and a string) Returns: Tuple of the offset and the string found at that offset z*Strings file contains invalid strings linerr)strings_patternsearchrKgroupr*)r7r\matchrAr^s r-rIzStrings._parse_lineisZ$++D11 KIJJ JQ**6{{F""r/rNrQ symbol_tabler;r<c tj|}|j|}t }t |t jr|d|j dD]~} | \} } } } }t| | | zdD]F}| |dz t}| d| f|||dz <G|r|| dz|j z dtj|||D]V}||sGd } |j}|}nU#t"j$rC}t&d ||j|jYd }~{d }~wwxYw|j|}t |t0jr|d|j dD]} | \} } } } }t| | | zdD]N}| | dz t}| d |j| f||| dz <O|r|| dz|j z d |jX|S)a4Creates a reverse mapping between virtual addresses and physical addresses. Args: context: the context for the method to run against layer_name: the layer to map against the string lines symbol_table: the name of the symbol table for the provided layer progress_callback: an optional callable to display progress pid_list: a lit of process IDs to consider when generating the reverse map Returns: A mapping of virtual offsets to strings and physical offsets rT) ignore_errorsirCrrDzCreating reverse kernel mapUnknownz*Process {}: invalid address {} in layer {}NzProcess zCreating mapping for task )rr(create_pid_filterlayersdict isinstancerIntelmappingmaximum_addressrangegetsetaddlist_processesUniqueProcessIdadd_process_layerr InvalidAddressExceptionrLdebugformatinvalid_addressrQrLinearlyMappedLayer)r,rNrQrjr;r<filterlayer reverse_mapmapvalrA_ mapped_offset mapped_sizemaplayervalcur_setprocessproc_idproc_layer_nameexcp proc_layers r-rPzStrings.generate_mappingys,00::z*7;vv eU[ ) )3 "--U-BRV-WW  BH?=+x  0KVTT55C)oocRi??GKK6 2333-4Kr **$%%#)>>5"=77\# "# "vg "'G !")"9*1*C*C*E*E%=!!! HOO ')=t ! !")!@J!*f.HII"&0&8&8!;4'9''""FOUKM1fk8', -}{/JF((KK+6//-2:Msuu*U*U ' %I0G%I%I6$R!"!"!"DK MR,? @ @0" 1 1%+c\U5J$J$ZAX$Z$Z!"!"!" s%EF9FF)NN)__name__ __module__ __qualname____doc___version_required_framework_versionrecompilerf classmethodrr configurationRequirementInterfacer.r8rrr6bytesr*rIrNContextInterfacer4r ProgressCallbackrrrrPr/r-rrskggH"+ bj!JKKO j&>&S!T   [ ,   1LIeT4&781L1L1L1Lf##%U *;####  9=(, NN#4NN N %5 N 49% N c3uS#X'' (NNN[NNNr/r)loggingrtypingrrrrrrvolatility3.frameworkr r r r #volatility3.framework.configurationr volatility3.framework.layersrrrvolatility3.framework.renderersrvolatility3.plugins.windowsr getLoggerrrLpluginsPluginInterfacerrr/r-rs  >>>>>>>>>>>>>>>>NNNNNNNNNNNN<<<<<<AAAAAAAAAA888888......  8 $ $vvvvvj 0vvvvvr/