X f` ddlZddlZddlmZmZmZmZmZmZddl m Z m Z m Z m Z ddlmZddlmZmZmZddlmZddlmZej0eZGdd e j6j8Zy) N)Dict GeneratorListSetTupleOptional) interfaces renderers exceptions constants) requirements)intel resourceslinear) format_hints)pslistcJeZdZdZdZdZejdZe de e jjfdZdZdeeddffd Zd edeeeffd Ze dd e j,j.d ededej4dee edeeeeeefff dZy)Stringsz]Reads output from the strings command and indicates which process(es) each string belongs to.)rrrrs%^(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?returnctjddddgtjdtjdtj d t d d tjd dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesrr)rpluginversionpidz8Process ID to include (all other processes are excluded)T)r element_typeroptional strings_filez Strings file)rr)r ModuleRequirementPluginRequirementrPsListListRequirementintURIRequirement)clss _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/strings.pyget_requirementszStrings.get_requirementssv  * *,()4   * *fmmY   ( ( V    ' '#   ctjdtfdtjfdtfg|j S)NStringzPhysical AddressResult)r TreeGridstrrHex _generator)selfs r-runz Strings.run0s>!!_1<3C3CDxQTo V OO   r/Nc #Kg}tj}|j|jdd}|j }d}|r@|dz } |j |\}}|j ||f|j }|r@|jj|jd}|j|j|j|j|j|jd} d} d} t!|} |D]\}}| dz } | |d z D cgc]\} }| d zt#|z}} }dt)|d t+j,d j/|ff| | z dz}t1|d| kDst1|d} |j|dy#t$rtjd|Y\wxYwcc}} w#t$t&f$rd g}YwxYww)z&Generates results from a strings file.r%rbrrz"Line in unrecognized format: line rr")progress_callbackpid_list :z FREE MEMORYzlatin-1z, dzMatching strings in memoryN)rResourceAccessoropenconfigreadline _parse_lineappend ValueErrorvollogerrorcontextmodulesgenerate_mapping layer_namesymbol_table_name_progress_callbacklenhex IndexErrorKeyErrorr4rr5joinround)r7 string_listaccessor strings_fplinecountoffsetstringrrevmap last_prog line_count num_stringsr revmap_listprogs r-r6zStrings._generator6s/1 --/]]4;;~#>E ""$ QJE K!%!1!1$!7""FF#34&&(D%%dkk(&;<&& LL     $ $"55[[' '   +& ) LNFF !OJ .CI&TV,CW1?$D3JV,   * $$V,IIk*  +c1DT1~ )!$N ''.JK' L! K A%IJ K&) .,o  .snAG7'F19G7 B G7 G%GGA G7!G71!GG7GG7GG41G73G44G7rXc|jj|}|s td|jdd\}}t ||fS)zParses a single line from a strings file. Args: line: bytes of the line of a strings file (an offset and a string) Returns: Tuple of the offset and the string found at that offset z*Strings file contains invalid strings linerr)strings_patternsearchrFgroupr*)r7rXmatchrZr[s r-rDzStrings._parse_lineisL$$++D1IJ JQ*6{F""r/rIrL symbol_tabler;r<c tjj|}|j|}t }t |t jr|jd|jdD]s} | \} } } } }t| | | zdD]:}|j|dz t}|jd| f|||dz <<|s[|| dz|jz dutjj|||D]}||r d } |j}|j!}|j|}t |t0j2sV|jd|jdD]} | \} } } } }t| | | zdD]G}|j| dz t}|jd |j| f||| dz <I|sh|| dz|jz d |j|S#t"j$$rE}t&j)d j+||j,|j.Yd }~\d }~wwxYw)a4Creates a reverse mapping between virtual addresses and physical addresses. Args: context: the context for the method to run against layer_name: the layer to map against the string lines symbol_table: the name of the symbol table for the provided layer progress_callback: an optional callable to display progress pid_list: a lit of process IDs to consider when generating the reverse map Returns: A mapping of virtual offsets to strings and physical offsets rT) ignore_errorsir=rr?zCreating reverse kernel mapUnknownz*Process {}: invalid address {} in layer {}NzProcess zCreating mapping for task )rr(create_pid_filterlayersdict isinstancerIntelmappingmaximum_addressrangegetsetaddlist_processesUniqueProcessIdadd_process_layerr InvalidAddressExceptionrGdebugformatinvalid_addressrLrLinearlyMappedLayer)r,rIrLrgr;r<filterlayer reverse_mapmapvalrZ_ mapped_offset mapped_sizemaplayervalcur_setprocessproc_idproc_layer_nameexcp proc_layers r-rKzStrings.generate_mappingys,00:z*7;v eU[[ )--U-B-BRV-W BH?=+x  0KVT5C)oocRi?GKK6 23-4Kr *5%%#)>)>>5 "==77\# "g'G !")"9"9*1*C*C*E")!@J!*f.H.HI&0&8&8!;!;4'9'"FOUKM1fk8', -}{/JF(K+6//-2:Msu*U ' '/0G0G/H%I6$R!"DK MR,? @K 1 1%+c\U5J5J$J&@AXAX@Y$Z!""%# "J;&==! HOO ')=)=t ! !sHI*%:I%%I*)NN)__name__ __module__ __qualname____doc___version_required_framework_versionrecompilerc classmethodrr configurationRequirementInterfacer.r8rrr6bytesr*rDrIContextInterfacer4r ProgressCallbackrrrrKr/r-rrsgH"+ bjj!JKO j&>&>&S&S!T  , 1LIeT4&781Lf##%U *;#  9=(, N##44NN N %55 N 49% N c3uS#X'' (NNr/r)loggingrtypingrrrrrrvolatility3.frameworkr r r r #volatility3.framework.configurationr volatility3.framework.layersrrrvolatility3.framework.renderersrvolatility3.plugins.windowsr getLoggerrrGpluginsPluginInterfacerrr/r-rsT  >>NN<AA8.   8 $vj  00vr/