
    *1f4                     ~   d dl Z d dlZd dlmZmZmZmZmZmZm	Z	 d dl
mZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZm Z  d dl!m"Z"  e j#        e$          Z% eddee&ej        j'        f         fdee&ej        j'        f         fg          Z( G d dej)        j*                  Z+dS )    N)DictList
NamedTupleOptionalTupleUnioncast)	constants
exceptions
interfacesobjects	rendererssymbols)requirements)scanners)format_hints)intermed)versions)services)poolscannerpslistvadyarascan)hivelistServiceBinaryInfodllbinaryc                   4   e Zd ZU dZdZdZedeej	        j
                 fd            Zedej        j        defd            Zej        dd	fej        dd
fej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfej        ddfgZeeej        e e!f                  e"d<   edej#        j$        de!de!de!fd            Z%de&ej'                 fdZ(ede)e!ej*        j+        f         fd             Z,ede)e!ej*        j+        f         fd!            Z-ed"ej        j        de.e!ef         fd#            Z/d$ Z0d% Z1d&S )'SvcScanzScans for windows services.   r   r   returnc           	      6   t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d
          t          j        dt          j        d
          t          j        dt          j
        d
          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r&   pluginversionr   )   r   r   r   r   )r   ModuleRequirementPluginRequirementr   PsListr   PoolScannerr   VadYaraScanr   HiveList)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/svcscan.pyget_requirementszSvcScan.get_requirements,   s     *,()4  
 *fmY   *";+BI   *";+BI   *(99  
 	
    service_recordbinary_infoc                 N   t          j        | j        j                  | j        |                                 | j        j        | j        j        | 	                                | 
                                |                                 |                                 |j        |j        fS )N)r   HexvoloffsetOrderget_pidStartr'   Stateget_typeget_nameget_display
get_binaryr   r   )r6   r7   s     r3   get_record_tuplezSvcScan.get_record_tupleC   s     ^/677 ""$$ , ,##%%##%%&&((%%''O
 	
r5   Tzservices-win10-25398-x64zservices-win10-19041-x64Fzservices-win10-19041-x86zservices-win10-18362-x64zservices-win10-18362-x86zservices-win10-17763-x86zservices-win10-16299-x64zservices-win10-16299-x86zservices-win10-15063-x64zservices-win10-15063-x86zservices-win8-x64zservices-win8-x86zservices-vista-x64zservices-vista-x86zservices-xp-x86zservices-xp-2003-x64_win_version_file_mapcontextsymbol_tableconfig_pathc                 |     j                  j        }t          j                   	 t	           fdt
          j        D                       }n# t          $ r t          d          w xY wt          j
                             |t          j                            dd          |t          j        |          S )a  Constructs a symbol table containing the symbols for services
        depending upon the operating system in use.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            symbol_table: The name of the table containing the kernel symbols
            config_path: The configuration path for any settings required by the new table

        Returns:
            A symbol table containing the symbols necessary for services
        c              3   J   K   | ]\  }}}|k     |           |V  dS )rF   rG   N ).0version_check	for_64bitfilenamerF   is_64bitrG   s       r3   	<genexpr>z/SvcScan.create_service_table.<locals>.<genexpr>   sW       # #6M9hy((!M'MMM ) ((((# #r5   z)This version of Windows is not supported!windowsr   )class_typesnative_types)symbol_spacenativesr   symbol_table_is_64bitnextr   rE   StopIterationNotImplementedErrorr   IntermediateSymbolTablecreateospathjoinr   rT   )rF   rG   rH   rU   symbol_filenamerQ   s   ``   @r3   create_service_tablezSvcScan.create_service_tablel   s    " +L9A0,GG	S" # # # # # #:A:W# # #  OO  	S 	S 	S%&QRRR	S /66GLLJ// ,% 7 
 
 	
s   'A A.c                 4   t           j                            | j        t          j                            | j        d          |j        |j	        d          D ]}	 t          t          j        |                    d                    c S # t          t          j        f$ rv 	 t          t          j        |                    d                    cY c S # t          t          j        f$ r( t"                              t&          j        d           Y nw xY wY w xY wd S )Nr   zmachine\system)rF   base_config_path
layer_namerG   filter_stringzCurrentControlSet\ServiceszControlSet001\Servicesz3Could not retrieve any control set from SYSTEM hive)r   r1   
list_hivesrF   r   configuration	path_joinrH   re   symbol_table_namer	   r   
StructTypeget_keyKeyErrorr   InvalidAddressExceptionvolloglogr
   LOGLEVEL_VVVV)selfr#   hives      r3   _get_service_keyzSvcScan._get_service_key   sW   %00L'5?? *  (1+ 1 
 
 	 	D&5R(S(S     j@A 	 	 	*DLL9R,S,S       !*"DE   JJ!/M     	 ts6   ,B		D ,CD;DDDDDc                    	 t          d |                                 D                       }t          d |                                D                                                                           d                              d          S # t          $ r t          j                    cY S t          $ r t          j
                    cY S w xY w)Nc              3   J   K   | ]}|                                 d k    |V  dS )
ParametersNrA   )rM   keys     r3   rR   z+SvcScan._get_service_dll.<locals>.<genexpr>   sA        <<>>\11 1111 r5   c              3   J   K   | ]}|                                 d k    |V  dS )
ServiceDllNrx   rM   vals     r3   rR   z+SvcScan._get_service_dll.<locals>.<genexpr>   sA        ||~~55 5555 r5   utf-16 )rY   get_subkeys
get_valuesdecode_datadecoderstripUnicodeDecodeErrorr   UnparsableValuerZ   UnreadableValue)service_key	param_keys     r3   _get_service_dllzSvcScan._get_service_dll   s    	/  &2244    I   (3355    
 !!	 " 	/ 	/ 	/,..... 	/ 	/ 	/,.....	/s   BB C/CCc                 L   	 t          d |                                 D                                                                           d                              d          S # t
          $ r t          j                    cY S t          $ r t          j	                    cY S w xY w)Nc              3   J   K   | ]}|                                 d k    |V  dS )	ImagePathNrx   r|   s     r3   rR   z.SvcScan._get_service_binary.<locals>.<genexpr>   sA        ||~~44 4444 r5   r~   r   )
rY   r   r   r   r   r   r   r   rZ   r   )r   s    r3   _get_service_binaryzSvcScan._get_service_binary   s    	/  *5577    
 !!	 " 	/ 	/ 	/,..... 	/ 	/ 	/,.....	/s   A"A% %B#B#"B#services_keyc                 B    |                                  }d |D             S )Nc           	          i | ]U}|                                 t          t                              |          t                              |                    VS rL   )rA   r   r   r   r   )rM   r   s     r3   
<dictcomp>z3SvcScan._get_service_binary_map.<locals>.<dictcomp>   se     
 
 

 	   ""$5((55++K88% %
 
 
r5   )r   )r   r   s     r3   _get_service_binary_mapzSvcScan._get_service_binary_map   s8      ++--
 

  (
 
 
 	
r5   c              #   j  K   | j         j        | j        d                  }|                     | j         |j        | j                  }|                     |          }||                     |          ni }| j         j        	                    |t          j        z   dz                                 d          }t          j                            dg          }t!          j        | j         |j                  }|rd}nd}g }	t          j                            | j         |j        |j        |          D ]}
d	}	 |
j        }|
                                }nU# t,          j        $ rC}t0                              d
                    ||j        |j                             Y d }~od }~ww xY w| j         j        |         }|                    | j         t=          j        |          t@          j!        "                    |
                    D ]}|s| j         #                    |t          j        z   dz   ||z
  |          }|$                                sJ|%                    |&                                tO          tQ          j)                    tQ          j)                                        }d| *                    ||          fV  | j         #                    |t          j        z   dz   ||          }|$                                s|j+        ,                                D ]}||	v r n|	-                    |           |%                    |&                                tO          tQ          j)                    tQ          j)                                        }d| *                    ||          fV  d S )Nr#   _SERVICE_RECORDTagzservices.exerK   s   serHs   sErv)rF   re   rG   filter_funcUnknownz*Process {}: invalid address {} in layer {})needle)rF   scannersections)r;   re   r   _SERVICE_HEADER).rF   modulesconfigrb   rj   rH   rt   r   rV   r@   r
   BANGrelative_child_offsetr   r.   create_name_filterr   is_vista_or_laterlist_processesre   UniqueProcessIdadd_process_layerr   rn   ro   debugformatinvalid_addresslayersscanr   BytesScannerr   r0   get_vad_mapsobjectis_validgetrA   r   r   r   rD   ServiceRecordtraverseappend)rr   r#   service_table_namer   service_binary_dll_maprelative_tag_offsetr   r   service_tagseentaskproc_idproc_layer_nameexcplayerr;   r6   service_infoservice_headers                      r3   
_generatorzSvcScan._generator   s#     %dk(&;<!66L&2D4D
 
 ,,V44 ' ((666 	 #l7@@/2CC
 



&
& 	 m667GHH$6Lv/G
 
 
  	"!KK!KM00L(1#	 1 
 
 G	 G	D  G	."&"8"8":":5   @GG!5t   
  L'8E** -[AAA$0==dCC %   3 3
 ) .%)\%8%8*Y^;>OO%(;;#2 &9 & &N *2244 ! #9#=#=&//11)%5779R9T9T $ $L --nlKK    
 &*\%8%8*Y^;>OO%#2 &9 & &N *2244 ! 
 +9*F*O*O*Q*Q  )T11!EN333'='A'A*3355- ) 9 ; ;Y=V=X=X ( (  11.,OO    a3)G	 G	s   7EF%"9F  F%c                 
   t          j        dt          j        fdt          fdt          fdt
          fdt
          fdt
          fdt
          fdt
          fd	t
          fd
t
          fdt
          fg|                                           S )NOffsetr<   PIDr>   r?   TypeNameDisplayBinaryzBinary (Registry)Dll)r   TreeGridr   r9   intstrr   )rr   s    r3   runzSvcScan.runU  s~    !<+,###C 3$c* OO
 
 	
r5   N)2__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   rh   RequirementInterfacer4   staticmethodr   ObjectInterfacer   rD   r   is_win10_25398_or_lateris_win10_19041_or_lateris_win10_18362_or_lateris_win10_17763_or_lateris_win10_16299_or_lateris_win10_15063is_win10_up_to_15063is_windows_8_or_laterr   is_windows_xpis_xp_or_2003rE   r   OsDistinguisherboolr   __annotations__rF   ContextInterfacerb   r   rk   rt   r   r   BaseAbsentValuer   r   r   r   r   r   rL   r5   r3   r   r   &   s        %%"+H
j&>&S!T 
 
 
 [
, 
"*:
&
 
 
 \
( 
	)41KL		)41KL		)52LM		)41KL		)52LM		)52LM		)41KL		)52LM		 $(BC		 %)CD		&.AB		&/BC		'/BC		'/BC		#T+?@		#U,@A		(9:		'=>%O4h&>c&I JK   * $
#4$
$
 $
 
	$
 $
 $
 \$
L(73E*F    8 /	sJ(88	9/ / / \/2 /	sJ(88	9/ / / \/( 

 (8

	c$$	%

 

 

 \

h h hT
 
 
 
 
r5   r   ),loggingr^   typingr   r   r   r   r   r   r	   volatility3.frameworkr
   r   r   r   r   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   %volatility3.framework.symbols.windowsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   r   r   $volatility3.plugins.windows.registryr   	getLoggerr   ro   r   r   r   pluginsPluginInterfacer   rL   r5   r3   <module>r      s  
  				 G G G G G G G G G G G G G G G G G G                = < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 2 2 2 2 2 2 : : : : : : E E E E E E H H H H H H H H H H 9 9 9 9 9 9		8	$	$ J	c:/??@A	5j2BBCD  
 
 
 
 
j 0 
 
 
 
 
r5   