
    [
#g9                        d dl Z d dlZd dlmZmZmZmZmZmZm	Z	 d dl
mZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZm Z m!Z! d dl"m#Z#  e jH                  e%      Z& eddee'ej                  jP                  f   fdee'ej                  jP                  f   fg      Z) G d dejT                  jV                        Z,y)    N)DictList
NamedTupleOptionalTupleUnioncast)	constants
exceptions
interfacesobjects	rendererssymbols)requirements)scanners)format_hints)intermed)versions)services)poolscannerpslistvadyarascan)hivelistServiceBinaryInfodllbinaryc                       e Zd ZU dZdZdZ fdZedee	j                  j                     fd       Zede	j                  j                  defd	       Zej&                  d
dfej(                  d
dfej(                  ddfej*                  d
dfej*                  ddfej,                  ddfej.                  d
dfej.                  ddfej0                  d
dfej0                  ddfej2                  d
dfej2                  ddfej4                  d
dfej4                  d
dfej6                  d
dfej6                  ddfej8                  ddfej:                  d
dfgZeeej@                  e!e"f      e#d<   ede	jH                  jJ                  de"de"de"fd        Z&ede"d!e"de"de'ejP                     fd"       Z)ede*e"e	jV                  jX                  f   fd#       Z-ede*e"e	jV                  jX                  f   fd$       Z.ed%e	j                  j                  de/e"ef   fd&       Z0ed'        Z1ede	jH                  jJ                  d!e"de"d(e"fd)       Z2ed!e"de"fd*       Z3d+ Z4d, Z5 xZ6S )-SvcScanzScans for windows services.   r   r   )   r   r   c                 F    t        |   |i | | j                  | _        y N)super__init__service_scan_enumeration_method)selfargskwargs	__class__s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/svcscan.pyr%   zSvcScan.__init__,   s#    $)&)#'#4#4     returnc           	      `   t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      t        j                  dt        j                  d
      t        j                  dt        j                  d
      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r3   pluginversionr   )   r   r   r   r   )r   ModuleRequirementPluginRequirementr   PsListr   PoolScannerr   VadYaraScanr   HiveList)clss    r,   get_requirementszSvcScan.get_requirements0   s     **,()4
 **fmmY **";+B+BI **";+B+BI **(9(99
 	
r-   service_recordbinary_infoc                    t        j                  | j                  j                        | j                  | j                         | j                  j                  | j                  j                  | j                         | j                         | j                         | j                         |j                  |j                  fS r#   )r   HexvoloffsetOrderget_pidStartr4   Stateget_typeget_nameget_display
get_binaryr   r   )rA   rB   s     r,   get_record_tuplezSvcScan.get_record_tupleG   s     ^//667  ""$  ,,  ,,##%##%&&(%%'OO
 	
r-   Tzservices-win10-25398-x64zservices-win10-19041-x64Fzservices-win10-19041-x86zservices-win10-18362-x64zservices-win10-18362-x86zservices-win10-17763-x86zservices-win10-16299-x64zservices-win10-16299-x86zservices-win10-15063-x64zservices-win10-15063-x86zservices-win8-x64zservices-win8-x86zservices-vista-x64zservices-vista-x86zservices-xp-x86zservices-xp-2003-x64_win_version_file_mapcontextsymbol_tableconfig_pathc                      j                      j                  }t        j                         	 t	         fdt
        j                  D              }t        j                  j                   |t        j                  j                  dd      |t        j                   |      S # t        $ r t        d      w xY w)a  Constructs a symbol table containing the symbols for services
        depending upon the operating system in use.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            symbol_table: The name of the table containing the kernel symbols
            config_path: The configuration path for any settings required by the new table

        Returns:
            A symbol table containing the symbols necessary for services
        c              3   H   K   | ]  \  }}}|k(  r |       r|  yw)rQ   rR   N ).0version_check	for_64bitfilenamerQ   is_64bitrR   s       r,   	<genexpr>z0SvcScan._create_service_table.<locals>.<genexpr>   s1      #6M9hy(!'M #s   "z)This version of Windows is not supported!windowsr   )class_typesnative_types)symbol_spacenativesr   symbol_table_is_64bitnextr   rP   StopIterationNotImplementedErrorr   IntermediateSymbolTablecreateospathjoinservices_typesr_   )rQ   rR   rS   r`   symbol_filenamer\   s   ``   @r,   _create_service_tablezSvcScan._create_service_tablep   s    " ++L9AA00,G	S" #:A:W:W# O //66GGLLJ/&22% 7 
 	
  	S%&QRR	Ss   $B) )B>
layer_namec                    t         j                  j                  | t        j                  j                  |d      ||d      D ]-  }	 t        t        j                  |j                  d            c S  y # t        t        j                  f$ rt 	 t        t        j                  |j                  d            cY c S # t        t        j                  f$ r' t        j                  t        j                   d       Y nw xY wY w xY w)Nr   zmachine\system)rQ   base_config_pathro   rR   filter_stringzCurrentControlSet\ServiceszControlSet001\Servicesz3Could not retrieve any control set from SYSTEM hive)r   r>   
list_hivesr   configuration	path_joinr	   r   
StructTypeget_keyKeyErrorr   InvalidAddressExceptionvolloglogr
   LOGLEVEL_VVVV)rQ   rS   ro   rR   hives        r,   _get_service_keyzSvcScan._get_service_key   s     %%00'55??Z "%+ 1 
D&&5R(S 
2  j@@A 	**DLL9R,S  !*"D"DE JJ!//M	s6   (A44D(B;6D;=C;8D:C;;D Dc                 ^   	 t        d | j                         D              }t        d |j                         D              j                         j	                  d      j                  d      S # t        $ r t        j                         cY S t        $ r t        j                         cY S w xY w)Nc              3   F   K   | ]  }|j                         d k(  r|  yw)
ParametersNrL   )rX   keys     r,   r]   z+SvcScan._get_service_dll.<locals>.<genexpr>   s&      <<>\1    !c              3   F   K   | ]  }|j                         d k(  r|  yw)
ServiceDllNr   rX   vals     r,   r]   z+SvcScan._get_service_dll.<locals>.<genexpr>   s&      ||~5 r   utf-16 )rd   get_subkeys
get_valuesdecode_datadecoderstripUnicodeDecodeErrorr   UnparsableValuere   UnreadableValue)service_key	param_keys     r,   _get_service_dllzSvcScan._get_service_dll   s    	/ &224 I  (335 
 !	 " 	/,,.. 	/,,..	/s   A+A. .B,B,+B,c                    	 t        d | j                         D              j                         j                  d      j	                  d      S # t
        $ r t        j                         cY S t        $ r t        j                         cY S w xY w)Nc              3   F   K   | ]  }|j                         d k(  r|  yw)	ImagePathNr   r   s     r,   r]   z.SvcScan._get_service_binary.<locals>.<genexpr>   s&      ||~4 r   r   r   )
rd   r   r   r   r   r   r   r   re   r   )r   s    r,   _get_service_binaryzSvcScan._get_service_binary   s}    	/ *557 
 !	 " 	/,,.. 	/,,..	/s   AA B-BBservices_keyc           
          | j                         }|D ci c]C  }|j                         t        t        j	                  |      t        j                  |            E c}S c c}w r#   )r   rL   r   r   r   r   )r   r   r   s      r,   _get_service_binary_mapzSvcScan._get_service_binary_map   sh      ++-  (

 	   "$5((5++K8% 
 	
 
s   AA c           	   #     K   |dz  ry |j                  |t        j                  z   dz   ||      }|j                         sy |j                  j                         D ]d  }|j                  |j                         t        t        j                         t        j                                     }| j                  ||       f y w)N   _SERVICE_HEADERrF   ro   )objectr
   BANGis_validServiceRecordtraversegetrL   r   r   r   rO   )	r?   rQ   service_table_nameservice_binary_dll_mapproc_layer_namerF   service_headerrA   service_infos	            r,   enumerate_vista_or_later_headerz'SvcScan.enumerate_vista_or_later_header   s      A: /2CC& ( 
 &&(
 -::CCEN155'')!--/1J1J1LL &&~|DD Fs   CCr   c           
   #   n  K   |j                   j                  |t        j                  z   dz         j	                  d      }t        j                  ||      }|rd}	nd}	g }
t        j                  j                  ||||      D ]Q  }d}	 |j                  }|j                         }|j&                  |   }|j)                  |t+        j,                  |		      t.        j0                  j3                  |      
      D ]  }|s|j5                  |t        j                  z   dz   ||z
  |      }|j7                         sA|j9                  |j;                         t=        t?        j@                         t?        j@                                     }| jC                  ||       | jE                  |||||      D ]  }||
v r |
jG                  |       |   T y # t        j                  $ rE}t        j                  dj!                  ||j"                  |j$                               Y d }~d }~ww xY ww)N_SERVICE_RECORDTagrV   s   serHs   sErv)rQ   ro   rR   filter_funcUnknownz*Process {}: invalid address {} in layer {})needle)rQ   scannersectionsr   )$ra   rK   r
   r   relative_child_offsetr   is_vista_or_laterr   r;   list_processesUniqueProcessIdadd_process_layerr   ry   rz   debugformatinvalid_addressro   layersscanr   BytesScannerr   r=   get_vad_mapsr   r   r   rL   r   r   r   rO   r   append)r?   rQ   ro   rR   r   r   r   relative_tag_offsetr   service_tagseentaskproc_idr   excplayerrF   rA   r   s                      r,   r&   zSvcScan.service_scan  s'     &22;;/2CC



& 	 %66,
 !K!KMM00!%#	 1 
D  G	.."&"8"8": NN?3E** --[A$00==dC % 
 )%,^^*Y^^;>OO%(;;#2 &4 &N *224 #9#=#=&//1)%5579R9R9T$L ..~|LL*-*M*M*.'+ *T1!N3,,+/)
 55 @GG!5!5t
 s1   BH5G'D3H5H2-:H-'H5-H22H5c                     | j                  |||      }| j                  ||||      }|| j                  |      ni }t        j                  j                  dg      }|||fS )zW
        Data structures and information needed to analyze service information
        zservices.exe)rn   r~   r   r   r;   create_name_filter)	r?   rQ   rS   ro   rR   r   r   r   r   s	            r,   get_prereq_infozSvcScan.get_prereq_infoc  s~     !66\;
 ++[*l
 ' ''5 	 mm667GH!#9;FFr-   c              #   V  K   | j                   j                  | j                  d      }| j                  | j                   | j                  |j
                  |j                        \  }}}| j                  | j                   |j
                  |j                  |||      D ]  }d|f 
 y w)Nr0   r   )rQ   modulesconfigr   rS   ro   symbol_table_namer'   )r(   r0   r   r   r   records         r,   
_generatorzSvcScan._generator{  s     %%dkk(&;<BFBVBVLL$**F,=,=v?W?WC
?2K ..LL$$"
F f+
s   B'B)c                     t        j                  dt        j                  fdt        fdt        fdt
        fdt
        fdt
        fdt
        fdt
        fd	t
        fd
t
        fdt
        fg| j                               S )NOffsetrG   PIDrI   rJ   TypeNameDisplayBinaryzBinary (Registry)Dll)r   TreeGridr   rD   intstrr   )r(   s    r,   runzSvcScan.run  s|    !!<++,###C 3$c* OO
 	
r-   )7__name__
__module____qualname____doc___required_framework_version_versionr%   classmethodr   r   rt   RequirementInterfacer@   staticmethodr   ObjectInterfacer   rO   r   is_win10_25398_or_lateris_win10_19041_or_lateris_win10_18362_or_lateris_win10_17763_or_lateris_win10_16299_or_lateris_win10_15063is_win10_up_to_15063is_windows_8_or_laterr   is_windows_xpis_xp_or_2003rP   r   OsDistinguisherboolr   __annotations__rQ   ContextInterfacern   r   rv   r~   r   r   BaseAbsentValuer   r   r   r   r   r&   r   r   r   __classcell__)r+   s   @r,   r   r   &   s   %"+H5 
j&>&>&S&S!T 
 
, 
"**::
&
 
( 
	)	)41KL		)	)41KL		)	)52LM		)	)41KL		)	)52LM		)	)52LM		)	)41KL		)	)52LM		 	 $(BC		 	 %)CD		&	&.AB		&	&/BC		'	'/BC		'	'/BC		#	#T+?@		#	#U,@A			(9:			'=>%O4h&>&>c&I JK * $
##44$
$
 $
 
	$
 $
L !/2BE	'$$	% < /	sJ((888	9/ /2 /	sJ((888	9/ /( 

 ((88

	c$$	%

 

 E E@ M-##44M- M- 	M-
  M- M-^ Gs GRU G G."
r-   r   )-loggingri   typingr   r   r   r   r   r   r	   volatility3.frameworkr
   r   r   r   r   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   %volatility3.framework.symbols.windowsr   0volatility3.framework.symbols.windows.extensionsr   rl   volatility3.plugins.windowsr   r   r   $volatility3.plugins.windows.registryr   	getLoggerr   rz   r   r   r   pluginsPluginInterfacer   rW   r-   r,   <module>r     s   
  	 G G G  = 1 8 2 : W H H 9			8	$ 	c://???@A	5j22BBBCD v
j  00 v
r-   