
    *1f                         d dl mZmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ  G d dej         j!                  Z"dS )    )Iterable	GeneratorListTuple)	constants
interfaces	renderers)requirements)RequirementInterface)ObjectInterface)BytesDataFormatInfoInteger
StructType)ObjectTemplate)array_to_string)format_hints)intermed)pe)modulesc            	           e Zd ZdZdZdZedee         fd            Z	de
dedeee
ef         ddf         fd	Zd
 Zdej        fdZdS )
Passphrasez"TrueCrypt Cached Passphrase Finder)r      r   )      r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	d
dd          gS )NkernelzWindows kernelIntel32Intel64)descriptionarchitecturesr   )r   r   r   )name	componentversion
min-lengthz)Minimum length of passphrases to identifyr   T)r#   r!   defaultoptional)r
   ModuleRequirementVersionRequirementr   ModulesIntRequirement)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/truecrypt.pyget_requirementszPassphrase.get_requirements   st     *,()4  
 +'/9   '!G	  
 	
    module_base
layer_nameNc              #   ^  K   t           j                            | j        | j        ddt
          j                  }| j                            |t          j	        z   dz   ||          }t          d |                                                                D                       }|j        |z   }|j        j        }d}t!          |dd	          }	t#          t$          |t          j	        z   d
z   |	          }
t'          ||          \  }}|rt)          d          | j                            |t          j	        z   dz   ||||
          }| j                            d          }|D ]}||cxk    rdk    sn |j        d         |z   }| j                            |t          j	        z   dz   |||          }t1          d |D                       sj| j                            |t          j	        z   dz   |||z   dz   d          }t3          |          r||                    d          fV  dS )a/  Scans the TrueCrypt kernel module for cached passphrases.

        Args:
            module_base: the module's DLL base
            layer_name: the name of the layer in which the module resides

        Generates:
            A tuple of the offset at which a password is found, and the password
        windowsr   )class_types_IMAGE_DOS_HEADERc              3   J   K   | ]}t          |j                  d k    |V  dS )z.dataN)r   Name).0secs     r.   	<genexpr>z)Passphrase.scan_module.<locals>.<genexpr>B   sC       (
 (
sx((G33 3333(
 (
r0      littleT)length	byteordersignedint)data_formatz"PE data section not DWORD-aligned!array)countsubtyper&   @   offsetbytes)r>   c              3   6   K   | ]}d |cxk    odk     nc V  dS )       N )r9   cs     r.   r;   z)Passphrase.scan_module.<locals>.<genexpr>j   s>      <<Atq''''4''''<<<<<<r0   r      ascii)encodingN)r   IntermediateSymbolTablecreatecontextconfig_pathr   r5   objectr   BANGnextget_nt_headerget_sectionsVirtualAddressMiscVirtualSizer   r   r   divmod
ValueErrorconfiggetvolallanydecode)selfr1   r2   pe_table_name
dos_headerdata_sectionbasesizeDWORD_SIZE_BYTESformatint32rD   not_alignedlengths
min_lengthr>   rG   
passphrasebufs                      r.   scan_modulezPassphrase.scan_module.   s      !8??L$*It @ 
 
 +/,*=*=IN*-@@+
 +


 $( (
 (
!//11>>@@(
 (
 (
 $
 $

 !/+= %1 !#x
 
 
 ]Y^3e;
 
 
 $D*:;;{ 	CABBB,%%IN*W4 & 
 
 [__\22
 	> 	>F ----2----Z),<<F $ 3 3	.8	 !4 ! !J <<<<<<<  ,,	.8!#	 -  C 3xx *++W+=======7	> 	>r0   c              #   h  K   | j         j        | j        d                  }t          j                            | j         |j        |j                  }t          d |D                       }|                     ||j                  D ]-\  }}dt          j
        |          t          |          |ffV  .d S )Nr   c              3      K   | ]:}|j                                                                         d k    1|j        V  ;dS )ztruecrypt.sysN)BaseDllName
get_stringlowerDllBase)r9   mods     r.   r;   z(Passphrase._generator.<locals>.<genexpr>~   sU       %
 %
))++1133FF KFFFF%
 %
r0   r   )rS   r   r_   r+   list_modulesr2   symbol_table_namerW   rs   r   Hexlen)re   r   modstruecrypt_module_baserG   passwords         r.   
_generatorzPassphrase._generatory   s      %dk(&;<*1/*F*FL&+V-E+
 +
 !% %
 %
%
 %
 %
 !
 !

 !% 0 0!6#4!
 !
 	K 	KFH |'//XIJJJJJ	K 	Kr0   c                     t          j        dt          j        fdt          fdt
          fg|                                           S )NOffsetLengthPassword)r	   TreeGridr   r}   rA   strr   )re   s    r.   runzPassphrase.run   sE    !<+,3S!
 OO
 
 	
r0   )__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r   r/   rA   r   r   r   rs   r   r	   r   r   rL   r0   r.   r   r      s        ,,H"+
&:!; 
 
 
 [
$I>I>,/I>	5c?D$.	/I> I> I> I>VK K K
Y' 
 
 
 
 
 
r0   r   N)#typingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   .volatility3.framework.interfaces.configurationr   (volatility3.framework.interfaces.objectsr   volatility3.framework.objectsr   r   r   r   'volatility3.framework.objects.templatesr   %volatility3.framework.objects.utilityr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   pluginsPluginInterfacer   rL   r0   r.   <module>r      sS  
 4 3 3 3 3 3 3 3 3 3 3 3 B B B B B B B B B B < < < < < < O O O O O O D D D D D D T T T T T T T T T T T T B B B B B B A A A A A A 8 8 8 8 8 8 2 2 2 2 2 2 ? ? ? ? ? ? / / / / / /{
 {
 {
 {
 {
#3 {
 {
 {
 {
 {
r0   