
    [
#g                         d dl mZmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ  G d dej@                  jB                        Z"y)    )Iterable	GeneratorListTuple)	constants
interfaces	renderers)requirements)RequirementInterface)ObjectInterface)BytesDataFormatInfoInteger
StructType)ObjectTemplate)array_to_string)format_hints)intermed)pe)modulesc            	           e Zd ZdZdZdZedee   fd       Z	de
dedeee
ef   ddf   fd	Zd
 Zdej"                  fdZy)
Passphrasez"TrueCrypt Cached Passphrase Finder)r      r   )      r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
dd      gS )NkernelzWindows kernelIntel32Intel64)descriptionarchitecturesr   )r   r   r   )name	componentversion
min-lengthz)Minimum length of passphrases to identifyr   T)r#   r!   defaultoptional)r
   ModuleRequirementVersionRequirementr   ModulesIntRequirement)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/truecrypt.pyget_requirementszPassphrase.get_requirements   sa     **,()4
 ++'//9 ''!G	
 	
    module_base
layer_nameNc              #   r  K   t         j                  j                  | j                  | j                  ddt
        j                        }| j                  j                  |t        j                  z   dz   ||      }t        d |j                         j                         D              }|j                  |z   }|j                  j                  }d}t!        |dd	      }	t#        t$        |t        j                  z   d
z   |	      }
t'        ||      \  }}|rt)        d      | j                  j                  |t        j                  z   dz   ||||
      }| j*                  j-                  d      }|D ]  }||cxk  rdk  sn |j.                  d   |z   }| j                  j                  |t        j                  z   dz   |||      }t1        d |D              si| j                  j                  |t        j                  z   dz   |||z   dz   d      }t3        |      r||j5                  d      f  yw)a/  Scans the TrueCrypt kernel module for cached passphrases.

        Args:
            module_base: the module's DLL base
            layer_name: the name of the layer in which the module resides

        Generates:
            A tuple of the offset at which a password is found, and the password
        windowsr   )class_types_IMAGE_DOS_HEADERc              3   P   K   | ]  }t        |j                        d k(  r|   yw)z.dataN)r   Name).0secs     r.   	<genexpr>z)Passphrase.scan_module.<locals>.<genexpr>B   s)      (
sxx(G3 (
s   $&   littleT)length	byteordersignedint)data_formatz"PE data section not DWORD-aligned!array)countsubtyper&   @   offsetbytes)r>   c              3   <   K   | ]  }d |cxk  xr dk  nc   yw)       N )r9   cs     r.   r;   z)Passphrase.scan_module.<locals>.<genexpr>j   s     <Atq'4''<s   r      ascii)encodingN)r   IntermediateSymbolTablecreatecontextconfig_pathr   r5   objectr   BANGnextget_nt_headerget_sectionsVirtualAddressMiscVirtualSizer   r   r   divmod
ValueErrorconfiggetvolallanydecode)selfr1   r2   pe_table_name
dos_headerdata_sectionbasesizeDWORD_SIZE_BYTESformatint32rD   not_alignedlengths
min_lengthr>   rG   
passphrasebufs                      r.   scan_modulezPassphrase.scan_module.   s7     !88??LL$**It @ 
 +/,,*=*=INN*-@@+


 $( (
!//1>>@(
 $

 !//+= %%11 !#x
 ]Y^^3e;
 $D*:;{ABB,,%%INN*W4 & 
 [[__\2
F -2-ZZ),<<F $ 3 3	.8	 !4 !J <<< ,,	.8!#	 - C 3x*++W+===7 s   H5H7c              #     K   | j                   j                  | j                  d      }t        j                  j	                  | j                   |j
                  |j                        }t        d |D              }| j                  ||j
                        D ]*  \  }}dt        j                  |      t        |      |ff , y w)Nr   c              3      K   | ];  }|j                   j                         j                         d k(  r|j                   = yw)ztruecrypt.sysN)BaseDllName
get_stringlowerDllBase)r9   mods     r.   r;   z(Passphrase._generator.<locals>.<genexpr>~   s:      %
))+113F KK%
s   AAr   )rS   r   r_   r+   list_modulesr2   symbol_table_namerW   rs   r   Hexlen)re   r   modstruecrypt_module_baserG   passwords         r.   
_generatorzPassphrase._generatory   s     %%dkk(&;<*1//*F*FLL&++V-E-E+
 !% %
%
 !

 !% 0 0!6#4#4!
FH |''/XIJJ!
s   CCc                     t        j                  dt        j                  fdt        fdt
        fg| j                               S )NOffsetLengthPassword)r	   TreeGridr   r}   rA   strr   )re   s    r.   runzPassphrase.run   sC    !!<++,3S!
 OO
 	
r0   )__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r   r/   rA   r   r   r   rs   r   r	   r   r   rL   r0   r.   r   r      s}    ,H"+
&:!; 
 
$I>I>,/I>	5c?D$.	/I>VK
Y'' 
r0   r   N)#typingr   r   r   r   volatility3.frameworkr   r   r	   #volatility3.framework.configurationr
   .volatility3.framework.interfaces.configurationr   (volatility3.framework.interfaces.objectsr   volatility3.framework.objectsr   r   r   r   'volatility3.framework.objects.templatesr   %volatility3.framework.objects.utilityr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   pluginsPluginInterfacer   rL   r0   r.   <module>r      sN   
 4 3 B B < O D T T B A 8 2 ? /{
##33 {
r0   