X fd) ddlZddlmZmZmZmZmZmZddlm Z m Z m Z ddl m Z ddlmZddlmZddlmZejeZdd d d d d ddddddd ZGdde jjZdS)N)CallableList GeneratorIterableTypeOptional) renderers interfaces exceptions) requirements)utility) format_hints)pslist @ii@) PAGE_NOACCESS PAGE_READONLYPAGE_READWRITEPAGE_WRITECOPY PAGE_EXECUTEPAGE_EXECUTE_READPAGE_EXECUTE_READWRITEPAGE_EXECUTE_WRITECOPY PAGE_GUARD PAGE_NOCACHEPAGE_WRITECOMBINEPAGE_TARGETS_INVALIDceZdZdZdZdZdZfdZede e j j fdZ ede jjd ed edeefd Zed fd e jjdee jjgefdee jjddffdZeefde jjd e jjde jjdee jjdedee jjf dZdZdZ xZ!S)VadInfozLists process memory ranges.)rrrrrrrcHtj|i|d|_dS)N)super__init___protect_values)selfargskwargs __class__s _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadinfo.pyr+zVadInfo.__init__(s-$)&)))#returnc @tjddddgtjddd tjd d td tjd t jdtjddddtjdd|j dgS)NkernelzWindows kernelIntel32Intel64)name description architecturesaddresszRProcess virtual memory address to include (all other address ranges are excluded).T)r8r9optionalpidzFilter on specific process IDs)r8r9 element_typer<rr()r8pluginversiondumpzExtract listed memory rangesF)r8r9defaultr<maxsizezNMaximum size for dumped VAD sections (all the bigger sections will be ignored)) r ModuleRequirementIntRequirementListRequirementintPluginRequirementrPsListBooleanRequirementMAXSIZE_DEFAULT)clss r1get_requirementszVadInfo.get_requirements,s  *,()4     ';      (<       *fmY     +:      '<+    9# # r2context layer_name symbol_tablec|j|jd}||||}|dj}|d||dd}|S)aLook up the array of memory protection constants from the memory sample. These don't change often, but if they do in the future, then finding them dynamically versus hard-coding here will ensure we parse them properly. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols kernel_virtual_offset)rOoffsetMmProtectToValuearrayrGr) object_typerSsubtypecount)layersconfigmodule get_symbolr;objectget_type)rLrNrOrPkvontkrnlmpaddrvaluess r1protect_valueszVadInfo.protect_valuesTs~$nZ(/0GH>>,:c>RR""#566>h6G6G6N6NVX!   r2cdSNF_s r1zVadInfo.tser2proc filter_funcNc#zK|D]}||s|VdS)aLists the Virtual Address Descriptors of a specific process. Args: proc: _EPROCESS object from which to list the VADs filter_func: Function to take a virtual address descriptor value and return True if it should be filtered out Returns: A list of virtual address descriptors based on the process and filtered based on the filter function N) get_vad_roottraverse)rLrjrkvads r1 list_vadszVadInfo.list_vadsnsU"$$&&//11  C;s##    r2ro open_methodrCc |}|}n+#t$rtdYdSwxYwd|cxkr|kr(nn%td|dd|dddSd} |j}|} nV#tj $rD} td || j | j Yd} ~ dSd} ~ wwxYw|j | } d |d |dd|dd } || } d }|}|}|||zkrTt|||z|z }| ||d}|sn#| |||z }|||zkTn8#t"$r+} td| d| Yd} ~ dSd} ~ wwxYw| S)a/Extracts the complete data for Vad as a FileInterface. Args: context: The context to retrieve required elements (layers, symbol tables) from proc: an _EPROCESS instance vad: The suspected VAD to extract (ObjectInterface) open_method: class to provide context manager for opening the file maxsize: Max size of VAD section (default MAXSIZE_DEFAULT) Returns: An open FileInterface object containing the complete data for the process or None in the case of failure z-Unable to find the starting/ending VPN memberNrzSkip VAD dump z#x-z due to maxsize limitUnknownz*Process {}: invalid address {} in layer {}zpid.z.vad.z.dmpiT)padzUnable to dump VAD z: ) get_startget_endAttributeErrorvollogdebugget_sizeUniqueProcessIdadd_process_layerr InvalidAddressExceptionformatinvalid_addressrOrYminreadwrite Exception)rLrNrjrorqrC vad_startvad_endproc_idproc_layer_nameexcp proc_layer file_name file_handle chunk_sizerSvad_sizeto_readdatas r1vad_dumpzVadInfo.vad_dumps|,  IkkmmGG    LLH I I I44  w ' ' ' ' ' ' ' ' ' LLQQQQQQQQ   4 *G"4466OO1    LL<CCT14?    44444  ^O4 H7HHHHHHHHH  %+i00K)JF||~~H9x///j)h*>*GHH!vwDAA!!$''''! 9x///    LLByBBDBB C C C44444 s@(+$AA B<<D 9D  D.BF// G$9 GG$c#Kjjjd}jj|j}dt jjdtfd}|}j dd dt jjdtffd }|}|D]}tj |j } ||D]} d } jd rMj|| jjd } d } | r| | j} d |j|t'j|| jjt'j| t'j| | | j|j|jt<| | t'j| !| "| f fVdS)Nr5rhr3cdSrerfrgs r1 passthroughz'VadInfo._generator..passthroughs5r2r;xc|jdcxko|knc S)Nr;)rvrZrw)rr-s r1filter_functionz+VadInfo._generator..filter_functions?KKMMT[-CRRRRqyy{{RRRRSSr2)rkDisabledrArCzError outputting filer)#rNmodulesrZrYrOr objectsObjectInterfaceboolgetr array_to_string ImageFileNamerpropenclosepreferred_filenamer|rHex canonicalizevolrSrvrwget_tagget_protectionrcsymbol_table_namewinnt_protectionsget_commit_chargeget_private_memory get_parent get_file_name) r-procsr5 kernel_layerrrkrrj process_namero file_outputrs ` r1 _generatorzVadInfo._generatorsv%dk(&;<|*6+<=  :-= $    " ;??9d + + 7 T:#5#E T$ T T T T T T*K% % D"243EFFL~~d ~DD" " ( ;v&E"&-- dCDK )R)RSS$(99$(77 ** // $ & 1 & 8 . --//..00$()9)9::))++#'" % % r2cD|jj|jd}tj|jdd}tjdtfdtfdtj fdtj fdtj fdtfd tfd tfd tfd tj fd tfdtfg | tj|j|j|j|S)Nr5r=PIDProcessOffsetz Start VPNzEnd VPNTag Protection CommitCharge PrivateMemoryParentFilez File output)rNrOrPrk)rNrrZrrIcreate_pid_filterrr TreeGridrGstrrrrlist_processesrOr)r-r5rks r1runz VadInfo.runs%dk(&;<m55dkooeT6R6RSS ! C <+,l./L,- s#% #&<+, $  OO ,, L%0!'!9 + -     r2)"__name__ __module__ __qualname____doc___required_framework_version_versionrKr+ classmethodrr configurationRequirementInterfacerMrNContextInterfacerrrGrcrrrrrrprpluginsFileHandlerInterfacerrrr __classcell__)r0s@r1r'r'!s&&"+H(O$$$$$% j&>&S!T% % % [% N#4  # [2 O  0   / 0$ 6  :%5tTA B [(' AA#4A 0A  / A *,AB A  A *$9 :AAA[AF444l       r2r')loggingtypingrrrrrrvolatility3.frameworkr r r #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersrvolatility3.plugins.windowsr getLoggerrryrrPluginInterfacer'rfr2r1rs/ FFFFFFFFFFFFFFFFCCCCCCCCCC<<<<<<111111888888......  8 $ $""&   x x x x x j 0x x x x x r2