X fd) ddlZddlmZmZmZmZmZmZddlm Z m Z m Z ddl m Z ddlmZddlmZddlmZej(eZdd d d d d ddddddd ZGdde j0j2Zy)N)CallableList GeneratorIterableTypeOptional) renderers interfaces exceptions) requirements)utility) format_hints)pslist @ii@) PAGE_NOACCESS PAGE_READONLYPAGE_READWRITEPAGE_WRITECOPY PAGE_EXECUTEPAGE_EXECUTE_READPAGE_EXECUTE_READWRITEPAGE_EXECUTE_WRITECOPY PAGE_GUARD PAGE_NOCACHEPAGE_WRITECOMBINEPAGE_TARGETS_INVALIDceZdZdZdZdZdZfdZede e jjfdZ ede jjd ed edeefd Zed fd e j(j*dee j(j*gefdee j(j*ddffdZeefde jjd e j(j*de j(j*dee j6j8dedee j6j8f dZdZdZ xZ!S)VadInfozLists process memory ranges.)rrrrrrrc2t||i|d|_y)N)super__init___protect_values)selfargskwargs __class__s _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/vadinfo.pyr+zVadInfo.__init__(s $)&)#returnc \tjddddgtjddd tjd d td tj d t jdtjddddtjdd|jdgS)NkernelzWindows kernelIntel32Intel64)name description architecturesaddresszRProcess virtual memory address to include (all other address ranges are excluded).T)r8r9optionalpidzFilter on specific process IDs)r8r9 element_typer<rr()r8pluginversiondumpzExtract listed memory rangesF)r8r9defaultr<maxsizezNMaximum size for dumped VAD sections (all the bigger sections will be ignored)) r ModuleRequirementIntRequirementListRequirementintPluginRequirementrPsListBooleanRequirementMAXSIZE_DEFAULT)clss r1get_requirementszVadInfo.get_requirements,s  * *,()4   ' ';    ( (<     * *fmmY   + +:    ' '<++  9# # r2context layer_name symbol_tablec|j|jd}|j|||}|jdj}|j d||j dd}|S)aLook up the array of memory protection constants from the memory sample. These don't change often, but if they do in the future, then finding them dynamically versus hard-coding here will ensure we parse them properly. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols kernel_virtual_offset)rOoffsetMmProtectToValuearrayrGr) object_typerSsubtypecount)layersconfigmodule get_symbolr;objectget_type)rLrNrOrPkvontkrnlmpaddrvaluess r1protect_valueszVadInfo.protect_valuesTsx$nnZ(//0GH>>,:c>R""#56>>h6G6G6NVX!  r2cyNF_s r1zVadInfo.tsr2proc filter_funcNc#lK|jjD]}||r |yw)aLists the Virtual Address Descriptors of a specific process. Args: proc: _EPROCESS object from which to list the VADs filter_func: Function to take a virtual address descriptor value and return True if it should be filtered out Returns: A list of virtual address descriptors based on the process and filtered based on the filter function N) get_vad_roottraverse)rLrjrkvads r1 list_vadszVadInfo.list_vadsns6"$$&//1 Cs#  s*44ro open_methodrCcr |j}|j}d|cxkr|j kr"nntj d|dd|ddyd} |j }|j} |j| } d |d |dd|dd } || } d }|}|j }|||zkrJt|||z|z }| j||d}|s | S| j!|||z }|||zkrJ| S#t$rtj dYywxYw#tj$rD} tj d j|| j| jYd} ~ yd} ~ wwxYw#t"$r%} tj d| d| Yd} ~ yd} ~ wwxYw)a/Extracts the complete data for Vad as a FileInterface. Args: context: The context to retrieve required elements (layers, symbol tables) from proc: an _EPROCESS instance vad: The suspected VAD to extract (ObjectInterface) open_method: class to provide context manager for opening the file maxsize: Max size of VAD section (default MAXSIZE_DEFAULT) Returns: An open FileInterface object containing the complete data for the process or None in the case of failure z-Unable to find the starting/ending VPN memberNrzSkip VAD dump z#x-z due to maxsize limitUnknownz*Process {}: invalid address {} in layer {}zpid.z.vad.z.dmpiT)padzUnable to dump VAD z: ) get_startget_endAttributeErrorvollogdebugget_sizeUniqueProcessIdadd_process_layerr InvalidAddressExceptionformatinvalid_addressrOrYminreadwrite Exception)rLrNrjrorqrC vad_startvad_endproc_idproc_layer_nameexcp proc_layer file_name file_handle chunk_sizerSvad_sizeto_readdatas r1vad_dumpzVadInfo.vad_dumps,  IkkmG w ' ' LL 2a|;PQ  **G"446O^^O4 7)52a|4H  %i0K)JF||~H9x//j)h*>*GH!vwDA!!$''! 9x//S  LLH I 11  LL<CCT114??    .  LL.ykD6B C sH D D.A F)F D+*D+.F:FF F6F11F6c#&Kjjjd}jj|j}dt j jdtfd}|}jjdd(dt j jdtffd }|}|D]}tj|j}j||D]} d } jd rVjj|| jjd } d } | r| j!| j"} d |j$|t'j(|j+| j,j.t'j(| j1t'j(| j3| j5| j7j9j|j|j:t<| j?| jAt'j(| jC| jE| f fyw)Nr5rhr3cyrerfrgs r1 passthroughz'VadInfo._generator..passthroughsr2r;xcz|jjdcxkxr|jk Sc S)Nr;)rvrZrw)rr-s r1filter_functionz+VadInfo._generator..filter_functions4KKMT[[-CRqyy{RSSRSSr2)rkDisabledrArCzError outputting filer)#rNmodulesrZrYrOr objectsObjectInterfaceboolgetr array_to_string ImageFileNamerpropenclosepreferred_filenamer|rHex canonicalizevolrSrvrwget_tagget_protectionrcsymbol_table_namewinnt_protectionsget_commit_chargeget_private_memory get_parent get_file_name) r-procsr5 kernel_layerrrkrrj process_namero file_outputrs ` r1 _generatorzVadInfo._generators)%%dkk(&;<||**6+<+<=  :--== $ " ;;??9d + 7 T:#5#5#E#E T$ T*K% D"2243E3EFL~~d ~D" ( ;;v&"&-- dCDKK >)RS$((9$((7 ** // $ & 1 1 & 8 8 . --/..0$(()9:))+#'" % sJJc|jj|jd}tjj |jj dd}tjdtfdtfdtjfdtjfdtjfdtfd tfd tfd tfd tjfd tfdtfg |jtjj|j|j|j |S)Nr5r=PIDProcessOffsetz Start VPNzEnd VPNTag Protection CommitCharge PrivateMemoryParentFilez File output)rNrOrPrk)rNrrZrrIcreate_pid_filterrr TreeGridrGstrrrrlist_processesrOr)r-r5rks r1runz VadInfo.runs%%dkk(&;<mm55dkkooeT6RS !! C <++,l../L,,- s#% #&<++, $  OO ,, LL%00!'!9!9 + -   r2)"__name__ __module__ __qualname____doc___required_framework_version_versionrKr+ classmethodrr configurationRequirementInterfacerMrNContextInterfacerrrGrcrrrrrrprpluginsFileHandlerInterfacerrrr __classcell__)r0s@r1r'r'!s&"+H(O$% j&>&>&S&S!T% % N##44  # 2    00    / / 0$ 6  :%%55tTA B (' A##44A  00A   / / A *,,AAB A  A *$$99 :AAF4l r2r')loggingtypingrrrrrrvolatility3.frameworkr r r #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersrvolatility3.plugins.windowsr getLoggerrryrrPluginInterfacer'rfr2r1rs| FFCC<18.   8 $""&  x j  00x r2