
    Xf)                     8   d dl Z d dlZd dlZd dlmZmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZmZmZ  ej        e          Z	 d dlZn# e$ r e                     d
            w xY w G d dej!        j"                  Z#dS )    N)	GeneratorListTupleOptional)
exceptions	renderers	constants
interfaces)requirements)scanners)format_hints)intermed)pe)pslistmodulesdlllistzLPython pefile module not found, plugin (and dependent plugins) not availablec                   ~   e Zd ZdZdZdZedeej	        j
                 fd            Zedej        j        dededeeeeeef                  fd	            Zedej        j        d
edededeeeeef         f
d            Zdeej        j        ddf         deej        j        ddf         deeddf         fdZd ZdS )VerInfoz(Lists version information from PE files.   r   r      r   r   returnc           
      $   t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d
          t          j        dt          j	        d          t          j
        dddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   r   r   )r   	componentr"   	extensivez-Search physical layer for version informationTF)r   r   optionaldefault)r   ModuleRequirementPluginRequirementr   PsListr   ModulesVersionRequirementr   DllListBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/verinfo.pyget_requirementszVerInfo.get_requirements#   s    
 *,()4  
 *fmY   *w	   +'/9   + K	  
 	
    context
layer_namefilenamec           
         d}d|z   }|j         |                             |t          j        t	          |d                              }|D ]}|j         |                             ||z
  |          }d}|                    |          t          |          z   }	|	dk    rFd}
t          j	        |
||	|	t          j
        |
          z                      \	  }}}}}}}}}||||fc S dS )	zSearches for an original filename, then tracks back to find the VS_VERSION_INFO and read the fixed
        version information structurei   zOriginalFilename zutf-16be)r2   scanners   r   z
<IHHHHHHHHN)layersscanr   BytesScannerbytesreadfindlenstructunpackcalcsize)r.   r2   r3   r4   premable_max_distanceiteratoroffsetdatavs_ver_infoverinfo_offset	structurestruct_versionFV2FV1FV4FV3PV2PV1PV4PV3s                       r/   find_version_infozVerInfo.find_version_info>   s%    !&)H4>*-22X%:5:;V;V%W%W 3 
 
  	, 	,F>*-22..0E D .K!YY{33c+6F6FFN""(	IO.6?9;U;U*UUVJ JFS#sCc3 S#s++++ # tr1   pe_table_namebase_addressc                    |t          d          t          j                    }|                    |t          j        z   dz   ||          }|                                D ]/\  }}|                    |           |                    |           0t          j
        |                                d          }	 |	j        t          j        d         g           t          |	j        t                     r|	j        d         }
n|	j        }
|
j        d	z	  }|
j        d
z  }|
j        d	z	  }|
j        d
z  }|                                 ||||fS )aA  Get File and Product version information from PE files.

        Args:
            context: volatility context on which to operate
            pe_table_name: name of the PE table
            layer_name: name of the layer containing the PE file
            base_address: base address of the PE (where MZ is found)
        NzLayer must be a string not None_IMAGE_DOS_HEADER)rC   r3   T)rD   	fast_loadIMAGE_DIRECTORY_ENTRY_RESOURCEr      i  )	TypeErrorioBytesIOobjectr	   BANGreconstructseekwritepefilePEgetvalueparse_data_directoriesDIRECTORY_ENTRY
isinstanceVS_FIXEDFILEINFOlistProductVersionMSProductVersionLSclose)r.   r2   rR   r3   rS   pe_data
dos_headerrC   rD   r   version_structmajorminorproductbuilds                  r/   get_version_informationzVerInfo.get_version_information[   s`   " =>>>*,,^^IN*-@@! $ 
 

 '2244 	  	 LFDLL   MM$YG,,..$???!!#$DEF	
 	
 	
 b)400 	103NN  0N/25/&8 1R7/&8eWe++r1   procsNmodssession_layersc              #   r  K   | j         j        | j        d                  }t          j                            | j         | j        ddt          j                  }| j         j	        |j
                 j                            dd          }|D ]m}	 |j                                        }n(# t          j        $ r t!          j                    }Y nw xY wt          j                            | j         ||j                  }		 |                     | j        ||	|j                  \  }
}}}n# t          j        t.          t0          f$ rm t!          j                    gdz  \  }
}}}t3          |t           j                  s4|2| j        d         r%|                     | j        ||          }||\  }
}}}Y nw xY wd	t!          j                    t!          j                    t9          j        |j                  ||
|||ffV  o|D ]}d
}	 |j        }|                                }nU# t          j        $ rC}t@          !                    d"                    ||j#        |j
                             Y d}~od}~ww xY w|$                                D ]-}	 |j                                        }n(# t          j        $ r t!          j                    }Y nw xY w	 t9          j        |j                  }n(# t          j        $ r t!          j                    }Y nw xY w	 |                     | j        |||j                  \  }
}}}n># t          j        tJ          t0          f$ r t!          j                    gdz  \  }
}}}Y nw xY wd	|j        |j&        '                    d|j&        j(        j)        d          |||
|||ffV  /dS )a  Generates a list of PE file version info for processes, dlls, and
        modules.

        Args:
            procs: <generator> of processes
            mods: <generator> of modules
            session_layers: <generator> of layers in the session to be checked
        r   windowsr   )class_typesmemory_layerN   r$   r   Unknownz*Process {}: invalid address {} in layer {}stringreplace)
max_lengtherrors)*r2   r   configr   IntermediateSymbolTablecreateconfig_pathr   ry   r7   r3   getBaseDllName
get_stringr   InvalidAddressExceptionr   UnreadableValuer*   find_session_layerDllBasers   _contextrY   AttributeErrorrf   rQ   NotApplicableValuer   HexUniqueProcessIdadd_process_layervollogdebugformatinvalid_addressload_order_modules
ValueErrorImageFileNamecastvolcount)selfrt   ru   rv   r   rR   physical_layer_namemodr   session_layer_namero   rp   rq   rr   resultprocproc_idproc_layer_nameexcpentryr   s                        r/   
_generatorzVerInfo._generator   s~      %dk(&;< 8??L$*It @ 
 

 #l1&2CDKOOD
 
  '	 '	C:!o88::5 : : :'799: ")!C!Cnck" "@151M1MM=2Dck2 2.w 6	>R @ @ @2;2K2M2M1NQR1R.w";	0IJJ	@+7K0 8 "33':K F )9?6w@ 022022 $S[11	      /	 /	DG	."&"8"8":":5   @GG!5t   
  0022 " ">"'"3">">"@"@KK!9 > > >"+";"="=KKK>:*.u}==GG!9 : : :'799GGG:W595Q5Q}ou}6 62UE7EE #:JW W W W6?6O6Q6Q5RUV5V2UE7EEEW ,*//$'+'9'='C#, 0  
  #    %"/	 /	ss   B(("CC<'D$$BF-,F-HI/,9I**I/
J$$"K	K	K''"LL'L888M32M3c                 :   | j         j        | j        d                  }t          j                            | j         |j        |j                  }t          j        	                    | j         |j        |j                  }t          j        
                    | j         |j        |j                  }t          j        dt          fdt          fdt          j        fdt          fdt          fdt          fdt          fd	t          fg|                     |||                    S )
Nr   PIDProcessBaseNameMajorMinorProductBuild)r2   r   r   r   r)   list_processesr3   symbol_table_namer*   list_modulesget_session_layersr   TreeGridintstrr   r   r   )r   r   rt   ru   rv   s        r/   runzVerInfo.run  s    %dk(&;<,,L&+V-E
 
 ++L&+V-E
 

 !;;L&+V-E
 
 !C )*##C #	 OOE488
 
 	
r1   )__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r
   configurationRequirementInterfacer0   r2   ContextInterfacer   r   r   r   rQ   rs   r   objectsObjectInterfacer   r    r1   r/   r   r      s       22H"+
j&>&S!T 
 
 
 [
4 #4  	
 
%S#s*+	,   [8 2,#42, 2, 	2,
 2, 
sCc!	"2, 2, 2, [2,hr+;T4GHr 
*:D$FGr "#tT/2	r r r rh
 
 
 
 
r1   r   )$rZ   loggingr>   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   r   r   	getLoggerr   r   ra   ImportErrorinfopluginsPluginInterfacer   r   r1   r/   <module>r      s  
 
			   3 3 3 3 3 3 3 3 3 3 3 3 N N N N N N N N N N N N < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 2 2 2 2 2 2 ? ? ? ? ? ? @ @ @ @ @ @ @ @ @ @		8	$	$
MMMM 
 
 

KKV   
	
C
 C
 C
 C
 C
j 0 C
 C
 C
 C
 C
s   A# #A?