
    [
#g)                     >   d dl Z d dlZd dlZd dlmZmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZmZmZ  ej6                  e      Z	 d dlZ G d dejB                  jD                        Z#y# e$ r ejA                  d
        w xY w)    N)	GeneratorListTupleOptional)
exceptions	renderers	constants
interfaces)requirements)scanners)format_hints)intermed)pe)pslistmodulesdlllistzLPython pefile module not found, plugin (and dependent plugins) not availablec                      e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  dededeeeeeef      fd	       Zedej                  j                  d
edededeeeeef   f
d       Zdeej*                  j,                  ddf   deej*                  j,                  ddf   deeddf   fdZd Zy)VerInfoz(Lists version information from PE files.)   r   r      r   r   returnc           
      F   t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
t        j                  d      t        j                  dddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   r   )r   	componentr!   	extensivez-Search physical layer for version informationTF)r   r   optionaldefault)r   ModuleRequirementPluginRequirementr   PsListr   ModulesVersionRequirementr   DllListBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/verinfo.pyget_requirementszVerInfo.get_requirements#   s    
 **,()4
 **fmmY **w	 ++'//9 ++ K	
 	
    context
layer_namefilenamec           
         d}d|z   }|j                   |   j                  |t        j                  t	        |d                  }|D ]  }|j                   |   j                  ||z
  |      }d}|j                  |      t        |      z   }	|	dk\  sJd}
t        j                  |
||	|	t        j                  |
      z          \	  }}}}}}}}}||||fc S  y)	zSearches for an original filename, then tracks back to find the VS_VERSION_INFO and read the fixed
        version information structurei   zOriginalFilename zutf-16be)r1   scanners   r   z
<IHHHHHHHHN)layersscanr   BytesScannerbytesreadfindlenstructunpackcalcsize)r-   r1   r2   r3   premable_max_distanceiteratoroffsetdatavs_ver_infoverinfo_offset	structurestruct_versionFV2FV1FV4FV3PV2PV1PV4PV3s                       r.   find_version_infozVerInfo.find_version_info>   s     !&)H4>>*-22X%:%:5:;V%W 3 
 F>>*-22..0ED .K!YY{3c+6FFN"(	IO.6??9;U*UVJFS#sCc3 S#s++  r0   pe_table_namebase_addressc                    |t        d      t        j                         }|j                  |t        j
                  z   dz   ||      }|j                         D ]'  \  }}|j                  |       |j                  |       ) t        j                  |j                         d      }	 |	j                  t        j                  d   g       t        |	j                  t               r|	j                  d   }
n|	j                  }
|
j"                  dz	  }|
j"                  d	z  }|
j$                  dz	  }|
j$                  d	z  }|j'                          ||||fS )
aA  Get File and Product version information from PE files.

        Args:
            context: volatility context on which to operate
            pe_table_name: name of the PE table
            layer_name: name of the layer containing the PE file
            base_address: base address of the PE (where MZ is found)
        zLayer must be a string not None_IMAGE_DOS_HEADER)rB   r2   T)rC   	fast_loadIMAGE_DIRECTORY_ENTRY_RESOURCEr      i  )	TypeErrorioBytesIOobjectr	   BANGreconstructseekwritepefilePEgetvalueparse_data_directoriesDIRECTORY_ENTRY
isinstanceVS_FIXEDFILEINFOlistProductVersionMSProductVersionLSclose)r-   r1   rQ   r2   rR   pe_data
dos_headerrB   rC   r   version_structmajorminorproductbuilds                  r.   get_version_informationzVerInfo.get_version_information[   sA   " =>>**,^^INN*-@@! $ 

 '224LFDLL MM$ 5 YYG,,.$?!!!##$DEF	
 b))40003N  00N//25//&8 11R7//&8eWe++r0   procsNmodssession_layersc              #   f  K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  ddt        j                        }| j                   j                  |j                     j                  j                  dd      }|D ]  }	 |j                  j                         }t        j$                  j'                  | j                   ||j(                        }		 | j+                  | j,                  ||	|j(                        \  }
}}}d	t!        j6                         t!        j6                         t9        j:                  |j(                        ||
|||ff  |D ]  }d
}	 |j<                  }|j?                         }|jI                         D ]  }	 |j                  j                         }	 t9        j:                  |j(                        }	 | j+                  | j,                  |||j(                        \  }
}}}d	|j<                  |jL                  jO                  d|jL                  jP                  jR                  d      |||
|||ff   y# t        j                  $ r t!        j"                         }Y w xY w# t        j                  t.        t0        f$ rr t!        j"                         gdz  \  }
}}}t3        |t         j"                        s7|5| j                  d   r&| j5                  | j,                  ||      }||\  }
}}}Y w xY w# t        j                  $ rE}t@        jC                  djE                  ||jF                  |j                               Y d}~	d}~ww xY w# t        j                  $ r t!        j"                         }Y w xY w# t        j                  $ r t!        j"                         }Y w xY w# t        j                  tJ        t0        f$ r! t!        j"                         gdz  \  }
}}}Y w xY ww)a  Generates a list of PE file version info for processes, dlls, and
        modules.

        Args:
            procs: <generator> of processes
            mods: <generator> of modules
            session_layers: <generator> of layers in the session to be checked
        r   windowsr   )class_typesmemory_layerN   r#   r   Unknownz*Process {}: invalid address {} in layer {}stringreplace)
max_lengtherrors)*r1   r   configr   IntermediateSymbolTablecreateconfig_pathr   rx   r6   r2   getBaseDllName
get_stringr   InvalidAddressExceptionr   UnreadableValuer)   find_session_layerDllBaserr   _contextrX   AttributeErrorre   rP   NotApplicableValuer   HexUniqueProcessIdadd_process_layervollogdebugformatinvalid_addressload_order_modules
ValueErrorImageFileNamecastvolcount)selfrs   rt   ru   r   rQ   physical_layer_namemodr   session_layer_namern   ro   rp   rq   resultprocproc_idproc_layer_nameexcpentryr   s                        r.   
_generatorzVerInfo._generator   s     %%dkk(&;< 88??LL$**It @ 

 #ll11&2C2CDKKOOD
 C:!oo88: ")!C!Cnckk"@151M1MMM=2Dckk2.w$ 002002 $$S[[1	 7 T DG	.."&"8"8": 002>"'"3"3">">"@K:*..u}}=GW595Q5Q}ou}}62UE7E ,,**//$'+'9'9'='='C'C#, 0 
  # % 3 O 55 :'779: 66	>R @2;2K2K2M1NQR1R.w";	0I0IJ+7K0!33':KF )9?6w@D 55 @GG!5!5t
  "99 >"+";";"=K>
 "99 :'779G: #::JW W6?6O6O6Q5RUV5V2UE7EWs   B/P12I75P1-J%/AP1L8$P18NO3-O/ AP17'J"P1!J""P1%BL51P14L55P18N:NP1NP1'N>:P1=N>>P1'O,(P1+O,,P1/;P.*P1-P..P1c                    | j                   j                  | j                  d      }t        j                  j                  | j                   |j                  |j                        }t        j                  j                  | j                   |j                  |j                        }t        j                  j                  | j                   |j                  |j                        }t        j                  dt        fdt        fdt        j                   fdt        fdt        fdt        fdt        fd	t        fg| j#                  |||            S )
Nr   PIDProcessBaseNameMajorMinorProductBuild)r1   r   r   r   r(   list_processesr2   symbol_table_namer)   list_modulesget_session_layersr   TreeGridintstrr   r   r   )r   r   rs   rt   ru   s        r.   runzVerInfo.run  s   %%dkk(&;<,,LL&++V-E-E
 ++LL&++V-E-E

 !;;LL&++V-E-E
 !!C ))*##C #	 OOE48
 	
r0   )__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r
   configurationRequirementInterfacer/   r1   ContextInterfacer   r   r   r   rP   rr   r   objectsObjectInterfacer   r    r0   r.   r   r      sX   2H"+
j&>&>&S&S!T 
 
4 ##44  	
 
%S#s*+	, 8 2,##442, 2, 	2,
 2, 
sCc!	"2, 2,hr++;;T4GHr 
**::D$FGr "#tT/2	rh
r0   r   )$rY   loggingr=   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.plugins.windowsr   r   r   	getLoggerr   r   r`   ImportErrorinfopluginsPluginInterfacer   r   r0   r.   <module>r      s   
 
   3 3 N N < 1 8 2 ? @ @			8	$
C
j  00 C
  

KKV 
	
s    B B