X f5ddlZddlmZmZmZmZmZddlmZm Z m Z ddl m Z ddl mZddlmZddlmZejeZGdd ZGd d e jjZdS) N)IteratorListTupleIterableOptional) renderers interfaces exceptions) requirements)registry) format_hints)hivescancLeZdZdZdZd dZdZedee fdZ dS) HiveGeneratorzWalks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the listrrTc0||_||_d|_dSN)_cmhive_forward_invalid)selfcmhiveforwards i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/hivelist.py__init__zHiveGenerator.__init__s   c#K|jj|jjjd|jD].}|s|jj|_dS|V/dS)NHiveListr) rrto_listvol type_nameris_validoffsetr)rhives r__iter__zHiveGenerator.__iter__syL)11 L  & DM2    D==??  $ ttJJJJ   rreturnc|jSr)rrs rinvalidzHiveGenerator.invalid$s }rN)T) __name__ __module__ __qualname____doc___required_framework_versionrr'propertyrintr+rrrrst--#, #XrrceZdZdZdZdZedeej j fdZ de de fdZ deeeeee fffdZe dd ejjd e d e d e dee deedeejfdZe dd ejjd e d e de deejjf dZdejfdZd S)rz>Lists the registry hives present in a particular memory image.rrrr(c tjddddgtjdddd tjd tjd tjd dddgS)NkernelzWindows kernelIntel32Intel64)name description architecturesfilterz$String to filter hive names returnedT)r;r<optionaldefaultrr5)r;pluginversiondumpzExtract listed registry hivesF)r;r<r@r?)r ModuleRequirementStringRequirementPluginRequirementrHiveScanBooleanRequirement)clss rget_requirementszHiveList.get_requirements/s  *,()4     *B      *(99     +;      rr;c|ddddddddddS) N\ _.[])splitreplace)rr;s r_sanitize_hive_namezHiveList._sanitize_hive_nameHsW JJt  R WS#   WS"   WS"   WS"    rc #jKd}|jj|jd}||j|j|j|jddD]}d}|jdrt||j|j |j|j|j j g}|j j dj}||}|d |d t%|jd }|5} |jr<|jj|jd|j jd } nd } | | t5d||D]B} t7||| z } || | d} | | C dddn #1swxYwY|j}dt;j|j j |pd|ffVdS)NiPr8r>)context layer_name symbol_table filter_stringDisabledrC)rYrZ hive_offsetsrz registry.rPz.hiveiaT)padrQ)rXmodulesconfiglist_hive_objectsrYsymbol_table_namegetnext list_hives config_pathr"r%r&StorageLengthrVget_nameopenhex hive_offset _base_blocklayers dependenciesread BaseBlockwriterangeminpreferred_filenamer Hex)r chunk_sizer8 hive_object file_outputr&maxaddr hive_name file_handle file_data hive_dataicurrent_chunk_sizedatas r _generatorzHiveList._generatorQs %dk(&;<11L(1+//(D99 2  0 0 K %K{6" =OO (#)#4%+%=&1o&<%= $)+A.5 44T]]__EE "iiH HHC0@,A,AHHH ! .I'7$(L$78I!8L$M$R$R I/%% %7 OOI..."1gz::..-0Wq[-I-I*#yy,>DyII!----. . . . . . . . . . . . . . . .*<  $[_%;<<((**0b    S0 0 s*B/G&&G* -G* NrXbase_config_pathrYrZr[r]c #K|[ d|||||D}n7#t$r*tdt dwxYw|D]}||||||} t j||dt|z} n@#tj $r.tdt|dYwxYw|j | | VdS) aWalks through a registry, hive by hive returning the constructed registry layer name. Args: context: The context to retrieve required elements (layers, symbol tables) from base_config_path: The configuration path for any settings required by the new table layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_string: An optional string which must be present in the hive name if specified offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string) Yields: A registry hive layer name Nc&g|]}|jjSr3)r"r%).0r&s r z'HiveList.list_hives..s,   HO   rzFUnable to import windows.hivelist plugin, please provide a hive offset)rXrrl base_layer nt_symbolsr&)r;z-Couldn't create RegistryHive layer at offset z , skipping) ra ImportErrorvollogwarning ValueErrormake_subconfigr RegistryHiverkr InvalidAddressExceptionrn add_layer) rIrXrrYrZr[r]rlreg_config_pathr&s rrezHiveList.list_hivess0      # 5 5\=!!       \!\  (  K!00!1'%' 1O ,_6C >,:c>RR''(9::B __y_QQ ""9--CCJOO!*.*?&*HSW!   uu 64 0 0 0  Dx$&& AAGDHO,,BB  HHTX_ % % %% &&((C 0E2,F,F,L,L,N,NNN>*-66txGGJJJ* L  LLZaa((    vu555B # #8?d**LLOOUv00PP E)))!)$**,,DMMOO4Ir0J0J0P0P0R0RRR~j1::48?KK#" !z 2 O7G$G$G AAG,--BB %-88Z%%D"=.>04 0Cf0L-*2,5'8)-*9**J ,9>>3=3F3N3N$(H$6 G4"4"!>!>K-8,@,@,B,B%1+6?+AT+I+I(0$(HH[_-C$D$D$D(5(=+8+>+>+@+@+.{/C/C/E/E/K+L+L+R+R+T+T,U,U,3>*+E+N+N,7O,B,*,*)>3>,=,=,=#!>$&= gnn #DHO 4 4OL L 42 2 $G$G%%s7DRAS-,S-ctjdtjfdtfdtfg|S)NOffset FileFullPathz File output)rTreeGridr rvrrr*s rrunz HiveList.runHsA! ( )NC+@=RUBV W OO     r)NNr)r,r-r.r/_versionr0 classmethodrr configurationRequirementInterfacerJrrVrrr2rrXContextInterfacerrr rreobjectsObjectInterfacerarrrr3rrrr)sHHH"+ j&>&S!T   [ 0      4HU3c3h+?%@A4444l(,"&;;#4;; ;  ;  } ;3i; (' (;;;[;z " @@#4@@ @  @ *$4 5 @@@[@D Y'      rr)loggingtypingrrrrrvolatility3.frameworkrr r #volatility3.framework.configurationr volatility3.framework.layersr volatility3.framework.renderersr $volatility3.plugins.windows.registryr getLoggerr,rrpluginsPluginInterfacerr3rrrs<<<<<<<<<<<<<<CCCCCCCCCC<<<<<<111111888888999999  8 $ $2c c c c c z!1c c c c c r