X f5ddlZddlmZmZmZmZmZddlmZm Z m Z ddl m Z ddl mZddlmZddlmZej&eZGdd ZGd d e j.j0Zy) N)IteratorListTupleIterableOptional) renderers interfaces exceptions) requirements)registry) format_hints)hivescanc>eZdZdZdZddZdZedee fdZ y) HiveGeneratorzWalks the registry HiveList linked list in a given direction and stores an invalid offset if it's unable to fully walk the listrrc.||_||_d|_yN)_cmhive_forward_invalid)selfcmhiveforwards i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/hivelist.py__init__zHiveGenerator.__init__s   c#K|jjj|jjjd|j D]3}|j s|jj|_y|5yw)NHiveListr) rrto_listvol type_nameris_validoffsetr)rhives r__iter__zHiveGenerator.__iter__slLL))11 LL   & & DMM2  D==? $ J  sBB returnc|jSr)rrs rinvalidzHiveGenerator.invalid$s }}rN)T) __name__ __module__ __qualname____doc___required_framework_versionrr'propertyrintr+rrrrs8-#, #rrceZdZdZdZdZedeejjfdZ de de fdZ deeeeee fffdZe dd ej$j&d e d e d e dee deedeej.fdZe dd ej$j&d e d e de deej2j4f dZdej:fdZy )rz>Lists the registry hives present in a particular memory image.rrrr(c tjddddgtjdddd tjd tj d tj d dddgS)NkernelzWindows kernelIntel32Intel64)name description architecturesfilterz$String to filter hive names returnedT)r;r<optionaldefaultrr5)r;pluginversiondumpzExtract listed registry hivesF)r;r<r@r?)r ModuleRequirementStringRequirementPluginRequirementrHiveScanBooleanRequirement)clss rget_requirementszHiveList.get_requirements/s  * *,()4   * *B    * *(9(99   + +;    rr;c|jddjddjddjddjddS) N\ _.[])splitreplace)rr;s r_sanitize_hive_namezHiveList._sanitize_hive_nameHsH JJt R WS#  WS"  WS"  WS"   rc #Kd}|jj|jd}|j|j|j|j |jj ddD]}d}|jdrt|j|j|j|j|j |jjg}|jjdj}|j|j!}|j#d |d t%|j&d }|5} |j(rK|jj*|j,dj/|jj0d } nd } | j3| t5d||D]6} t7||| z } |j/| | d} | j3| 8 ddd|j8}dt;j<|jj|j!xsd|ffy#1swY[xYww)NiPr8r>)context layer_name symbol_table filter_stringDisabledrC)rYrZ hive_offsetsrz registry.rPz.hiveiaT)padrQ)rXmodulesconfiglist_hive_objectsrYsymbol_table_namegetnext list_hives config_pathr"r%r&StorageLengthrVget_nameopenhex hive_offset _base_blocklayers dependenciesread BaseBlockwriterangeminpreferred_filenamer Hex)r chunk_sizer8 hive_object file_outputr&maxaddr hive_name file_handle file_data hive_dataicurrent_chunk_sizedatas r _generatorzHiveList._generatorQs8 %%dkk(&;<11LL((11++//(D9 2 0 K %K{{6"OO ((#)#4#4%+%=%=&1oo&<&<%= $))++A.55 44T]]_E "ii {!C0@0@,A+B%H ! .I''$(LL$7$78I8I!8L$M$R$R II//% %7 OOI."1gz:.-0Wq[-I*#yy,>DyI!-. .*<<  $$[__%;%;<((*0b S0 0 . .s EI1B1I% AI1%I. *I1NrXbase_config_pathrYrZr[r]c #K|6 |j||||Dcgc]}|jj}}|D]\}|j|||||} tj|| dt|z}|jj||^ycc}w#t$r!tj dt dwxYw#tj$r%tj dt|dYwxYww)aWalks through a registry, hive by hive returning the constructed registry layer name. Args: context: The context to retrieve required elements (layers, symbol tables) from base_config_path: The configuration path for any settings required by the new table layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_string: An optional string which must be present in the hive name if specified offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string) Yields: A registry hive layer name NzFUnable to import windows.hivelist plugin, please provide a hive offset)rXrrl base_layer nt_symbolsr&)r;z-Couldn't create RegistryHive layer at offset z , skipping)rar"r% ImportErrorvollogwarning ValueErrormake_subconfigr RegistryHiverkr InvalidAddressExceptionrn add_layer) rIrXrrYrZr[r]r&rlreg_config_paths rrezHiveList.list_hivess20   !$ 5 5\=! HHOO   ( K!00!1'%' 1O ,,_6C >,:c>R''(9:BB __y_Q ""9-CCJO!*..*?*?&*HSW!  u 64 0 Dxx$& AAGDHHOO,B  HHTXX__ %% &&(C 0E2,F,L,L,NN>>*-66txxGJ "**  LLZaa(  vu5B #88??d*LLOOUv0P )!)$**,DMMO4Ir0J0P0P0RR~~j1::488??K"  #" "zz O7G$G AAG,-B %--88Z%D"==..04 0C0Cf0L-*2,5'8)-*9*J ,9>3=3F3F3N3N$(HH$6$6 G4"!>K-8,@,@,B+6??+A+AT+I(0$(HH[__-C-C$D(5(=+8+>+>+@+.{/C/C/E/K+L+R+R+T,U,3>>*+E+N+N,7OO,B,B,*3>,=#!>>%%H5 N&== gnn #DHHOO 4sRFT2T9DT 2T>A-T,DR752R7(R70T7AT TTTctjdtjfdtfdtfg|j S)NOffset FileFullPathz File output)rTreeGridr rvrrr*s rrunz HiveList.runHs?!! (( )NC+@=RUBV W OO   r)NNr)r,r-r.r/_versionr0 classmethodrr configurationRequirementInterfacerJrrVrrr2rrXContextInterfacerrr rreobjectsObjectInterfacerarrrr3rrrr)sqHH"+ j&>&>&S&S!T  0   4HU3c3h+?%@A4l(,"&;##44;; ;  ;  } ;3i; ('' (;;z " @##44@@ @  @ *$$44 5 @@D Y'' rr)loggingtypingrrrrrvolatility3.frameworkrr r #volatility3.framework.configurationr volatility3.framework.layersr volatility3.framework.renderersr $volatility3.plugins.windows.registryr getLoggerr,rrpluginsPluginInterfacerr3rrrsX<<CC<189   8 $2c z!!11c r