
    Xfx.                         d dl Z d dlZd dlmZmZmZmZmZ d dlm	Z	m
Z
mZmZmZ d dlmZ d dlmZmZ d dlmZmZmZ d dlmZ d dlmZ  ej6                  e      Z G d	 d
ej<                  j>                        Z y)    N)ListSequenceIterableTupleUnion)objects	renderers
exceptions
interfaces	constants)requirements)RegistryHiveRegistryFormatException)TreeGrid
conversionformat_hints)RegValueTypes)hivelistc                   V   e Zd ZdZdZdZedeej                  j                     fd       Ze	 	 ddedeej                     d	edeeeeej(                  eeej                  j,                  f      fd
       Z	 	 ddedeej                     d	efdZ	 	 	 ddededee   ded	ef
dZd Zy)PrintKeyz;Lists the registry keys under a hive or specific key value.)   r   r      r   r   returnc           
         t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
d d      t        j                  ddd d      t        j                  dddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionoffsetHive OffsetT)r   r    defaultoptionalkeyzKey to start fromrecursezRecurses through keysF)r   ModuleRequirementPluginRequirementr   HiveListIntRequirementStringRequirementBooleanRequirement)clss    i/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/printkey.pyget_requirementszPrintKey.get_requirements   s     **,()4
 **(9(99 ''=$QU **(;TTX ++3	
 	
    Nhive	node_pathr)   c              #   R  K   |s|j                  |j                        g}t        |t              rt	        |      dk  rt
        j                  d       y|d   }|g|dd z   }dj                  |D cg c]  }|j                          c}      }|j                  j                  j                  t        j                  dz         rt        |j                  d      t!        j"                  |j$                  j&                        }|j)                         D ]  }	t	        |      d|||	j+                         |	f}
|
 |s)|	j                  j,                  |D cg c]  }|j                  j,                   c}vsd	 |	j                          | j5                  |||	gz   |	      E d{     |j7                         D ]%  }t	        |      d
|||j+                         |f}
|
 ' yc c}w c c}w # t.        j0                  $ r }t
        j3                  |       Y d}~d}~ww xY w7 w)a  Walks through a set of nodes from a given node (last one in
        node_path). Avoids loops by not traversing into nodes already present
        in the node_path.

        Args:
            hive: The registry hive to walk
            node_path: The list of nodes that make up the
            recurse: Traverse down the node tree or stay only on the same level

        Yields:
            A tuple of results (depth, is_key, last write time, path, volatile, and the node).
        r   z6Hive walker was not passed a valid node_path (or None)N\
_CELL_DATAz.Encountered _CELL_DATA instead of _CM_KEY_NODETr)   F)get_noderoot_cell_offset
isinstancelistlenvollogwarningjoinget_namevol	type_nameendswithr   BANGr   r   r   wintime_to_datetimeLastWriteTimeQuadPartget_subkeysget_volatiler$   r
   InvalidAddressExceptiondebugkey_iterator
get_values)r0   r4   r5   r)   nodekey_path_itemskkey_pathlast_write_timekey_noderesultxexcp
value_nodes                 r1   rO   zPrintKey.key_iterator2   s    . t'<'<=>I)T*c)nq.@NNST})AB-/99NCqajjlCD88&&y~~'DE)		K  %889K9K9T9TU((* 	HI%%'F L<<&&Y.Oquu||.OO! ))+
  #//i8*4g  0    '	. //+ 		JI!!#F L		= D& /P &== !T* !s\   A0H'2G%	B4H'>H'G*4H':G/
H'%H%&A	H'/H"HH'H""H'c           	   #     K   | j                  |||      D ]	  \  }}}}}}	|r	 |	j                         }
t        j                  |	j                  j                        }||t        j                  j                  |j                        d||
t        j                          |ff 	 |	j                         xs d}	 t#        |	j$                        j&                  }t)        |t        j                        r*t
        j                  d       t        j                         }n	 |	j+                         }t)        |t,              rt        j.                  |d      }nt#        |	j$                        t"        j0                  k(  rt        j.                  |d      }nVt#        |	j$                        t"        j2                  k(  rt        j.                  |d	d
      }nt        j.                  |d	      }||t        j                  j                  |j                        |||||ff}|  y# t        j                  t        f$ r4}t
        j                  |       t        j                         }
Y d}~8d}~ww xY w# t        j                  t        f$ r4}t
        j                  |       t        j                         }Y d}~d}~ww xY w# t        j                  t        f$ r4}t
        j                  |       t        j                         }Y d}~3d}~ww xY w# t4        t        j                  t        f$ r4}t
        j                  |       t        j                         }Y d}~wd}~ww xY ww)a  Method that wraps the more generic key_iterator, to provide output
        for printkey specifically.

        Args:
            hive: The registry hive to walk
            node_path: The list of nodes that make up the
            recurse: Traverse down the node tree or stay only on the same level

        Yields:
            The depth, and a tuple of results (last write time, hive offset, type, path, name, data and volatile)
        NKeyz	(Default)z8Couldn't read registry value type, so data is unreadablezutf-8)encodingT)show_hexz	utf-16-le)r]   split_nulls)rO   rC   r
   rM   r   r@   rN   r	   UnreadableValuer   rH   rI   rJ   r   Hexhive_offsetNotApplicableValuer   Typer   r=   decode_dataintMultiTypeData
REG_BINARYREG_MULTI_SZ
ValueError)selfr4   r5   r)   depthis_keyrU   rT   volatilerQ   key_node_namerY   value_node_name
value_type
value_datarW   s                   r1   _printkey_iteratorzPrintKey._printkey_iteratory   s    0 tY8e	 
@$(MMOM #-"@"@&&//#
 '!..2243C3CD %!446  B&*mmo&DO=!.tyy!9!>!>J j)*C*CDLLR "113 A%)%5%5%7
%j#6)5)C)C *W*J +49959Q9QQ)5)C)C *T*J +49959S9SS)5)C)C *[d*J *6)C)C *[*J '!..2243C3CD" '"  Ke	 66+ @ LL&$-$=$=$?M@8 66+ B LL&&/&?&?&AOB 66+ = LL&!*!:!:!<J=F #"::/ A
 T*%.%>%>%@
As   !M)H$A0M)%I4:KAM)CL*:M)$I1=)I,&M),I11M)4K)J<6M)<KM)L)LM)LM)M&2)M!M)!M&&M)
layer_namesymbol_tablehive_offsetsr(   c              #     K   t         j                  j                  | j                  | j                  |||      D ]c  }	 ||j                  |d      }n|j                  |j                        g}| j                  |||      D ]  \  }}	|t        |      z
  |	f  e y # t        j                  t        t        f$ r1}
t        |
t              r0t        j!                  d| dt#        |j$                         d       nkt        |
t              rt        j!                  |
       nEt        |
t        j                        r+t        j!                  dt#        |
j&                                d	t)        j*                         t-        j.                  |j$                        d
d|xs dz   t)        j*                         t)        j*                         t)        j*                         ff}| Y d }
~
d }
~
ww xY ww)N)rt   ru   rv   T)return_listr:   zKey 'z' not found in Hive at offset .z$Invalid address identified in Hive: r   r\   z?\ )r   r,   
list_hivescontextconfig_pathget_keyr;   r<   rs   r?   r
   rM   KeyErrorr   r=   r@   rN   hexrb   invalid_addressr	   r`   r   ra   )rk   rt   ru   rv   r(   r)   r4   r5   rX   yrY   rW   s               r1   _registry_walkerzPrintKey._registry_walker   s     %%00LL!%% 1 
 *	D#? $Sd CI!%t/D/D!E FI 33D)W3U 2DAqs9~-q112*	  22' 
 dH-LLu$B3tGWGWCXBYYZ[  &=>LL&j&H&HILL>s4CWCW?X>YZ !113$(()9)9:+!113!113!113 7s0   <G5A B"G5"G2D&G-'G5-G22G5c                     | j                   j                  dd       }| j                  j                  | j                   d      }t	        dt
        j
                  fdt        j                  fdt        fdt        fdt        fdt        j                  fd	t        fg| j                  |j                  |j                  |d n|g| j                   j                  d
d       | j                   j                  dd                   S )Nr$   r   zLast Write Timer%   rd   r\   NameDataVolatiler(   r)   )rv   r(   r)   )columns	generator)configgetr|   modulesr   datetimer   ra   strrg   boolr   rt   symbol_table_name)rk   r$   r   s      r1   runzPrintKey.run%  s    40%%dkk(&;<"H$5$56 0 01334T" ++!!((%+^T&KKOOE40	48 , 
 	
r3   )NF)NNF)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer2   r   r   r   
StructTyper   r   r   rf   r   r   ObjectInterfacerO   rs   r   r    r3   r1   r   r      s@   E"+H
j&>&>&S&S!T 
 
0  37	DD G../D 	D
 
x((#tZ5G5G5W5WW	

D DR 37	vv G../v 	vx #'22 2 3i	2
 2 2h
r3   r   )!r   loggingtypingr   r   r   r   r   volatility3.frameworkr   r	   r
   r   r   #volatility3.framework.configurationr   %volatility3.framework.layers.registryr   r   volatility3.framework.renderersr   r   r   9volatility3.framework.symbols.windows.extensions.registryr   $volatility3.plugins.windows.registryr   	getLoggerr   r@   pluginsPluginInterfacer   r   r3   r1   <module>r      sW   
   9 9 W W < W N N S 9			8	$g
z!!11 g
r3   