
    XfG6                        d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZmZm	Z	m
Z
 d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d d	lmZ  ej        e          Z G d
 dej         j!                  Z"dS )    N)Any	GeneratorListTuple)	constants
exceptions
interfaces	renderers)requirements)BufferDataLayer)RegistryHive)
conversionformat_hints)intermed)hivelistc                        e Zd ZdZdZ fdZedeej	        j
                 fd            Zd ZddZdefd	Zd
edeeeef         ddf         fdZd Zd Z xZS )
UserAssistz/Print userassist registry keys and information.)   r   r   c                     t                      j        |i | d| _        d| _        d | _        d | _        	 t          t          j        	                    t          j        
                    t                    d          d          5 }t          j        |          | _        d d d            d S # 1 swxY w Y   d S # t          $ r t                               d           Y d S w xY w)Nr   _VOL_USERASSIST_TYPES_7zuserassist.jsonrbzUsersassist data file not found)super__init___userassist_size_userassist_type_name_reg_table_name_win7openospathjoindirname__file__jsonload_folder_guidsIOErrorvollogerror)selfargskwargsfp	__class__s       k/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/userassist.pyr   zUserAssist.__init__   s"   $)&))) !%>"#
	<RW__X668IJJD  3%)Yr]]"3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3  	< 	< 	<LL:;;;;;;	<s6   AB< B/"B< /B33B< 6B37B< <$C$#C$returnc                     t          j        ddddg          t          j        ddd d	          t          j        d
t          j        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesoffsetHive OffsetT)r5   r6   defaultoptionalr   )   r   r   )r5   pluginversion)r   ModuleRequirementIntRequirementPluginRequirementr   HiveList)clss    r/   get_requirementszUserAssist.get_requirements,   ss     *,()4  
 '=$QU   *(99  
 	
    c                    t          j                    t          j                    t          j                    t          j                    t          j                    t          j                    d}|                                }||S ||d<   | j        |S t	          |          | j        k     r|S | j        j                            d          }t          | j        | j
        ||          }| j                            |           | j                            | j        t          j        z   | j        z   |d          }| j        rt          j                    |d<   t%          |j                  |d<   |j        d	z   d
z  }|dk    rt+          j        |          n|j        }t%          |j                  |d<   t1          |          |d<   not%          |j                  |d<   t%          |j        dk     r|j        n	|j        dz
            |d<   t          j                    |d<   t          j                    |d<   t7          j        |j        j                  |d<   |S )zVReads the raw data of a _CM_KEY_VALUE and returns a dict of
        userassist fields.)idcountfocustimelastupdatedrawdataNrL   userassist_bufferr   )object_type
layer_namer8   rG   rH   i  g     @@)secondsrI   rJ      rK   )r
   UnparsableValuedecode_datar   lenr   contextlayersfree_layer_namer   _config_path	add_layerobjectr   r   BANGr   NotApplicableValueintCount	FocusTimedatetime	timedelta
FocusCountstrIDCountStartingAtFiver   wintime_to_datetimeLastUpdatedQuadPart)	r*   reg_valitemuserassist_datauserassist_layer_namebufferuserassist_objrP   rJ   s	            r/   parse_userassist_dataz UserAssist.parse_userassist_data<   sg   
 +--.00.00-//$466 022
 
 "--//"K)Y:K$"777K $ 3 C CDW X X L$+-BO
 
 	v&&&,,,n() - - 
 
 : 	:"577DJ 455DM%/#5?G Q;; "73333#- 
   9::DMt99DLL ^.//DJ!599 22#7!; DM
 &8::DM$799DL(<&/
 
] rE   Nc                     | j         du rd| _        n| j         du rd| _        | j        j                            | j        t          j        z   | j        z             j        | _	        dS )zKDetermine the userassist type and size depending on the OS
        version.Tr   F_VOL_USERASSIST_TYPES_XPN)
r   r   rU   symbol_spaceget_typer   r   r[   sizer   r*   s    r/   _determine_userassist_typez%UserAssist._determine_userassist_type   so     :)BD&&Z5  )CD& $ 9 B B 9>1D4NN!
 !

 	rE   c                     | j         j        | j        d                  }| j         j                            |j        t          j        z   dz                                 d          S )Nr2   _KUSER_SHARED_DATA	CookiePad)	rU   modulesconfigrr   rs   symbol_table_namer   r[   
has_member)r*   r2   s     r/   _win7_or_laterzUserAssist._win7_or_later   sW     %dk(&;<|(11$y~58LL
 

*[
!
!	"rE   hivec              #     K   | j         j        | j        d                  }|j                            |j        t          j        z   dz                                             }| j	        Ot          j        t          j                  5  |                                 | _	        ddd           n# 1 swxY w Y   |                                  |                    dd          }|st"                              d           dS t'          |t(                    st"                              d           dS |d	         }|                                D ]}|                                D ]}|                                }t/          j        |j        j                  }	d
t6          j                            |j                  |||	dt7          j                    t7          j                    t7          j                    t7          j                    t7          j                    t7          j                    t7          j                    ff}
|
V  |                                D ]}|                                }dt6          j                            |j                  |||	d|t7          j                    t7          j                    t7          j                    t7          j                    t7          j                    t7          j                    ff}
|
V  |                                 D ]*}|                                }t          j        tB                    5  tE          j#        |d          }ddd           n# 1 swxY w Y   | j	        rE|$                    d          d
         }|| j%        v r!|&                    || j%        |                   }| '                    |          }dt6          j                            |j                  |||	d||d         |d         |d         |d         |d         t9          j(        |d                   ff}
|
V  ,dS )z-Generate userassist data for a registry hive.r2   _CMHIVEN=software\microsoft\windows\currentversion\explorer\userassistT)return_listz8list_userassist did not find a valid node_path (or None)z6userassist_node_path did not return a list as expectedr   Keyr<   Subkeyrot_13\ValuerG   rH   rI   rJ   rK   rL   ))rU   rz   r{   r   castr|   r   r[   get_namer   
contextlibsuppressr   SymbolErrorr~   rv   get_keyr(   warning
isinstancelistget_subkeysget_key_pathr   rf   LastWriteTimerh   r
   r   Hexhive_offsetr\   
get_valuesUnicodeDecodeErrorcodecsencodesplitr&   replacero   HexBytes)r*   r   r2   	hive_nameuserassist_node_pathuserassist_nodeguidkeycountkeycountkey_pathcountkey_last_write_timeresultsubkeysubkey_namevalue
value_nameguiduserassist_data_dicts                    r/   list_userassistzUserAssist.list_userassist   s     
 %dk(&;<INN$y~5	A
 

(** 	 :$Z%;<< 3 3!0022
3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 	'')))#||P  ,  
  

 $ 	NNUVVV4.55 	NNSTTT4.r2&2244 a	! a	!G#//11 _! _! ( 5 5 7 7+5+I*3, ,(, !.2243CDD!%0!466!466!466!466!466!466!466! B  '2244 ! !F"(//"3"3K%266t7GHH%)4$'%8::%8::%8::%8::%8::%8::F" !LLLL &0022 ! !E!&!1!1J#,-?@@ I I%+]:x%H%H
I I I I I I I I I I I I I I I z )//55a84#555)3);); $d&8&>* *J ,0+E+Ee+L+L(%266t7GHH%)4#&060909080?(12Fy2QRRF" !LLLL=!C_!a	! a	!s$   B,,B03B0M3	3M7:M7c              #   4  K   d }| j                             dd           | j                             dd           g}| j        j        | j         d                  }t          j                            | j        | j        |j        |j	        d|          D ]}	 | 
                    |          E d {V   # t          j        $ r9}t                              dt          |j                              Y d }~nd }~wt          j        $ rB}t                              d                    |j        |j                             Y d }~nSd }~wt&          $ rC t                              d                    dt          |j                                       Y nw xY wd	t*          j                            |j                  |j        r|j        nt+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    t+          j                    ff}|V  d S )
Nr8   r2   z
ntuser.dat)rU   base_config_pathrO   symbol_tablefilter_stringhive_offsetsz$Invalid address identified in Hive: z0Invalid address identified in lower layer {}: {}z(Key '{}' not found in Hive at offset {}.r   r   )r{   getrU   rz   r   rB   
list_hivesconfig_pathrO   r|   r   r   PagedInvalidAddressExceptionr(   debughexinvalid_addressInvalidAddressExceptionformatKeyErrorr   r
   r   r   r5   UnreadableValue)r*   r   r2   r   excpr   s         r/   
_generatorzUserAssist._generator  s     ;??8T**6 KOOHd;;<L%dk(&;< %00L!-(1&% 1 
 
 /	 /	D//555555555:   V3t?S;T;TVV        5   FMM)=        
    >EE\D,--      *..t/?@@!%KDII	0I0K0K-//-//-//-//-//-//-//-//-//-//F" LLLL_/	 /	s+   B22F/C55F8EAFFc                    t           j                            | j        | j        dd          | _        t          j        dt          j        j	        fdt          fdt          fdt          j        fdt          fdt          fd	t          fd
t          fdt          fdt          fdt          j        fdt          j        fg|                                           S )Nwindowsregistryr9   z	Hive NamePathzLast Write TimeTypeNamerd   r^   zFocus CountzTime FocusedzLast UpdatedzRaw Data)r   IntermediateSymbolTablecreaterU   rX   r   r
   TreeGridr   r   rc   r`   r]   r   r   ru   s    r/   runzUserAssist.runR  s    '?FFL$+Y
 
  
 !	 6 :;c""H$56s#$%!23\23 OO
 
 	
rE   )r0   N)__name__
__module____qualname____doc___required_framework_versionr   classmethodr   r	   configurationRequirementInterfacerD   ro   rv   boolr~   r   r   r   r]   r   r   r   __classcell__)r.   s   @r/   r   r      s       99"+< < < < < 
j&>&S!T 
 
 
 [
C C CJ   " " " " "A! A!	5e$dD0	1A! A! A! A!F6 6 6p
 
 
 
 
 
 
rE   r   )#r   r   r`   r$   loggingr   typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   %volatility3.framework.layers.physicalr   %volatility3.framework.layers.registryr   volatility3.framework.renderersr   r   volatility3.framework.symbolsr   $volatility3.plugins.windows.registryr   	getLoggerr   r(   pluginsPluginInterfacer    rE   r/   <module>r      sP  
         				 . . . . . . . . . . . . N N N N N N N N N N N N < < < < < < A A A A A A > > > > > > D D D D D D D D 2 2 2 2 2 2 9 9 9 9 9 9		8	$	$O
 O
 O
 O
 O
#3 O
 O
 O
 O
 O
rE   