
    [
#gp8                     4   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZmZm	Z	m
Z
 d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ d d	lmZ d d
lmZ  ej>                  e       Z! G d dejD                  jF                  ejH                        Z%y)    N)Any	GeneratorListTuple)	constants
exceptions
interfaces	renderers)requirements)BufferDataLayer)RegistryHive)
conversionformat_hints)intermed)hivelist)	timelinerc                        e Zd ZdZdZ fdZedeej                  j                     fd       Zd ZddZdefd	Zd
edeeeef   ddf   fdZd Zd Zd Z xZS )
UserAssistz/Print userassist registry keys and information.)   r   r   c                    t        |   |i | d| _        d| _        d | _        d | _        	 t        t        j                  j                  t        j                  j                  t              d      d      5 }t        j                  |      | _        d d d        y # 1 sw Y   y xY w# t        $ r t         j#                  d       Y y w xY w)Nr   _VOL_USERASSIST_TYPES_7zuserassist.jsonrbzUsersassist data file not found)super__init___userassist_size_userassist_type_name_reg_table_name_win7openospathjoindirname__file__jsonload_folder_guidsIOErrorvollogerror)selfargskwargsfp	__class__s       k/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/registry/userassist.pyr   zUserAssist.__init__   s    $)&) !%>"#
	<RWW__X68IJD 3%)YYr]"3 3 3  	<LL:;	<s0   AB) 9BB) B&"B) &B) )C
	C
returnc                     t        j                  ddddg      t        j                  ddd d	      t        j                  d
t        j
                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesoffsetHive OffsetT)r6   r7   defaultoptionalr   )   r   r   )r6   pluginversion)r   ModuleRequirementIntRequirementPluginRequirementr   HiveList)clss    r0   get_requirementszUserAssist.get_requirements-   sa     **,()4
 ''=$QU **(9(99
 	
    c                 H   t        j                         t        j                         t        j                         t        j                         t        j                         t        j                         d}|j                         }||S ||d<   | j                  |S t	        |      | j
                  k  r|S | j                  j                  j                  d      }t        | j                  | j                  ||      }| j                  j                  |       | j                  j                  | j                  t        j                  z   | j                   z   |d      }| j                  rt        j"                         |d<   t%        |j&                        |d<   |j(                  dz   d	z  }|dkD  rt+        j,                  |
      n|j(                  }t%        |j.                        |d<   t1        |      |d<   n|t%        |j2                        |d<   t%        |j4                  dk  r|j4                  n|j4                  dz
        |d<   t        j"                         |d<   t        j"                         |d<   t7        j8                  |j:                  j<                        |d<   |S )zVReads the raw data of a _CM_KEY_VALUE and returns a dict of
        userassist fields.)idcountfocustimelastupdatedrawdatarM   userassist_bufferr   )object_type
layer_namer9   rH   rI   i  g     @@)secondsrJ   rK      rL   )r
   UnparsableValuedecode_datar   lenr   contextlayersfree_layer_namer   _config_path	add_layerobjectr   r   BANGr   NotApplicableValueintCount	FocusTimedatetime	timedelta
FocusCountstrIDCountStartingAtFiver   wintime_to_datetimeLastUpdatedQuadPart)	r+   reg_valitemuserassist_datauserassist_layer_namebufferuserassist_objrQ   rK   s	            r0   parse_userassist_dataz UserAssist.parse_userassist_data=   sZ   
 ++-..0..0--/$446 002
 "--/"K)Y::K$"7"77K $ 3 3 C CDW X LL$++-BO
 	v&,,,,nn(() - - 
 ::"557DJ 4 45DM%//#5?G Q; ""73#-- 
   9 9:DMt9DL ^../DJ!559 22#77!;DM
 &88:DM$779DL(<<&&//
] rF   Nc                    | j                   du rd| _        n| j                   du rd| _        | j                  j                  j	                  | j
                  t        j                  z   | j                  z         j                  | _	        y)zKDetermine the userassist type and size depending on the OS
        version.Tr   F_VOL_USERASSIST_TYPES_XPN)
r   r   rV   symbol_spaceget_typer   r   r\   sizer   r+   s    r0   _determine_userassist_typez%UserAssist._determine_userassist_type   sn     ::)BD&ZZ5 )CD& $ 9 9 B B  9>>1D4N4NN!

$ 	rF   c                     | j                   j                  | j                  d      }| j                   j                  j	                  |j
                  t        j                  z   dz         j                  d      S )Nr3   _KUSER_SHARED_DATA	CookiePad)	rV   modulesconfigrs   rt   symbol_table_namer   r\   
has_member)r+   r3   s     r0   _win7_or_laterzUserAssist._win7_or_later   s`     %%dkk(&;<||((11$$y~~58LL

*[
!	"rF   hivec              #     K   | j                   j                  | j                  d      }|j                  j	                  |j
                  t        j                  z   dz         j                         }| j                  At        j                  t        j                        5  | j                         | _	        ddd       | j                          |j!                  dd      }|st"        j%                  d       yt'        |t(              st"        j%                  d       y|d	   }|j+                         D ]  }|j+                         D ]  }|j-                         }t/        j0                  |j2                  j4                        }	d
t6        j8                  j;                  |j<                        |||	dt7        j>                         t7        j>                         t7        j>                         t7        j>                         t7        j>                         t7        j>                         t7        j>                         ff}
|
 |j+                         D ]  }|j                         }dt6        j8                  j;                  |j<                        |||	d|t7        j>                         t7        j>                         t7        j>                         t7        j>                         t7        j>                         t7        j>                         ff}
|
  |jA                         D ]	  }|j                         }t        j                  tB              5  tE        jF                  |d      }ddd       | j                  rA|jI                  d      d
   }|| jJ                  v r|jM                  || jJ                  |         }| jO                  |      }dt6        j8                  j;                  |j<                        |||	d||d   |d   |d   |d   |d   t9        jP                  |d         ff}
|
    y# 1 sw Y   zxY w# 1 sw Y   xY ww)z-Generate userassist data for a registry hive.r3   _CMHIVEN=software\microsoft\windows\currentversion\explorer\userassistT)return_listz8list_userassist did not find a valid node_path (or None)z6userassist_node_path did not return a list as expectedr   Keyr=   Subkeyrot_13\ValuerH   rI   rJ   rK   rL   rM   ))rV   r{   r|   r   castr}   r   r\   get_namer   
contextlibsuppressr   SymbolErrorr   rw   get_keyr)   warning
isinstancelistget_subkeysget_key_pathr   rg   LastWriteTimeri   r
   r   Hexhive_offsetr]   
get_valuesUnicodeDecodeErrorcodecsencodesplitr'   replacerp   HexBytes)r+   r   r3   	hive_nameuserassist_node_pathuserassist_nodeguidkeycountkeycountkey_pathcountkey_last_write_timeresultsubkeysubkey_namevalue
value_nameguiduserassist_data_dicts                    r0   list_userassistzUserAssist.list_userassist   s    
 %%dkk(&;<IINN$$y~~5	A

(* 	 ::$$Z%;%;< 3!002
3 	'')#||P  ,  

 $NNUV.5NNST.r2&224G#//1 ( 5 5 7+5+I+I**33,(, !..2243C3CD!%0!446!446!446!446!446!446!446! B  '224F"(//"3K%2266t7G7GH%)4$'%88:%88:%88:%88:%88:%88:F" !L' 5, &002E!&!1J#,,-?@ I%+]]:x%H
I zz)//5a84#5#55)3);); $d&8&8&>*J ,0+E+Ee+L(%2266t7G7GH%)4#&060909080?(112Fy2QRF" !L= 3C 2 5)3 3rI Is8   BQP-5JQP:	CQ-P72Q:Q?Qc              #     K   d }| j                   j                  dd       | j                   j                  dd       g}| j                  j                  | j                   d      }t        j
                  j                  | j                  | j                  dd      | _        t        j                  j                  | j                  | j                  |j                  |j                  d|      D ]  }	 | j                  |      E d {     y 7 # t         j"                  $ r5}t$        j'                  dt)        |j*                                Y d }~nd }~wt         j,                  $ rC}t$        j'                  dj/                  |j                  |j*                               Y d }~nJd }~wt0        $ r; t$        j'                  d	j/                  d
t)        |j2                                     Y nw xY wdt4        j6                  j9                  |j2                        |j:                  r|j:                  nt5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         t5        j<                         ff}| w)Nr9   r3   windowsregistryz
ntuser.dat)rV   base_config_pathrP   symbol_tablefilter_stringhive_offsetsz$Invalid address identified in Hive: z0Invalid address identified in lower layer {}: {}z(Key '{}' not found in Hive at offset {}.r   r   )r|   getrV   r{   r   IntermediateSymbolTablecreaterY   r   r   rC   
list_hivesconfig_pathrP   r}   r   r   PagedInvalidAddressExceptionr)   debughexinvalid_addressInvalidAddressExceptionformatKeyErrorr   r
   r   r   r6   UnreadableValue)r+   r   r3   r   excpr   s         r0   
_generatorzUserAssist._generator  s^    ;;??8T*6 KKOOHd;<L%%dkk(&;<'??FFLL$++Y
 

 %%00LL!--((11&% 1 
D//555
 6:: :3t?S?S;T:UV  55 FMM)=)= 
  >EE\D,,- **..t/?/?@!%DII	0I0I0K--/--/--/--/--/--/--/--/--/--/F" Lsb   C-L
0DDD	L
DG,!+EL
G,'9F% L
%AG,)L
+G,,DL
c              #     K   | j                         D ]p  }|\  }}t        |d   t              st        |d   t        j                        r:d|d    d|d    d|d    d}|t
        j                  j                  |d   f r y w)	NrR   
   zUserAssist:  r   z (   ))r   r   rd   r
   r]   r   TimeLinerTypeMODIFIED)r+   row_depthrow_datar7   s        r0   generate_timelinezUserAssist.generate_timelineW  s     ??$C"FH(1+s+Ji::5 !-Xa[M8A;-r(ST+VWX"I$;$;$D$DhrlSS %s   ,BB:Bc                 V   t        j                  dt         j                  j                  fdt        fdt        fdt
        j
                  fdt        fdt        fdt        fdt        fd	t        fd
t        fdt
        j
                  fdt        j                  fg| j                               S )Nr:   z	Hive NamePathzLast Write TimeTypeNamere   r_   zFocus CountzTime FocusedzLast UpdatedzRaw Data)	r
   TreeGridr   r   rd   ra   r^   r   r   rv   s    r0   runzUserAssist.runa  s    !!	 6 6 : :;c""H$5$56s#$%!2!23\223 OO
 	
rF   )r1   N)__name__
__module____qualname____doc___required_framework_versionr   classmethodr   r	   configurationRequirementInterfacerE   rp   rw   boolr   r   r   r   r^   r   r   r   r   __classcell__)r/   s   @r0   r   r      s    9"+< 
j&>&>&S&S!T 
 
CJ" "A! A!	5e$dD0	1A!F:xT
rF   r   )&r   r   ra   r%   loggingr    typingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   %volatility3.framework.layers.physicalr   %volatility3.framework.layers.registryr   volatility3.framework.renderersr   r   volatility3.framework.symbolsr   $volatility3.plugins.windows.registryr   volatility3.pluginsr   	getLoggerr   r)   pluginsPluginInterfaceTimeLinerInterfacer    rF   r0   <module>r      sn   
      	 . . N N < A > D 2 9 )			8	$Y
##33Y5Q5Q Y
rF   