X fDTdZddlZddlZddlZddlZddlmZmZmZm Z m Z m Z m Z m Z mZddlmZddlmZej&eZGddej$j,ZGdd ej$j,ZGd d ej$j,ZGd d ej$j,ZGddej$j6Zde efdZGddej$j<ZGddej$j>Zy)zoRenderers. Renderers display the unified output format in some manner (be it text or file or graphical output N) AnyCallableDictIterableListOptionalTupleTypeVarUnion) interfaces) renderersceZdZdZy)UnreadableValuezQClass that represents values which are empty because the data cannot be read.N__name__ __module__ __qualname____doc__Z/home/panchajanya/Development/work/volatility3/volatility3/framework/renderers/__init__.pyrrs rrceZdZdZy)UnparsableValuezbClass that represents values which are empty because the data cannot be interpreted correctly.NrrrrrrsrrceZdZdZy)NotApplicableValuez]Class that represents values which are empty because they don't make sense for this node.NrrrrrrsrrceZdZdZy)NotAvailableValueaClass that represents values which cannot be provided now (but might in a future run) This might occur when information packed with volatility (such as symbol information) is not available, but a future version or a different run may later have that information available (ie, it could be applicable, but we can't get it and it's not because it's unreadable or unparsable). Unreadable and Unparsable should be used in preference, and only if neither fits should this be used. Nrrrrrr$s rrc eZdZdZdedddeejjde ejjddf d Z defd Z d e eefdefd Zdefd Zde ejjddfdZdeeeffdZede ejjfdZedefdZedeejjfdZedefdZddededdfdZy)TreeNodez4Class representing a particular node in a tree grid.pathtreegridTreeGridparentvaluesreturnNct|ts td||_||_||_|j ||j||_y)Nz(Treegrid must be an instance of TreeGrid) isinstancer" TypeError _treegrid_parent_path_validate_values RowStructure_values)selfr r!r#r$s r__init__zTreeNode.__init__4sQ(H-FG G!   f%,x,,f5 rc<d|jd|jdS)Nz )r r.r/s r__repr__zTreeNode.__repr__CsTYYKtDLL>;;ritemcV|jj|j|SN)r)children __getitem__)r/r5s rr9zTreeNode.__getitem__Fs"~~&&t,88>>rcJt|jj|Sr7)lenr)r8r3s r__len__zTreeNode.__len__Is4>>**4011rc "t|tjjr+t |t |j j k(s tdtt |j j D]}|j j |}||}t||jtjjfrRtdj||jt||jy)zqA function for raising exceptions if a given set of values is invalid according to the column properties.z[Values must be a list of objects made up of simple types and number the same as the columnszRValues item with index {} is the wrong type for column {} (got {} but expected {})N)r' collectionsabcSequencer;r)columnsr(rangetyper r BaseAbsentValueformatname)r/r$indexcolumnvals rr,zTreeNode._validate_valuesLs v{77 8F s4>>#9#9::m 3t~~5567 E^^++E2F-CcFKK1E1E1U1U#VWhoov{{DIv{{  rc6|jjS)z0Returns the contents of the node as a dictionary)r._asdictr3s rasdictzTreeNode.asdictcs||##%%rc,t|jS)zSReturns the list of values from the particular node, based on column index.)listr.r3s rr$zTreeNode.valuesgsDLL!!rc|jS)zReturns a path identifying string. This should be seen as opaque by external classes, Parsing of path locations based on this string are not guaranteed to remain stable. )r+r3s rr z TreeNode.pathmszzrc|jS)z-Returns the parent node of this node or None.)r*r3s rr#zTreeNode.parentws||rcft|jjtjS)z*Return the path depth of the current node.)r;r splitr"path_sepr3s r path_depthzTreeNode.path_depth|s"499??8#4#4566raddedct|jjtj}|jtj}t |dz }t ||t |dk\r!t t |||rdndz||<tjj||_y)zUpdates the path based on the addition or removal of a node higher up in the tree. This should only be called by the containing TreeGrid and expects to only be called for affected nodes. N)r+rRr"rSr;intstrjoin)r/r rU componentschanged changed_indexs r path_changedzTreeNode.path_changedsZZ%%h&7&78 **X../G q( z-( )S-= =(+J}-.u!"E)J} %&&++J7 r)F)rrrrrZrr r rr BaseTypesr0r4r rYslicerr9r<r,rrLpropertyr$r r#rTboolr_rrrrr1sq> 6 6 6--667 6 Z))334 6  6<#<?c5j 1?c?22tJ,@,@,J,J'KPT.&S#X&"Z11;;<"" c!5!5!>!>?7C7788T8d8rrnamesc ztjd|Dcgc]}tj|c}Scc}w)Nr-)r> namedtupler" sanitize_name)rdrFs rRowStructureConstructorrhs3  ! !%H$//5H Hs8 c eZdZdZdZdeeeejjfde e ee efddfdZededefd Z d"d ejj"d ed ede efd ZedefdZedeejj0fdZede fdZde ejj6deejj6fdZde ejj6defdZdZde ejj6dedefdZde ejj6de e dedefdZ dZ!dZ"e#dZ$ d#de ejj6d e%ejj6e$ge$fd e$de ejjLfdZ' d#deejj6d e%d e$de ejjLde$f d!Z(y)$r"aClass providing the interface for a TreeGrid (which contains TreeNodes) The structure of a TreeGrid is designed to maintain the structure of the tree in a single object. For this reason each TreeNode does not hold its children, they are managed by the top level object. This leaves the Nodes as simple data carries and prevents them being used to manipulate the tree as a whole. This is a data structure, and is not expected to be modified much once created. Carrying the children under the parent makes recursion easier, but then every node is its own little tree and must have all the supporting tree functions. It also allows for a node to be present in several different trees, and to create cycles. |rA generatorr%Ncd|_d|_g|_g}t|dkr t d|D]{\}}t ||j }|s/tdj||jj|jtjj||}t|Dcgc]}|j c}|_||_|g}t'|}||_ycc}w)aConstructs a TreeGrid object using a specific set of columns. The TreeGrid itself is a root element, that can have children but no values. The TreeGrid does *not* contain any information about formatting, these are up to the renderers and plugins. Args: columns: A list of column tuples made up of (name, type). generator: An iterable containing row for a tree grid, each row contains a indent level followed by the values for each column in order. FrrWz5Columns must be a list containing at least one columnz)Column {}'s type is not a simple type: {}N) _populated _row_count _childrenr; ValueError issubclass base_typesr(rE __class__rappendr r ColumnrhrFr-_columnsiter _generator)r/rArkconverted_columnsrF column_typeis_simple_typerHs rr0zTreeGrid.__init__s >@?A w.functionsrrrWzException during population: T)r r rr populatedrxminr;_appendrn Exceptionvollogdebugrm) r/rrr accumulator prev_nodeslevelr5 parent_indexr#treenodeexcps rpopulatezTreeGrid.populates"*   Z11::   ~~ BD #'??)KE4#&s:#>L=IA=MZ q(89SWF#||FD9H!+Al!;xj!HJ+&.x&E OOq(O) ! q>>>s %c|j} |;|jj|jD]}|t |\}}|S#t $rgcYSwxYw)zvReturns the children list associated with a particular node. Returns None if the node does not exist )ror rRrSrY IndexError)r/rr8path_componentrs rrzTreeGrid._find_childrensj >> &*iioodmm&D@N"*3~+>"?KAx@ I s=A AAc4| td|jS)z\Returns the values for a particular node. The values returned are mutable, z-Node must be a valid node within the TreeGrid)r(r$)r/rs rr$zTreeGrid.values*s <KL L{{rr#r$c(|j|d|S)zyAdds a new node at the top level if parent is None, or under the parent node otherwise, after all other children.N)_insert)r/r#r$s rrzTreeGrid._append3s ||FD&11rpositioncl d}|j|}||j|jz}||tt |z n1|t|z ||dD]\}}|j | fddt |||}||j|gf|S|j||gf|S)z8Inserts an element into the tree at a specific position.r~Nc(|jdS)NT)r_)childrnewpaths rz"TreeGrid._insert..Ks5+=+=gt+Lr) rr rSrZr;visitrrtinsert) r/r#rr$ parent_pathr8rr tree_itemrs @rrzTreeGrid._insert:s &&v.   ++ 5K  !CH $66G!CM1G#HI. a Ld  WdFF;   OOYO , OOHy"o 6rcL|jj|jS)z?Returns true if descendent is a child, grandchild, etc of node.)r startswith)r/r descendants r is_ancestorzTreeGrid.is_ancestorUs))$))44rc0jdfddS)z&Returns the maximum depth of the tree.Nc:t|j|Sr7)maxrT)nar/s rrz$TreeGrid.max_depth..[sSDOOA4F-Grr)rr3s`r max_depthzTreeGrid.max_depthYszz$ GKKr_Tsort_keyc|js|j|j|}|}| |||}|?|)|t|fd}|js t |}|j ||||}|S)aVisits all the nodes in a tree, calling function on each one. function should have the signature function(node, accumulator) and return new_accumulator If accumulators are not needed, the function must still accept a second parameter. The order of that the nodes are visited is always depth first, however, the order children are traversed can be set based on a sort_key function which should accept a node's values and return something that can be sorted to receive the desired order (similar to the sort/sorted key). We use the private _find_children function so that we don't have to re-traverse the tree for every node we descend further down c.|djSNrr$xsort_key_not_nones rrz TreeGrid.visit..s,=adkk,Jrkey)rrrsorted ascendingreversed_visit)r/rrrrr8rrs @rrzTreeGrid.visit_s&~~ MMO&&t,)  "4)<=K  #$,!!"J ))'1H++h+xPKrlist_of_childrenrc|R|D]M\}}|||}|)|t|fd}|js t|}|j||||}O|S)z=Visits all the nodes in a tree, calling function on each one.c.|djSrrrs rrz!TreeGrid._visit..s0A!A$++0Nrr)rrrr)r/rrrrrr8rs @rrzTreeGrid._visitsy  '/ U 8&q+6 '(0%% &N H$--#+H#5"kk(Hk8T  Ur)NNTr7))rrrrrSrr rZr r r`rrrYr0 staticmethodrgVisitorSignaturerrcrrrbrrurArrr8rr$rrrrr rr ColumnSortKeyrrrrrr"r"s H&$eC!5!5!?!??@A&$HU3:%678&$  &$P C C  ;?#'# )&&77)!) ) )  )V4 j2299:3?Z11::;? j""++ ,? 8J,@,@,I,I#J s 2z33<<=2GJ2 2--6673-   65L BBF &z++445&J00992>BC& & ://==> &ZBF z33<<=  ://==>  rr"c >eZdZ d dedededdfdZdeedefdZ y) rr! column_namerr%Nc4d}d|_||_tt|jD]P}|j|}|j j |j k(s>|}|j|_R|td|||_ y)Nz&Column not found in TreeGrid columns: ) _typerrBr;rArFrrCrp_index)r/r!rrrirHs rr0zColumnSortKey.__init__s "s8++,- )A%%a(F{{  "k&7&7&99#[[  ) >Ek]ST T rr$c||j}t|tjjr|j t j k(rt j j}|S|j ttfvrd}|S|j tk(rd}|S|j ttjfvrd}|S|j tk(rd}|S)z(The key function passed as the sort key.rXF-r)rr'r r rDrdatetimerrYfloatrcrZ Disassemblybytes)r/r$values r__call__zColumnSortKey.__call__st{{# eZ11AA BzzX... ))-- U|+ t#  Y%:%:;; u$ r)T) rrrr"rZrcr0rrrrrrrrsAFJ   /2 ?C   tCySrr) rr>collections.abcrloggingtypingrrrrrrr r r volatility3.frameworkr volatility3.framework.interfacesr getLoggerrrrDrrrrrrZrhr"rrrrrs WWW,6   8 $ j**:: j**:: --==  ,,<< ^8z##,,^8B49 Bz##,,BJJ((66r