*1f6ddlZddlZddlZddlZddlZddlmZmZmZm Z m Z m Z m Z m Z mZddlmZmZmZmZej(eZe dej&j.ej0j2eeefZGddej8ZGddej0j<Zd ej@jBd ed e"fd Z#y) N) AnyCallableDictIterableIteratorOptionalTupleTypeVarList) constants exceptions interfacesobjectsSymbolSpaceReturnTypeceZdZdZdZdZy) SymbolTypeN)__name__ __module__ __qualname__TYPESYMBOLENUMX/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/__init__.pyrr"s D F Drrc eZdZdZd,fd Zd-deddfdZd.dedefdZd edeefd Z d/d e d e dedeefd Z de fdZ dede fdZdeefdZdej$j&ddfdZdeddfdZ d-dedeeeeej2gefdeedefdZGddej<j>Z de!dede"fdZ#dZ$d edej:jJfd Z&d!edej$jNfd"Z(d#ej:jJdej:jJfd$Z)d%edej:jJfd&Z*d'e!dedefd(Z+dedefd)Z,dedefd*Z-dedefd+Z.xZ/S)0 SymbolSpacezHandles an ordered collection of SymbolTables. This collection is ordered so that resolution of symbols can proceed down through the ranks if a namespace isn't specified. returnNcpt|tj|_i|_i|_yN)super__init__ collections OrderedDict_dict _resolved_resolved_symbols)self __class__s rr%zSymbolSpace.__init__/s4   # # % BDIKr table_namect}|$t|jj}n|j|j||D]}|j y)zClears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.N)listr(valuesappendclear_symbol_cache)r+r- table_listtables rr2zSymbolSpace.clear_symbol_cache8s\IM  djj//12J   djj4 5 'E  $ $ & 'rprefixcnd}|t|z|vr|dz }|t|z|vr|t|zS)zaReturns an unused table name to ensure no collision occurs when inserting a symbol table.r)str)r+r5counts rfree_table_namezSymbolSpace.free_table_nameCsEs5z!T) QJEs5z!T)E ""r type_namec#K|jD]=}|j|j|D]}|tjz|z?yw)z4Returns all symbols based on the type of the symbol.N)r(get_symbols_by_typer BANG)r+r:r4 symbol_names rr<zSymbolSpace.get_symbols_by_typeMsPZZ ;E#zz%0DDYO ; inn,{:: ; ;sAAoffsetsizec#K|jj}|!||jvr|j|g}ng}|D]<}|j||D]$}|jtj z|z&>yw)z>Returns all symbols that exist at a specific relative address.N)r?r@)r(r0get_symbols_by_locationnamer r=)r+r?r@r-r3r4r>s rrBz#SymbolSpace.get_symbols_by_locationSs JJ      !TZZ'"jj45   @E$<>1K?? @ @sBBc,t|jS)z.Returns the number of tables within the space.)lenr(r+s r__len__zSymbolSpace.__len__es4::ric |j|S)z(Returns a specific table from the space.)r()r+rHs r __getitem__zSymbolSpace.__getitem__iszz!}rc,t|jS)z:Iterates through all available tables in the symbol space.)iterr(rFs r__iter__zSymbolSpace.__iter__msDJJrvaluect|tjjs t ||j |j vr|j|j ||j |j <y)z+Adds a symbol_list to the end of the space.N) isinstancersymbolsBaseSymbolTableInterface TypeErrorrCr(remove)r+rNs rr1zSymbolSpace.appendqsU%!3!3!L!LME" " :: # KK #!& 5::rkeyc,i|_|j|=y)z+Removes a named symbol_list from the space.N)r)r()r+rUs rrTzSymbolSpace.removeys JJsOrproducer validatortablesc||jj}|D]}|j|}|jstj d|d8|jj |k(rM||jj |jjrtj d|dyy)aVerifies the producer metadata and version of tables Args: producer: String name of a table producer to have validation performed validator: callable that takes an optional version and an optional datetime that returns False if table is invalid Returns: False if an invalid table was found or True if no invalid table was found z Symbol table z> could not be validated because no producer metadata was foundz does not pass validatorFT)r(keysrWvollogdebugrCversiondatetime)r+rWrXrYr-r4s rverify_table_versionsz!SymbolSpace.verify_table_versionss >ZZ__&F  JJJz*E>> #J G  ;y ;F ;r)rrr__doc__r7r% __classcell__r,s@rUnresolvedTemplaterbs   Takes a symbol name and resolves it with ReferentialTemplates.get_type get_symbolget_enumerationz/Weak_resolve called without a proper SymbolTyperrrzType z& references missing Type/Symbol/Enum: NzMalformed name: )rrrrrSsplitr r=rEgetattrr(KeyErrorr SymbolError)r+rirC get_function name_arrayr-component_namees r _weak_resolvezSymbolSpace._weak_resolves :?? *%L Z.. .'L Z__ ,,LMN NZZ / z?a #AJ']N Dwtzz*5|D^TT$$T43CD61JKK   ,,"D6!GsK sB?? C*C%%C*ct}|r1|j|dg|dd}}|r|d|dd}}|jD]}t|tj j r|jj|jvr{|j|jj |jtj|jj|j|jj<|j!||f|js|j||r|r1|D]8\}}|j#||j|jj:y#tj$rI|j|jj|j|jj<YwxYw)zzIteratively resolves a type, populating linked child ReferenceTemplates with their properly resolved counterparts.rrN)setr)childrenrPr templatesReferenceTemplatevolr:r1rvrrr rqrhadd replace_child)r+ traverse_list replacementstemplate_traverse_list traverserchildparents r_iterative_resolvezSymbolSpace._iterative_resolvesu }Q/05QR %2 ")*1-*12.2 '//=E!%):):)L)LM!99..dnnD)001D1DE "$($6$6(29L9L%&!%uyy/B/B C%(()U);<.55e<'= ) <* MMFE  uyy7J7J(K L M$.#9#9"$($;$;EII>2Eqy(1&5(99UQY[;QI ((:)H 'T ~~i((rr>c|jtj|}||jvr4|j(|j |j|j|<t |tjjsMd}|jtj}|dkDr |d|||dzd}}tj||d||S)z=Look-up a symbol name across all the contained symbol spaces.NrrzUnresolvable Symbol: )rvrrr*type _subresolverPrrQSymbolInterfacerr r=r rq)r+r>retvalr-rs rrlzSymbolSpace.get_symbol s##J$5$5{C d44 49P262B2B6;;2OD " "; /&*"4"4"D"DEJ$$Y^^4Eqy*5fu*={5ST9;?WK ((Z+@ )N  robject_templatec|jD]p}t|tjjr&|j |j j}n|j|}|j||r|S)z?Ensure an ObjectTemplate doesn't contain any ReferenceTemplates) old_child new_child) ryrPrrzr{rkr|r:rr~)r+rrrs rrzSymbolSpace._subresolvest%-- PE%!2!2!D!DE MM%))*=*=>  ,,U3  ) )EY ) O  P r enum_namec(|jtj|}t|tj j sMd}|jtj}|dkDr |d|||dzd}}tj||d||S)zJLook-up a set of enumeration choices from a specific symbol table.NrrzUnresolvable Enumeration: ) rvrrrPrrTemplaterr r=r rq)r+rrr-rs rrmzSymbolSpace.get_enumeration$s##JOOY?&*"4"4"="=>JNN9>>2Eqy(1&5(99UQY[;QI ((:)CI;'O  r member_typecP|jtj}t|dk(r |d}|d}ny||vry||}|tj k(r||j vS|tjk(r||jvS|tjk(r||jvSy)z2Test for membership of a component within a table.rrrF) rnr r=rErrtypesrrQr enumerations)r+rrCrsr-rtr4s r _membershipzSymbolSpace._membership2sZZ / z?a #AJ']N T !Z  *// )!U[[0 0 J-- -!U]]2 2 JOO +!U%7%77 7rcB|jtj|Sr#)rrrr+rCs rhas_typezSymbolSpace.has_typeH 66rcB|jtj|Sr#)rrrrs r has_symbolzSymbolSpace.has_symbolKs 1 1488rcB|jtj|Sr#)rrrrs rhas_enumerationzSymbolSpace.has_enumerationNrr)r!Nr#)layer)rN)0rrrrer%r7r2r9rr<intrBrGrrJrrMrrQrRr1rTrrr r_boolr r`rrzr{rhrrrvrrrkrrlrrmrrrrrfrgs@rr r (sP L 'S 'D '#c##;S;Xc];=A@@!$@69@ #@$SS (3- 'J..GG'D'#$! ""Xe_hx7H7H.IJDPQ"S "  "L rs     ML   8 $&&cN   g7*$$99g7T     0 0 EH   r