
    *1f                     L   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZmZmZmZmZmZmZmZ d dlmZmZ d dlmZmZmZmZmZ d dlmZ d dlm Z  d dl!m"Z"m#Z#  ej$        e%          Z&d#d
e'de(defdZ) G d dej        j*                  Z+ G d dej        j*        e	          Z, G d de,          Z- G d de-          Z. G d de.          Z/ G d de/          Z0 G d de0          Z1 G d de1          Z2 G d d e2          Z3 G d! d"e3          Z4dS )$    N)ABCMeta)	AnyDict	GeneratorIterableListMappingOptionalTupleType)schemassymbols)class_subclasses	constants
exceptions
interfacesobjects)requirements)	resources)metadatanativeFnameis_propertyreturnc                 8      fd}rt          |          S |S )Nc                 h    rt          | j                  S  t          | j                  |i |S N)getattr	_delegate)selfargskwargsr   r   s      X/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/intermed.py_delegate_functionz8_construct_delegate_function.<locals>._delegate_function9   s>     	14>4000,wt~t,,d=f===    )property)r   r   r$   s   `` r#   _construct_delegate_functionr'   8   sA    > > > > > >
  ,*+++r%   c                       e Zd ZdZ	 	 	 	 	 d%dej        j        dededed	ej        j	        d
e
eeef                  dede
eeeej        j                 f                  deddf fdZededeeeeef         ed         f         ded         fd            Z edd          Z edd          Z edd          Z edd          Z edd          Z ed          Z ed          Z ed          Z ed          Z ed          Z ed          Z  ed          Z!e"	 d&d ed!e
e         de#eddf         fd"            Z$e"	 	 	 	 d'dej        j        ded ed!ed	e
ej        j	                 d
e
eeef                  de
eeeej        j                 f                  dedefd#            Z%e"de&ej'        j(                 f fd$            Z) xZ*S )(IntermediateSymbolTablea  The IntermediateSymbolTable class reads a JSON file and conducts common
    tasks such as validation, construction by looking up a JSON file from the
    available files and ensuring the appropriate version of the schema and
    proxy are chosen.

    The JSON format itself is made up of various groups (symbols, user_types, base_types, enums and metadata)
        * Symbols link a name to a particular offset relative to the start of a section of memory
        * Base types define the simplest primitive data types, these can make more complex structure
        * User types define the more complex types by specifying members at a relative offset from the start of the type
        * Enums can specify a list of names and values and a type inside which the numeric encoding will fit
        * Metadata defines information about the originating file

    These are documented in JSONSchema JSON files located in volatility3/schemas.
    NTr   contextconfig_pathr   isf_urlnative_typestable_mappingvalidateclass_typessymbol_maskr   c
                 0   t          d t          t                    D                       | _        t	          j                                        |          5 }
t          j        d          }t          j
         ||
                    }ddd           n# 1 swxY w Y   |r+t          j        |          st          j        d|           |                    dd          }|st          j        d|            |                      |j        dd          | j                  ||||||          | _        | j        j        t&          j        k     r2t+          d	                     |j        dd          |                    | j        j        t&          j        k     r/t0                              d
 |j        dd           d|            t5                                          ||||p| j        j        ||           || j        d<   |	| j        d<   dS )aV  Instantiates a SymbolTable based on an IntermediateSymbolFormat JSON file.  This is validated against the
        appropriate schema.  The validation can be disabled by passing validate = False, but this should almost never be
        done.

        Args:
            context: The volatility context for the symbol table
            config_path: The configuration path for the symbol table
            name: The name for the symbol table (this is used in symbols e.g. table!symbol )
            isf_url: The URL pointing to the ISF file location
            native_types: The NativeSymbolTable that contains the native types for this symbol table
            table_mapping: A dictionary linking names referenced in the file with symbol tables in the context
            validate: Determines whether the ISF file will be validated against the appropriate schema
            class_types: A dictionary of type names and classes that override StructType when they are instantiated
            symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking)
        c                      g | ]}|j         |fS  )version.0xs     r#   
<listcomp>z4IntermediateSymbolTable.__init__.<locals>.<listcomp>r   s    WWW!	1~WWWr%   zutf-8Nz'File does not pass version validation: r   z)Invalid ISF file attempted to be parsed: formatz0.0.0z)ISF version {} is no longer supported: {}zISF version z has been deprecated: )r.   r0   r,   r1   )dictr   ISFormatTable	_versionsr   ResourceAccessoropencodecs	getreaderjsonloadr   r/   r   SymbolSpaceErrorget_closest_versionr   r5   r   ISF_MINIMUM_SUPPORTEDRuntimeErrorr:   ISF_MINIMUM_DEPRECATEDvollogwarningsuper__init__nativesconfig)r    r*   r+   r   r,   r-   r.   r/   r0   r1   fpreaderjson_objectr   	__class__s                 r#   rM   z IntermediateSymbolTable.__init__S   s}   > WW7G7V7VWWWXX'))..w77 	02%g..F)FF2JJ//K	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0 	0
  	G,[99 	-C'CC   ??:t44 	-EGEE  

..HL7++T^
 

;k<P P >!I$CCC;BB HL733W   
 ^#i&FFFNN_|x|Hg>>__V]__  
 	2DN2'# 	 	
 	
 	
 ")I%0M"""s   2BBBr5   versionsr<   c                     d |                      d          D             \  }fd|D             }|st          d|            |t          |                   S )a  Determines the highest suitable handler for specified version
        format.

        An interface version such as Major.Minor.Patch means that Major
        of the provider must be equal to that of the   consumer, and the
        provider (the JSON in this instance) must have a greater minor
        (indicating that only additive   changes have been made) than
        the consumer (in this case, the file reader).
        c                 ,    g | ]}t          |          S r4   )intr6   s     r#   r9   z<IntermediateSymbolTable._closest_version.<locals>.<listcomp>   s    BBB!s1vvBBBr%   .c                 D    g | ]}|d          k    |d         k    |S )r      r4   )r7   r8   majorminors     r#   r9   z<IntermediateSymbolTable._closest_version.<locals>.<listcomp>   s.    UUUAQqTU]]qtu}}a}}}r%   zJNo Intermediate Format interface versions support file interface version: )split
ValueErrormax)r5   rT   patchsupported_versionsr[   r\   s       @@r#   rF   z(IntermediateSymbolTable._closest_version   s     CBw}}S/A/ABBBueUUUUUUUU! 	f]dff   .//00r%   r   typesenumerationsr   producerclear_symbol_cacheget_type
get_symbolget_enumerationget_type_classset_type_classdel_type_classsub_pathfilenamec              #     K   t           j        }|d}|}n2d                    t          j                            |                    }t                              t           j        dd                    t          j
                              t          j
        D ]}t          j                            |          sBt          j                            t          j                            t          |                    }|D ]{}	 t          j        |                              |                                                              ||z             D ]}|                                V  l# t(          $ r Y xw xY wt          j        |                              |                                                              |dz             D ]}t+          j        |          5 }	|	                                D ]f}
|D ]a}|
                    ||z             s|dk    rA|
                    |          r,dt3          t          j        |                    z   dz   |
z   V  bg	 ddd           n# 1 swxY w Y   dS )	zReturns an iterator of appropriate file-scheme symbol URLs that can
        be opened by a ResourceAccessor class.

        Filter reduces the number of results returned to only those URLs
        containing that string
        N*/zSearching for symbols in z, z.zipz	jar:file:!)r   ISF_EXTENSIONSjoinospathr]   rJ   logLOGLEVEL_VVVVr   __path__isabsabspath__file__pathlibPathjoinpathresolverglobas_uriFileNotFoundErrorzipfileZipFilenamelistendswithstr)clsrl   rm   
extensions	zip_matchru   	extensionfoundzip_pathzfiler   s              r#   file_symbol_urlz'IntermediateSymbolTable.file_symbol_url   s      -
H II x!8!899I 	

#E		'2B(C(CEE	
 	
 	
 $ 	/ 	/D7==&& Ewrw||Hd'C'CDD'  	
T**!(++ x)344	- - $llnn,,,,- )   D T""++H55==??EEhQWFWXX/ / _X.. 	/% % 0 0 / /)3 / /I#}}Y-BCC / )S 0 0T]]95M5M 0&1C$+L$:$:5" 5" '"$''(*.'/ !/ !/ !///	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/ 	/	/%	/ 	/s&   A(E++
E87E8 A<I))I-0I-c	           
      
   t          |                     ||                    }	|	st          d|          |j                            |          }
 | |||
|	d         ||||          }|j                            |           |
S )a  Takes a context and loads an intermediate symbol table based on a
        filename.

        Args:
            context: The context that the current plugin is being run within
            config_path: The configuration path for reading/storing configuration information this symbol table may use
            sub_path: The path under a suitable symbol path (defaults to volatility3/symbols and volatility3/framework/symbols) to check
            filename: Basename of the file to find under the sub_path
            native_types: Set of native types, defaults to native types read from the intermediate symbol format file
            table_mapping: a dictionary of table names mentioned within the ISF file, and the tables within the context which they map to
            symbol_mask: An address mask used for all returned symbol offsets from this table (a mask of 0 disables masking)

        Returns:
             the name of the added symbol table
        z.No symbol files found at provided filename: {}r   )r*   r+   r   r,   r-   r.   r0   r1   )listr   r   symbol_spacefree_table_nameappend)r   r*   r+   rl   rm   r-   r.   r0   r1   urls
table_nametables               r#   createzIntermediateSymbolTable.create   s    : C''(;;<< 	#@(   )99(CC
#G%'##	
 	
 	
 	##E***r%   c                 t    t                                                      t          j        dd          gz   S )Nr,   zJJSON file containing the symbols encoded in the Intermediate Symbol Format)description)rL   get_requirementsr   StringRequirement)r   rS   s    r#   r   z(IntermediateSymbolTable.get_requirements-  s@    ww''))*h  -
 
 	
r%   )NNTNr   r   )NNNr   )+__name__
__module____qualname____doc__r   r*   ContextInterfacer   r   NativeTableInterfacer
   r   boolr	   r   r   ObjectInterfacerW   rM   staticmethodr   rF   r'   rb   rc   r   rd   re   rf   rg   rh   ri   rj   rk   classmethodr   r   r   r   configurationRequirementInterfacer   __classcell__rS   s   @r#   r)   r)   C   s        * AE26 L1 L1#4L1 L1 	L1
 L1 !(=L1  S#X/L1 L1 Cj0@AAB
L1 L1 
L1 L1 L1 L1 L1 L1\ 11 $U3S=%94;P%P Q1	o	1 1 1 \1( +*9d;;G(($77E//EEL++J==H++J==H556JKK++J77H--l;;J223DEEO112BCCN112BCCN112BCCN6:7/ 7/7/&.sm7/	3d?	#7/ 7/ 7/ [7/r  KO26 - -#4- - 	-
 - z1FG-  S#X/- Cj0@AAB
- - 
- - - [-^ 
j&>&S!T 
 
 
 
 
 [
 
 
 
 
r%   r)   c                   .    e Zd ZdZdZ	 	 ddej        j        dedede	dej
        j        d	eeeef                  d
df fdZd
eej
        j                 fdZddZed
eej
        j                 fd            Zed
ed         fd            ZddZ xZS )r<   z0Provide a base class to identify all subclasses.)r   r   r   Nr*   r+   r   rR   r-   r.   r   c                    || _         |                                  || _        |p|                                 }|t	          d          |dz   |_        t                                          |||||           i | _        i | _        d S )NzNative table not provided_natives)r.   )	_json_object_validate_jsonr   _get_natives	TypeErrorrL   rM   
_overrides_symbol_cache)	r    r*   r+   r   rR   r-   r.   ntrS   s	           r#   rM   zISFormatTable.__init__<  s     (	0T..00:7888#+tR}UUUOQLNr%   c                 h   t           j        t           j        d}t          |          D ]}||         }| j        d         D ]J}	 | j        d         |         d         |                    |          j        k    r n7;# t          $ r Y Gw xY wt          	                    d|            |j
        c S dS )JDetermines the appropriate native_types to use from the JSON
        data.x64x86
base_typeslength1Choosing appropriate natives for symbol library: Nr   x64NativeTablex86NativeTablesortedr   rf   sizer   rJ   debugrN   r    classesncnative_class	base_types        r#   r   zISFormatTable._get_nativesP  s     !/8MNN// 	, 	,B"2;L!.|< , ,	),7	B8L'00;;@A A A !   D UQSUUVVV#++++  t   5A;;
BBc                     d| j         vs$d| j         vsd| j         vsd| j         vs	d| j         vrt          j        d          d S )N
user_typesr   r   r   enumszMalformed JSON file provided)r   r   rD   r    s    r#   r   zISFormatTable._validate_jsonh  sb     1114#444!222 111d///-.LMMM 0/r%   c                     dS )PReturns a metadata object containing information about the symbol
        table.Nr4   r   s    r#   r   zISFormatTable.metadatar  s	     tr%   zmetadata.ProducerMetadatac                     t          j        | j                            di                               di                     S )r   r   rd   )r   ProducerMetadatar   rE   r   s    r#   rd   zISFormatTable.producerx  s?     (!!*b1155j"EE
 
 	
r%   c                 8    | j                                          dS )z,Clears the symbol cache of the symbol table.N)r   clearr   s    r#   re   z ISFormatTable.clear_symbol_cache  s      """""r%   )NN)r   N)r   r   r   r   r5   r   r*   r   r   r   r   r   r
   r   rM   r   r   r&   MetadataInterfacer   rd   re   r   r   s   @r#   r<   r<   7  ss       ::G AE26O O#4O O 	O
 O !(=O  S#X/O 
O O O O O O(hz'9'NO    0N N N N (:#5#GH    X
 
(#>? 
 
 
 X
# # # # # # # #r%   r<   )	metaclassc                      e Zd ZdZdZdedej        j        fdZ	e
dee         fd            Ze
dee         fd            Ze
dee         fd            Zdedeej        j                 fd	Zded
eej        j                 ddfdZdeddfdZdeeef         dej        j        fdZdedeeef         fdZdedej        j        fdZdedej        j        fdZdS )Version1FormatEClass for storing intermediate debugging data as objects and classes.)r   r   rZ   r   r   c                    | j                             |d          r| j         |         S | j        d                             |d          }|st          j        || j        d|           |d         }| j                            dd          r|| j        d         z  }t          j        	                    ||          | j         |<   | j         |         S )z5Returns the location offset given by the symbol name.Nr   Unknown symbol: addressr1   r   )r   r   )
r   rE   r   r   SymbolErrorr   rO   r   r   SymbolInterface)r    r   symbolr   s       r#   rg   zVersion1Format.get_symbol  s     !!$-- 	,%d++"9-11$== 	U(ty:ST:S:STTT#;??=!,, 	;M ::G#-#5#E#Ew $F $
 $
4  !$''r%   c                 R    t          | j                            di                     S )z(Returns an iterator of the symbol names.r   r   r   rE   r   s    r#   r   zVersion1Format.symbols  s%     D%)))R88999r%   c                 R    t          | j                            di                     S )z2Returns an iterator of the available enumerations.r   r   r   s    r#   rc   zVersion1Format.enumerations  s%     D%))'266777r%   c                     t          | j                            di                     t          | j        j                  z   S )z-Returns an iterator of the symbol type names.r   )r   r   rE   rN   rb   r   s    r#   rb   zVersion1Format.types  s7     D%)),;;<<tDLDV?W?WWWr%   c                 L    | j                             |t          j                  S r   )r   rE   r   AggregateTyper    r   s     r#   ri   zVersion1Format.get_type_class  s    ""4)>???r%   clazzNc                 `    || j         vrt          d| j         d|           || j        |<   d S )NzSymbol type not in z SymbolTable: )rb   r^   r   r   )r    r   r   s      r#   rj   zVersion1Format.set_type_class  sD     tz!!R49RRDRRSSS %r%   c                 ,    || j         v r
| j         |= d S d S r   )r   r   s     r#   rk   zVersion1Format.del_type_class  s'    4?""%%% #"r%   
dictionaryc                 *   |st          j        d|           |d         }|dk    r|d         }|| j        j        v rP| j                            | j        t          j        z   |z             }i }|dk    r*|d         |d<   |                     |d                   |d<   n|dk    rz|	                    dd	          rE| j                            | j        t          j        z   |d         z             }|j
        d
         |d
<   |                     |d                   |d<   n`|dk    r|                     |d                   }n>|dk    r8|d         |d         |d         z   d}|                     |d                   |d<    |j        di | |S |d         t          j                                        vrt          j        d|           |d         }t          j        |vr| j        t          j        z   |z   }n{|                    t          j                  }| j        	                    |d         |d                   t          j        z   t          j                            |dd	                   z   }t          j                            |          S )z=Converts an intermediate format dict into an object template.z!Invalid intermediate dictionary: kindbaser   arraycountsubtypepointerNdata_formatenumbitfieldbit_position
bit_length)	start_bitend_bittyper   zUnknown Intermediate format: r   rZ   )	type_namer4   )r   rD   rN   rb   rf   r   r   BANG_interdict_to_templaterE   vol_lookup_enum
update_volr   AggregateTypesvaluesr]   r.   rs   	templatesReferenceTemplate)r    r   r   native_templateupdater   reference_namereference_partss           r#   r   z%Version1Format._interdict_to_template  s     	-@J@@   v&	"6*I***"l33	IN*Y6 O
 FG##",W"5w$($?$?
9@U$V$Vy!!i''>>&$// I $ 5 5	IN2Z5GG! !I -6M-,HF=)$($?$?
9@U$V$Vy!!f$$**:f+=>>j((!+N!;).9J|<TT  '+&A&A*VBT&U&U{# 'O&00000"" fW%;%B%B%D%DDD-<
<<   $F+>//!Y7.HNN,229>BBO"&&q'9?1;MNN.!.%%oabb&9::;   22^2LLLr%   c                     | j         d                             |d          }|st          j        d|           t	          j        |d                   | j                            |d                   d}|S )z\Looks up an enumeration and returns a dictionary of __init__
        parameters for an Enum.r   NzUnknown enumeration: r   r   )choicesr   )r   rE   r   rD   copydeepcopyrN   rf   )r    r   lookupresults       r#   r   zVersion1Format._lookup_enum  s     "7+//d;; 	N-.Ld.L.LMMM}VK%899..vf~>>
 
 r%   	enum_namec                    t           j        |v rt          j        || j        d|           || j        d         vr&t          j        || j        d| j         d|           | j        d         |         }| j                            |d                   }t          j	        
                    | j        t           j        z   |z   t          j        ||d                   S )z#Resolves an individual enumeration.z-Enumeration for a different table requested: r   zEnumeration not found in z table: r   r   )r   object_classr   r  )r   r   r   r   r   r   rN   rf   r   r   ObjectTemplateEnumeration)r    r  curdictr   s       r#   rh   zVersion1Format.get_enumeration  s    >Y&&(	K	KK  
 D-g666(	JDIJJyJJ  
 #G,Y7L))'&/::	 //i).09< ,K(	 0 
 
 	
r%   r   c                 $   t           j        |v r_|                    t           j                  }|d|         ||dz   d         }}t          j        ||d|t           j        z   |z              || j        d         vr/| j                            | j        t           j        z   |z             S | j        d         |         }i }|d         D ]8}|d         |         }|d         | 	                    |d                   f}|||<   9| 
                    |          }	|	t          j        k    r-t          j        D ] }
t          j        |
         |d         k    r|
}	!t          j                            | j        t           j        z   |z   |	|d	         |
          S )Resolves an individual symbol.NrZ   (Symbol for a different table requested: r   fieldsoffsetr   r   r   r   r  r   members)r   r   findr   r   r   rN   rf   r   r   ri   r   r   r   r   r  r    r   indexr   r  r  member_name	interdictmemberr  r   s              r#   rf   zVersion1Format.get_type  s   >Y&&NN9>22E$-fuf$5y7M	J(d:	;VYb;bdd  
 D-l;;;<((Y^)Ci)OPPP#L1)<"8, 	* 	*K)+6I(#++If,=>>F $*GK  **9557000 / ) ))%0GFOCC#(L //i).09<%"	 0 
 
 	
r%   )r   r   r   r   r5   r   r   r   r   rg   r&   r   rc   rb   r   r   r   ri   rj   rk   r   r   Templater   r   rh   rf   r4   r%   r#   r   r     s       OOG(s (z'9'I ( ( ( ($ :# : : : X: 8hsm 8 8 8 X8 Xx} X X X XX@3 @4
0B0R+S @ @ @ @&& $Z%7%G H&	& & & &&3 &4 & & & &=MsCx.=M			$=M =M =M =M~
 
c3h 
 
 
 

 
1C1L 
 
 
 
2 
#  
**<*E  
  
  
  
  
  
r%   r   c                   f    e Zd ZdZdZdeej        j                 fdZ	de
dej        j        fdZdS )Version2Formatr   )   r   r   r   c                 h   t           j        t           j        d}t          |          D ]}||         }| j        d         D ]J}	 | j        d         |         d         |                    |          j        k    r n7;# t          $ r Y Gw xY wt          	                    d|            |j
        c S dS )r   r   r   r   r   Nr   r   s        r#   r   zVersion2Format._get_nativesE  s     !/8MNN// 	, 	,B"2;L!.|< , ,	),7	B6J'00;;@A A A !   D UQSUUVVV#++++  tr   r   c                 |   t           j        |v r_|                    t           j                  }|d|         ||dz   d         }}t          j        ||d|t           j        z   |z              || j        d         vr[|| j        j        v r/| j                            | j	        t           j        z   |z             S t          j        || j	        d|           | j        d         |         }i }|d         D ]8}|d         |         }|d         | 
                    |d                   f}|||<   9|                     |          }	|	t          j        k    r-t          j        D ] }
t          j        |
         |d	         k    r|
}	!t          j                            | j	        t           j        z   |z   |	|d
         |          S )r  NrZ   r  r   r   r  r  r   r   r   r  )r   r   r  r   r   r   rN   rb   rf   r   r   ri   r   r   r   r   r  r  s              r#   rf   zVersion2Format.get_typeZ  s   >Y&&NN9>22E$-fuf$5y7M	J(d:	;VYb;bdd  
 D-l;;;DL...|,,TY-G)-STTT ,ty*HY*H*H   #L1)<"8, 	* 	*K)+6I(#++If,=>>F $*GK  **9557000 / ) ))%0GFOCC#(L //i).09<%	 0 
 
 	
r%   N)r   r   r   r   r5   r
   r   r   r   r   r   r   r  rf   r4   r%   r#   r!  r!  @  sm        OOGhz'9'NO    *%
# %
**<*E %
 %
 %
 %
 %
 %
r%   r!  c                   :    e Zd ZdZdZdedej        j        fdZ	dS )Version3Formatr   )r"  rZ   r   r   r   c                    | j                             |d          r| j         |         S | j        d                             |d          }|st          j        || j        d|           |d         }| j                            dd          r|| j        d         z  }d}d|v r|                     |d                   }t          j	        
                    |||          | j         |<   | j         |         S )	,Returns the symbol given by the symbol name.Nr   r   r   r1   r   r   )r   r   r   )r   rE   r   r   r   r   rO   r   r   r   r   )r    r   r   r   symbol_types        r#   rg   zVersion3Format.get_symbol  s   !!$-- 	,%d++"9-11$== 	U(ty:ST:S:STTT#;??=!,, 	;M ::GV55fVnEEK#-#5#E#Ew[ $F $
 $
4  !$''r%   N
r   r   r   r   r5   r   r   r   r   rg   r4   r%   r#   r&  r&    sG        OOG(s (z'9'I ( ( ( ( ( (r%   r&  c                       e Zd ZdZdZej        ej        ej        ej        ej	        dZ
deej        j                 fdZdS )Version4Formatr   )   r   r   )rW   floatvoidr   charr   c                 4   i }| j         d         }|D ]q}|dk    ri||         }|d         | j        vrt          d          |d         |d         |d         f}| j        |d                  }|dk    rt          j        }||f||<   rt          j        d	|
          S )r   r   r/  r   zUnsupported base kindr   endiansignedr   r   )r   native_dictionary)r   format_mappingr^   r   Pointerr   NativeTable)r    native_dictr   r   current
format_valobject_types          r#   r   zVersion4Format._get_natives  s     &|4
# 	C 	CIF""$Y/6?$*===$%<===%fowx/@'(BST
"1'&/B	))")/K*5z)BI&!x;OOOOr%   N)r   r   r   r   r5   r   IntegerFloatBooleanCharr5  r
   r   r   r   r   r4   r%   r#   r,  r,    ss        OOG  NPhz'9'NO P P P P P Pr%   r,  c                   :    e Zd ZdZdZdedej        j        fdZ	dS )Version5Formatr   )r-  rZ   r   r   r   c                 F   | j                             |d          r| j         |         S | j        d                             |d          }|st          j        || j        d|           |d         }| j                            dd          r|| j        d         z  }d}d|v r|                     |d                   }d}d|v r't          j	        |                    d                    }t          j                            ||||	          | j         |<   | j         |         S )
r(  Nr   r   r   r1   r   r   constant_data)r   r   r   rC  )r   rE   r   r   r   r   rO   r   base64	b64decoder   r   r   )r    r   r   r   r)  symbol_constant_datas         r#   rg   zVersion5Format.get_symbol  s;   !!$-- 	,%d++"9-11$== 	U(ty:ST:S:STTT#;??=!,, 	;M ::GV55fVnEEK#f$$#)#3FJJ4O4O#P#P #-#5#E#E.	 $F $
 $
4  !$''r%   Nr*  r4   r%   r#   rA  rA    sG        OOG(s (z'9'I ( ( ( ( ( (r%   rA  c                   R    e Zd ZdZdZedeej        j	                 fd            Z
dS )Version6Formatr   )   r   r   r   c                 R   | j                             di                               d          r%t          j        | j         d         d                   S | j                             di                               d          r%t          j        | j         d         d                   S dS )z#Returns a MetadataInterface object.r   windowslinuxN)r   rE   r   WindowsMetadataLinuxMetadatar   s    r#   r   zVersion6Format.metadata  s       R0044Y?? 	V+D,=j,I),TUUU  R0044W== 	R)$*;J*G*PQQQtr%   N)r   r   r   r   r5   r&   r
   r   r   r   r   r4   r%   r#   rH  rH    sO        OOG(:#5#GH    X  r%   rH  c                       e Zd ZdZdZdS )Version7Formatr   )rI  rZ   r   N)r   r   r   r   r5   r4   r%   r#   rP  rP    s        OOGGGr%   rP  c                       e Zd ZdZdZdeeeeef         f         deeee	e
j        j        f         f         fdZ	 ddeeeeef         f         de	deee	eef         ddf         fd	Zd
ede
j        j        fdZdS )Version8Formatr   )rI  r"  r   r  r   c                     i }|                      |          D ](\  }}}||                     |d                   f}|||<   )|S )zFor each type field, it walks its tree of subtypes, reducing the hierarchy to just one level.
        It creates a tuple of offset and object templates for each field.
        r   )_reduce_fieldsr   )r    r  r  
new_offsetr  member_valuer  s          r#   _process_fieldszVersion8Format._process_fields  s\     595H5H5P5P 	* 	*1J\ $"="=l6>R"S"STF#)GK  r%   r   parent_offsetNc              #   t  K   |                                 D ]\  }}||                    dd          z   }|                    dd          ret          |t                    rP| j        d                             |d         d         i           }|                     |d         |          E d	{V  |||fV  d	S )
zReduce the fields bringing them one level up. It supports anonymous types such as structs or unions in any
        level of depth.r  r   	anonymousFr   r   r   r  N)itemsrE   
isinstancer;   r   rT  )r    r  rX  r  rV  rU  r   s          r#   rT  zVersion8Format._reduce_fields  s      
 *0 		< 		<%K&)9)9(A)F)FFJU33 <
<QU8V8V <+L9== (0"   ..wx/@*MMMMMMMMMM +|;;;;;		< 		<r%   r   c                    |                     t          j                  }|dk    r@|d|         ||dz   d         }}t          j        ||d|t          j        z   |z              | j        d                             |          }|/| j                            | j	        t          j        z   |z             S | 
                    |d                   }|                     |          }|t          j        k    r-t          j        D ] }t          j        |         |d         k    r|}!t          j                            | j	        t          j        z   |z   ||d         |	          S )
r  NrZ   r  r   r  r   r   r  )r  r   r   r   r   r   rE   rN   rf   r   rW  ri   r   r   r   r   r  )r    r   r  r   type_definitionr  r  r   s           r#   rf   zVersion8Format.get_type  s_   y~..B;;$-fuf$5y7M	J(d:	;VYb;bdd   +L9==iHH"<((Y^)Ci)OPPP&&x'@AA**9557000 / ) ))%0OF4KKK#(L //i).09<% (	 0 
 
 	
r%   )r   )r   r   r   r   r5   r   r   r   r   rW   r   r   r  rW  r   rT  rf   r4   r%   r#   rR  rR    s        OOG
3S#X./
	c5j099::	;
 
 
 
 GH< <3S#X./<@C<	5c4($4	5< < < < 
# 
**<*E 
 
 
 
 
 
r%   rR  )F)5rD  r@   r  rB   loggingrt   r|   r   abcr   typingr   r   r   r   r   r	   r
   r   r   volatility3r   r   volatility3.frameworkr   r   r   r   r   #volatility3.framework.configurationr   volatility3.framework.layersr   volatility3.framework.symbolsr   r   	getLoggerr   rJ   r   r   r'   SymbolTableInterfacer)   r<   r   r!  r&  r,  rA  rH  rP  rR  r4   r%   r#   <module>rj     sg  
      				         W W W W W W W W W W W W W W W W W W W W W W ( ( ( ( ( ( ( (              = < < < < < 2 2 2 2 2 2 : : : : : : : :		8	$	$8 s  #    q
 q
 q
 q
 q
j0E q
 q
 q
hK# K# K# K# K#J&;w K# K# K# K#\x
 x
 x
 x
 x
] x
 x
 x
v?
 ?
 ?
 ?
 ?
^ ?
 ?
 ?
D( ( ( ( (^ ( ( (4P P P P P^ P P PB( ( ( ( (^ ( ( (@    ^       ^   =
 =
 =
 =
 =
^ =
 =
 =
 =
 =
r%   