
    fH:                         d dl mZmZmZmZmZ d dlmZ d dlm	Z	m
Z
mZmZ d dlmZ d dlmZ d dlmZ  G d dej                  Z G d	 d
ej        j                  ZdS )    )IteratorListTupleOptionalUnion)	framework)	constants
exceptions
interfacesobjects)utility)intermed)
extensionsc                   (     e Zd ZddiZd fdZ xZS )LinuxKernelIntermedSymbolstype	interfacereturnNc                     t                      j        |i | |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j	                   |                     dt          j
                   |                     dt          j                   |                     d	t          j                   |                     d
t          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                   |                     dt          j                    |                     dt          j!                   |                     dt          j"                   d S )Nfile	list_head	mm_structsuper_blocktask_structvm_area_structqstrdentry	fs_structfiles_structkobjectcredmodulebpf_progkernel_cap_structkernel_cap_tvfsmountmountmnt_namespacenetsocketsock	inet_sock	unix_socknetlink_sock
vsock_sockpacket_sockbt_sockxdp_sock
maple_tree)#super__init__set_type_classr   struct_filer   r   r   r   r   r   r   r   r   r    r!   optional_set_type_classr"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   )selfargskwargs	__class__s      ^/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/__init__.pyr5   z#LinuxKernelIntermedSymbols.__init__   s   $)&))) 	FJ$:;;;K)=>>>K)=>>>M:+ABBBM:+ABBB,j.GHHHFJO444Hj&7888K)=>>>NJ,CDDDIz'9:::FJO444$$Xz/@AAA$$Z1DEEE$$%8*:VWWW$$^Z5LMMM 	J
(;<<<$$Wj.>???$$_j6NOOO 	E:>222Hj&7888FJO444K)=>>>K)=>>>$$^Z5LMMM$$\:3HIII$$]J4JKKK$$Y
0BCCC$$Z1DEEE 	$$\:3HIIIII    )r   N)__name__
__module____qualname__providesr5   __classcell__)r<   s   @r=   r   r      sQ        $H*J *J *J *J *J *J *J *J *J *Jr>   r   c                   6   e Zd ZdZdZdZ ej        e  ede	fd            Z
ede	fd            Zedede	f         fd            Zede	fd	            Zede	fd
            Zedej        j        de	dej        j        fd            Zedej        j        de	deej        j                 deee	eef                  fd            Zedej        j        de	deej        j                 deee	eef                  fd            Zedej        j        deee	eef                  defd            Zed             Zedede	de	dej        j        deej        j                 f
d            Z edej        j        dej        j        dej        j        fd             Z!dS )!LinuxUtilitiesz+Class with multiple useful linux functions.)      r   )rF   r   r   r   c                     |j                                         }|j                                         }|                                }|                                }|                     ||||          S )a  Returns the file pathname relative to the task's root directory.

        Args:
            task (task_struct): A reference task
            filp (file *): A pointer to an open file

        Returns:
            str: File pathname relative to the task's root directory.
        )fsget_root_dentryget_root_mnt
get_vfsmnt
get_dentrydo_get_path)clstaskfilprdentryrmntvfsmntr   s          r=   _get_path_filezLinuxUtilities._get_path_fileE   s`     '))++w##%%""""wff===r>   c                     |j                                         }|j                                         }|                                }|                                }|                     ||||          S )a  Returns the mount point pathname relative to the task's root directory.

        Args:
            task (task_struct): A reference task
            mnt (vfsmount or mount): A mounted filesystem or a mount point.
                - kernels < 3.3.8 type is 'vfsmount'
                - kernels >= 3.3.8 type is 'mount'

        Returns:
            str: Pathname of the mount point relative to the task's root directory.
        )rI   rJ   rK   get_vfsmnt_currentget_dentry_currentrN   )rO   rP   mntrR   rS   rT   r   s          r=   get_path_mntzLinuxUtilities.get_path_mntW   sd     '))++w##%%''))''))wff===r>   Nc                 Z   g }||k    s|                     |          s||                                k    s|                                rW||                                k    rn|                                sn|                                }|                                }|j        }|j                                        }|	                    |
                    d                     |}||k    |                     |          dd                    t          |                    z   }|S )a  Returns a pathname of the mount point or file
        It mimics the Linux kernel prepend_path function.

        Args:
            rdentry (dentry *): A pointer to the root dentry
            rmnt (vfsmount *): A pointer to the root vfsmount
            dentry (dentry *): A pointer to the dentry
            vfsmnt (vfsmount *): A pointer to the vfsmount

        Returns:
            str: Pathname of the mount point or file
        /)is_equalget_mnt_rootis_root
has_parentget_dentry_parentget_vfsmnt_parentd_parentd_namename_as_strappendstripjoinreversed)	rO   rR   rS   r   rT   path_reversedparentdnamepaths	            r=   rN   zLinuxUtilities.do_get_pathl   s%    vt'<'<,,....&..2B2B.V002222 ((** 11331133_FM--//E  S!1!1222F% vt'<'<( SXXh}55666r>   c                    |                                 }|                     ||          }|j        j        }t	          |                    |                    }t          |          dk    r|d                             t          j	                  d         }|dk    rd}	n5|dk    rd}	n,|dk    rd}	n#|d	k    r| 
                    ||          }	nd
| d}		 |j        j        }
n# t          j        $ r d}
Y nw xY w|	 d|
 d}nd|d}|S )a  Returns the sock pipe pathname relative to the task's root directory.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task (task_struct): A reference task
            filp (file *): A pointer to a sock pipe open file

        Returns:
            str: Sock pipe pathname relative to the task's root directory.
        rG   r   sockfs_dnamer*   anon_inodefs_dname
anon_inodepipefs_dnamepipesimple_dnamez<unsupported d_op symbol: >z	<UNKNOWN>z:[]z<invalid d_dname pointer> x)rM   get_module_from_volobj_typed_opd_dnamelist get_symbols_by_absolute_locationlensplitr	   BANGrU   d_inodei_inor
   InvalidAddressException)rO   contextrP   rQ   r   kernel_modulesym_addrsymbssympre_name	inode_numrets               r=   _get_new_sock_pipe_pathz&LinuxUtilities._get_new_sock_pipe_path   sL    ""77HH;&]CCHMMNNu::??(..003Cn$$#,,,'&&!&&--dD99 ?>>>("N0		5 ( ( ('			( -----CC <x;;;C
s   C# #C76C7c                    	 |                                 }|                                 n# t          j        $ r Y dS w xY w|dk    rdS d}	 |j        r(|j                            d          r|j        j        rd}n# t          j        $ r d}Y nw xY w|rt                              |||          }nt          	                    ||          }|S )a<  Returns a file (or sock pipe) pathname relative to the task's root directory.

        A 'file' structure doesn't have enough information to properly restore its
        full path we need the root mount information from task_struct to determine this

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            task (task_struct): A reference task
            filp (file *): A pointer to an open file

        Returns:
            str: A file (or sock pipe) pathname relative to the task's root directory.
         r   Frz   T)
rM   r_   r
   r   ry   
has_memberrz   rE   r   rU   )rO   r   rP   rQ   r   dname_is_validr   s          r=   path_for_filezLinuxUtilities.path_for_file   s   "	__&&FNN1 	 	 	22	 Q;;2		#&K**955& K'&
 "&1 	# 	# 	#"NNN	#  	< 88$MMCC //d;;C
s   (+ >>/A< <BBr   symbol_tablerP   c              #     K   |j         sd S |j                                         }|dk    rd S |j                                         }|dk    rd S |t          j        z   dz   }t
          j                            ||||          }t          |          D ].\  }}	|	dk    r#t          
                    |||	          }
||	|
fV  /d S )Nr   i  r   )countsubtyper   )filesget_fdsget_max_fdsr	   r   r   r   array_of_pointers	enumeraterE   r   )rO   r   r   rP   fd_tablemax_fds	file_typefdsfd_numrQ   	full_paths              r=   files_descriptors_for_processz,LinuxUtilities.files_descriptors_for_process   s       z 	4:%%''q==4*((** V4 9>1F:	o//GY 0 
 
 &cNN 	. 	.LFDqyy*88$MM	dI----		. 	.r>   
layer_namemodsc                 D    |j         |         j        fd|D             S )zZ
        A helper function to mask the starting and end address of kernel modules
        c                     g | ]]}t          j        |j                  |                                z  |                                z  |                                z   f^S  )r   array_to_stringnameget_module_baseget_core_size).0modmasks     r=   
<listcomp>z1LinuxUtilities.mask_mods_list.<locals>.<listcomp>!  sv     
 
 
 	 '11##%%,$$&&-1B1B1D1DD
 
 
r>   )layersaddress_mask)rO   r   r   r   r   s       @r=   mask_mods_listzLinuxUtilities.mask_mods_list  sA     ~j)6
 
 
 
 
 
 
 	
r>   kernel_module_name	mods_listc                 H   |j         |         }|j        |j                 j        }|                    d          }|j        j        |z  }|                    d          }|j        j        |z  }t          j        j	        ||fgt                              ||j        |          z   S )z`
        A helper function that gets the beginning and end address of the kernel module
        _text_etext)modulesr   r   r   object_from_symbolvoloffsetr	   linuxKERNEL_NAMErE   r   )rO   r   r   r   kernelr   
start_addrend_addrs           r=   generate_kernel_handler_infoz+LinuxUtilities.generate_kernel_handler_info*  s     !34~f/0=..w77
^*T1
,,X66<&- _(*h?
))'63DiPPQ 	Qr>   r   handlerstarget_addressc                 f   d}d}|D ]\  }}}||cxk    r|k    rn |}|t           j        j        k    rxt          |                    |                    }	t          |	          rGt           j        |	d         v r+|	d                             t           j                  d         n|	d         } n||fS )z
        Searches between the start and end address of the kernel module using target_address.
        Returns the module and symbol name of the address provided.
        UNKNOWNzN/Ar   rG   )r	   r   r   r{   r|   r}   r   r~   )
rO   r   r   r   mod_namesymbol_namer   startendsymbolss
             r=   lookup_module_addressz$LinuxUtilities.lookup_module_addressC  s      ( 	 	D%----#-----9?666"%FF~VV G 7||   )~;; $AJ,,Y^<<Q??!( $  .  $$r>   c              #      K   |r9|                     ||j        j                  }|V  t          ||          }|7d S d S )N)object_typer   )objectr   r   getattr)rO   vmlinuxstruct_namelist_member
list_startlist_structs         r=   walk_internal_listz!LinuxUtilities.walk_internal_liste  sk       	;!..'
0E )  K  k::J  	; 	; 	; 	; 	;r>   addr	type_namemember_namer   c                     |sdS |                     |          }|                    |          }||z
  }|                    ||d          S )a  Cast a member of a structure out to the containing structure.
        It mimicks the Linux kernel macro container_of() see include/linux.kernel.h

        Args:
            addr: The pointer to the member.
            type_name: The type of the container struct this is embedded in.
            member_name: The name of the member within the struct.
            vmlinux: The kernel symbols object

        Returns:
            The constructed object or None
        NT)r   r   absolute)get_typerelative_child_offsetr   )rO   r   r   r   r   type_decmember_offsetcontainer_addrs           r=   container_ofzLinuxUtilities.container_ofn  sc    *  	4##I.. 66{CC-~~!.4  
 
 	
r>   volobjc                 &   |j         j                            dd          }t          |          dk    r|d         nd}|j                            |          }t          |          }|st          d| d          |d         }|j        |         }|S )aV  Get the vmlinux from a vol obj

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            volobj (vol object): A vol object

        Raises:
            ValueError: If it cannot obtain any module from the symbol table

        Returns:
            A kernel object (vmlinux)
        !rG   rF   r   Nz"No module using the symbol table '')r   r   r~   r}   r   get_modules_by_symbol_tablesr{   
ValueError)rO   r   r   symbol_table_arrr   module_namesr   r   s           r=   rx   z*LinuxUtilities.get_module_from_volobj_type  s    $ ":/55c1==.12B.C.Cq.H.H'**dCCLQQL)) 	SQ,QQQRRR)!_!34r>   )"r?   r@   rA   __doc___version_required_framework_versionr   require_interface_versionclassmethodstrrU   rZ   r   rN   r   r   r   r   ContextInterfacer   ObjectInterfacer   r   r   r   intr   r   ModuleInterfacer   r   r   r   rx   r   r>   r=   rE   rE   =   s?       55H"+'I')DEE>3 > > > [>" > > > > [>( $5s;K $ $ $ [$L /S / / / [/b ,3 , , , [,\ .#4. .  0	. . . [.@ 
#4
 
 z)9:	

 
eCcM"	#
 
 
 [
( Q#4Q  Q J.>?	Q
 
eCcM"	#Q Q Q [Q0 %!)9% uS#s]+,% 	% % % [%B ; ; [; 

 
 	

 #3
 
*$4	5
 
 
 [
< #4 "2 
		+	   [  r>   rE   N)typingr   r   r   r   r   volatility3r   volatility3.frameworkr	   r
   r   r   volatility3.framework.objectsr   volatility3.framework.symbolsr   #volatility3.framework.symbols.linuxr   IntermediateSymbolTabler   configurationVersionableInterfacerE   r   r>   r=   <module>r      s   : 9 9 9 9 9 9 9 9 9 9 9 9 9 ! ! ! ! ! ! L L L L L L L L L L L L 1 1 1 1 1 1 2 2 2 2 2 2 : : : : : :-J -J -J -J -J!A -J -J -J`n n n n nZ-B n n n n nr>   