[ #g=iHddlZddlZddlmZmZddlmZmZmZm Z m Z ddl m Z ddl mZmZmZmZddlmZddlmZddlmZGd d ej0ZGd d ej4j6ZGd deZGddeZGddeZGdde Z!y)N)ABCabstractmethod)IteratorListTupleOptionalUnion) framework) constants exceptions interfacesobjects)utility)intermed) extensionsc(eZdZddiZdfd ZxZS)LinuxKernelIntermedSymbolstype interfacecd t||i||jdtj|jdtj |jdtj |jdtj|jdtj|jdtj|jdtj|jdtj|jd tj|jd tj|jd tj|jd tj|jd tj |jdtj"|jdtj$|jdtj&|j)dtj*|j)dtj,|j)dtj.|j)dtj0|j)dtj2|j)dtj4|j)dtj4|jdtj6|j)dtj8|j)dtj:|jdtj<|jdtj>|jdtj@|jdtjB|jdtjD|j)d tjF|j)d!tjH|j)d"tjJ|j)d#tjL|j)d$tjN|j)d%tjPy)&Nfile list_head mm_struct super_block task_structvm_area_structqstrdentry fs_struct files_structkobjectcredinodeidr address_spacepagemodulebpf_prog bpf_prog_auxkernel_cap_struct kernel_cap_t timespec64timespecvfsmountmount mnt_namespacenetsocketsock inet_sock unix_sock netlink_sock vsock_sock packet_sockbt_sockxdp_sock maple_tree))super__init__set_type_classr struct_filerrrrrrrrr r!r"r#IDRr%r&optional_set_type_classr'r(r)r*r+r,r.r/r0r1r2r3r4r5r6r7r8r9r:r;)selfargskwargs __class__s ^/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/__init__.pyr=z#LinuxKernelIntermedSymbols.__init__sC $)&) FJ$:$:; K)=)=> K)=)=> M:+A+AB M:+A+AB ,j.G.GH FJOO4 Hj&7&78 K)=)=> NJ,C,CD Iz'9'9: FJOO4 GZ%5%56 E:>>2 OZ-E-EF FJOO4 $$Xz/@/@A $$Z1D1DE $$^Z5L5LM $$%8*:V:VW $$^Z5L5LM $$\:3H3HI $$Z1F1FG J (;(;< $$Wj.>.>? $$_j6N6NO E:>>2 Hj&7&78 FJOO4 K)=)=> K)=)=> $$^Z5L5LM $$\:3H3HI $$]J4J4JK $$Y 0B0BC $$Z1D1DE $$\:3H3HIreturnN)__name__ __module__ __qualname__providesr= __classcell__rEs@rFrrs $H4J4JrGrc eZdZdZdZdZejeede fdZ ede fdZ ede de ffdZ ede fd Zede fd Zed ej"j$d e d ej&j(fdZed ej"j$de deej&j(deee eeffdZed ej"j$de deej&j(deee eeffdZedej"j8deee eefdefdZedZedede de dej"j8deej&j(f dZ ed ej"j$dej&j(dej"j8fd Z!y)!LinuxUtilitiesz+Class with multiple useful linux functions.)rS)rRrrrIc|jj}|jj}|j}|j }|j ||||S)aReturns the file pathname relative to the task's root directory. Args: task (task_struct): A reference task filp (file *): A pointer to an open file Returns: str: File pathname relative to the task's root directory. )fsget_root_dentry get_root_mnt get_vfsmnt get_dentry do_get_path)clstaskfilprdentryrmntvfsmntrs rF_get_path_filezLinuxUtilities._get_path_fileRsU''))+ww##%""wff==rGc|jj}|jj}|j}|j }|j ||||S)aReturns the mount point pathname relative to the task's root directory. Args: task (task_struct): A reference task mnt (vfsmount or mount): A mounted filesystem or a mount point. - kernels < 3.3.8 type is 'vfsmount' - kernels >= 3.3.8 type is 'mount' Returns: str: Pathname of the mount point relative to the task's root directory. )rUrVrWget_vfsmnt_currentget_dentry_currentrZ)r[r\mntr^r_r`rs rF get_path_mntzLinuxUtilities.get_path_mntdsY''))+ww##%'')'')wff==rGNcg}||k7s|j|s||jk(s|jrF||jk7rn|jsn|j }|j }|j }|jj}|j|jd|}||k7r|j|sddjt|z}|S)aReturns a pathname of the mount point or file It mimics the Linux kernel prepend_path function. Args: rdentry (dentry *): A pointer to the root dentry rmnt (vfsmount *): A pointer to the root vfsmount dentry (dentry *): A pointer to the dentry vfsmnt (vfsmount *): A pointer to the vfsmount Returns: str: Pathname of the mount point or file /) is_equal get_mnt_rootis_root has_parentget_dentry_parentget_vfsmnt_parentd_parentd_name name_as_strappendstripjoinreversed) r[r^r_rr` path_reversedparentdnamepaths rFrZzLinuxUtilities.do_get_pathys vt'<,,..&..2BV0022((*113113__FMM--/E  S!1 2F%vt'<(SXXh}566 rGc|j}|j||}|jj}t |j |}t |dk(r||djtjd}|dk(rd} n.|dk(rd} n&|dk(rd} n|d k(r|j||} nd |d } |jj} | d | d} | Sd|d} | S#tj$rd } Y)wxYw)aReturns the sock pipe pathname relative to the task's root directory. Args: context: The context to retrieve required elements (layers, symbol tables) from task (task_struct): A reference task filp (file *): A pointer to a sock pipe open file Returns: str: Sock pipe pathname relative to the task's root directory. rSr sockfs_dnamer2anon_inodefs_dname anon_inode pipefs_dnamepipe simple_dnamezz z:[]z x)rYget_module_from_volobj_typed_opd_dnamelist get_symbols_by_absolute_locationlensplitr BANGrad_inodei_inor InvalidAddressException) r[contextr\r]r kernel_modulesym_addrsymbssympre_name inode_numrets rF_get_new_sock_pipe_pathz&LinuxUtilities._get_new_sock_pipe_paths"77H ;;&&]CCHMN u:?(..03Cn$#,,'&!&--dD98uA> ("NN00 Jb 1-C  /xl;C 55 ('  (s=C%%C=<C=c |j}|j|dk(ryd} |jr3|jj dr|jj rd}|rtj|||}|Stj||}|S#tj$rYywxYw#tj$rd}YcwxYw)a<Returns a file (or sock pipe) pathname relative to the task's root directory. A 'file' structure doesn't have enough information to properly restore its full path we need the root mount information from task_struct to determine this Args: context: The context to retrieve required elements (layers, symbol tables) from task (task_struct): A reference task filp (file *): A pointer to an open file Returns: str: A file (or sock pipe) pathname relative to the task's root directory. rFrT) rYrkr rr has_memberrrQrra)r[rr\r]rdname_is_validrs rF path_for_filezLinuxUtilities.path_for_files" __&F NN  Q; # KK**95KK''!%  88$MC !//d;C 311  "11 #"N #s" B?B6B32B36C Cr symbol_tabler\c#K|jsy|jj}|dk(ry|jj}|dkDry|tjzdz}t j j||||}t|D])\}} | dk7s tj||| } || | f+yw)Nri r)countsubtyper) filesget_fds get_max_fdsr rrrarray_of_pointers enumeraterQr) r[rrr\fd_tablemax_fds file_typefdsfd_numr] full_paths rFfiles_descriptors_for_processz,LinuxUtilities.files_descriptors_for_processszz::%%' q=**((* V  9>>1F: oo// GY0 &cNLFDqy*88$M dI-- +s BC !C layer_namemodsc|j|j}|Dcgc]W}tj|j|j |z|j |z|j zfYc}Scc}w)zZ A helper function to mask the starting and end address of kernel modules )layers address_maskrarray_to_stringnameget_module_base get_core_size)r[rrrmaskmods rFmask_mods_listzLinuxUtilities.mask_mods_list"s~~j)66   ''1##%,$$&-1B1B1DD    sAA=kernel_module_name mods_listc|j|}|j|jj}|j d}|j j |z}|j d}|j j |z}tjj||fgtj||j|zS)z` A helper function that gets the beginning and end address of the kernel module _text_etext) modulesrrrobject_from_symbolvoloffsetr linux KERNEL_NAMErQr)r[rrrkernelr start_addrend_addrs rFgenerate_kernel_handler_infoz+LinuxUtilities.generate_kernel_handler_info7s!34~~f//0==..w7 ^^**T1 ,,X6<<&&-__ ( (*h ?  ) )'63D3Di PQ QrGrhandlerstarget_addresscTd}d}|D]\}}}||cxkr|ksn|}|tjjk(rdt|j |} t | r?tj | dvr%| djtj dn| d}||fS||fS)z Searches between the start and end address of the kernel module using target_address. Returns the module and symbol name of the address provided. UNKNOWNzN/ArrS)r rrrrrrr) r[rrrmod_name symbol_namerstartendsymbolss rFlookup_module_addressz$LinuxUtilities.lookup_module_addressPs ( D%-#-9??666"%FF~VG7| )~~;$AJ,,Y^^3>>">>>($5s;K$$L/S//b,3,,\.##44..  00 ..@ ##44  z))99:  eCcM" #   (Q##44Q QJ..>>? Q eCcM" # QQ0%!))99%uS#s]+,% %%B;;     ##33  *$$44 5   <##44""22    + + rGrQceZdZdZdZdZdZdejjde fdZ e dejjde ddfdZ eede fdZedefd Zedefd Zedefd Zedefd Zedefd ZedefdZedefdZedefdZdej6j8fdZdefdZdefdZdej6j8defdZ y) IDStoragez0Abstraction to support both XArray and RadixTreeNrrc|j||_|jjj|jj|_|jj dj|_|jj |j}|jdj}|jdz |_ d|jz|_|jdz |_y)NpointerslotsrS)rrrrr vmlinux_layerrsize pointer_sizenode_type_namechild_templater bit_length CHUNK_SHIFT CHUNK_SIZE CHUNK_MASK)rBrr node_typeslots_array_sizes rFr=zIDStorage.__init__s '9: !\\11889P9PQ LL11)<AALL))$*=*=> $33G<BB,6681<t/////A-rGrIc|j|}|jd}|jd}|r%|jdjj nd}|j tjdz}|j tjdzxr |jdjd}|s|r t||St||S)aReturns the appropriate ID storage data structure instance for the current kernel implementation. This is used by the IDR and the PageCache to choose between the XArray and RadixTree. Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the kernel module on which to operate Returns: The appropriate ID storage instance for the current kernel r%i_pagesrxarrayradix_tree_rootxa_head) rrrrrrendswithr rXArray RadixTree) r[rrraddress_space_typeaddress_space_has_i_pagesi_pages_type_namei_pages_is_xarrayi_pages_is_radix_tree_roots rFchoose_id_storagezIDStorage.choose_id_storages //"45$--o>$6$A$A)$L!)  - -i 8 < < F F  .66y~~7PQ%6%?%? NN. .& &H01<r is_internalrAs rF get_entrieszIDStorage.get_entriesMs%%dhhoo6""4( ++E2   u %OOE*E ))%0F Q;!!%( )#ooeV<   =sB8B:)!rJrKrLrrrrr rrrr=rrpropertyrrrrboolr r#r%r)r+r/r1rrr6r:r=rErrGrFrrs:KJJ.##44. .&:##44: :  ::B$$$$C$$""""t"""3"""""""""S"""d"" j&8&8&H&H c%3%"! 2 2 B B!s!rGrceZdZdZdZdefdZedefdZ edefdZ defdZ defdZ de fd Zde fd Zdefd Zde fd Zy )rrRrIcyNrrr's rFr)zXArray.get_tree_heightpsrGcy)Nxa_noderrs rFrzXArray.node_type_namessrGc|jSr8)XARRAY_TAG_INTERNALrs rFrzXArray.tag_internal_valuews'''rGc\|j|}|j|jz dzS)NrS)r6shiftrr4s rFr+zXArray.get_node_height{s,!!%( T---22rGc|jSr8)r r-s rFr/zXArray.get_head_nodes ||rGc:||jz|jk(Sr8)XARRAY_TAG_MASKrOrs rFr zXArray.node_is_internals,,,1I1IIIrGc&||jzdk7SrKrTrs rFr#zXArray.is_node_taggeds,,,22rGc"||jzSr8rVrs rFr%zXArray.untag_nodes---..rGc&|j| Sr8)r#rs rFr1zXArray.is_valid_nodes&&u---rGN)rJrKrLrTrOrr)rFrrrr+r/rGr r#r%r1rrGrFrrlsO(C((33SJJ3t3/3/.d.rGrceZdZdZdZdZdZdZdZdZ dfd Z e de fdZ e defdZdefd Zdefd Zdefd Zdefd Zdefd ZdefdZdefdZdefdZxZS)rrSrRrINrIcrt||i|d}||jz|_t t j |jt|jz |_ |jdz|_ d|jzdz |_ |jjdsd|_yy)NrSr rR)r<r=rRADIX_TREE_INDEX_BITSrmathceilfloatrRADIX_TREE_MAX_PATHRADIX_TREE_HEIGHT_SHIFTRADIX_TREE_HEIGHT_MASKrhas_typeRADIX_TREE_INTERNAL_NODE)rBrCrD char_bitsrEs rFr=zRadixTree.__init__s $)&) %.1B1B%B"#& IId0059I9I3JJ K$  (,'?'?!'C$'(D,H,H'HA&M#||$$%67 -.D ) 8rGcy)Nradix_tree_noderrs rFrzRadixTree.node_type_names rGc|jSr8rdrs rFrzRadixTree.tag_internal_values,,,rGc0tjtj5|jj dj dr3|jjd|d}|jcdddS dddy#1swYyxYw)Nr r>Tr3r) contextlibsuppressr SymbolErrorrrrrr>)rBr(r s rFr)zRadixTree.get_tree_heights  !7!7 8 .||$$%67BB8L"&,,"5"5%ed#6#'--  . .L . .s AB  Bc|jjds|j|jzdz S|jj d}||}|S)zMReturn the maximum key which can be store into a radix tree with this height.height_to_maxindexrS)r has_symbolrrQr)rBr5r>height_to_maxindex_arraymaxindexs rF_radix_tree_maxindexzRadixTree._radix_tree_maxindexsZ||&&';<OOtzz1Q6 6(,||'F'F$( $07HOrGc|j|}t|dr|j|jz dzSt|dr|j|j zSt|dr |j Stjd)NrQrSryr>z"Cannot find radix-tree node height) r6hasattrrQrryrbr>r VolatilityExceptionr4s rFr+zRadixTree.get_node_heights{!!%( 4 !JJ!1!11Q6 6 T6 "99t::: : T8 $;; 001UV VrGc|jSr8)rnoder-s rFr/zRadixTree.get_head_nodes zzrGc&||jzdk7SrKrirs rFr zRadixTree.node_is_internals555!;;rGc$|j|Sr8)r rs rFr#zRadixTree.is_node_taggeds$$U++rGc"||jzSr8)RADIX_TREE_ENTRY_MASKrs rFr%zRadixTree.untag_nodes33344rGcr|jjdr||jz|jk7Sy)Nr T)rrcr|RADIX_TREE_EXCEPTIONAL_ENTRYrs rFr1zRadixTree.is_valid_nodes; << !2 3222223 3rGrH)rJrKrLrdr~r|r\r`rarbr=rFrrrrr)rsr+r/rGr r#r%r1rNrOs@rFrrs #$ !"!.$!!!-C--   C  W WS<<,t,535drGrceZdZdZdej j dedejjfdZ dejjfdZ y) PageCachezLinux Page Cache abstractionrr page_cachecp|j||_||_tj |||_y)z Args: context: interfaces.context.ContextInterface, kernel_module_name: The name of the kernel module on which to operate page_cache: Page cache address space N)rr _page_cacherr _idstorage)rBrrrs rFr=zPageCache.__init__s2'9: %#55g?QRrGrIc#K|jj|jjD]*}|s|jj d|d}|s'|,yw)zRReturns all page cache contents Yields: Page objects r&Tr3N)rrErr rr)rB page_addrr&s rFget_cached_pageszPageCache.get_cached_pagessW44T5E5E5M5MNI<<&&vi$&OD Os AA A N) rJrKrLrr rrrrrr=rrrGrFrrsZ&S##44S S&&66 S" *"4"4"D"D rGr)"r]rkabcrrtypingrrrrr volatility3r volatility3.frameworkr r r rvolatility3.framework.objectsrvolatility3.framework.symbolsr#volatility3.framework.symbols.linuxrIntermediateSymbolTabler configurationVersionableInterfacerQrrrrrrrGrFrs #99!LL12:7J!A!A7JtlZ--BBl^ p!p!f!.Y!.H` `F!!rG