
    *1f:                        d dl mZmZ d dlZd dlmZ d dlmZmZ d dlm	Z	m
Z
mZ  ej        e          Z G d de	j                  Z G d d	e	j                  Z G d
 de	j                  Z G d de	j                  ZeeeeeeedZdS )    )DictTupleN)	constants)	ELF_IDENT	ELF_CLASS)objects
interfaces
exceptionsc                        e Zd ZdZdej        j        dedej        j	        de
deeee
ej        j        f         f         ddf fd	Zd
 Zd Zd Zd Zd Zd Zd Zd Z xZS )elfz
    Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`,
    depending on the corresponding value on e_ident
    context	type_nameobject_infosizemembersreturnNc           	         t                                          |||||           | j        j        }|                                 }	 | j                            |t          j        z   dz   ||j	                  }n^# t          j        t          j        f$ r@}	t                              dt          |j	                   d| d|	            Y d }	~	d S d }	~	ww xY w|dk    rd S | j                            |t          j        z   dz   ||j	        t           j        z             }
|
t$          j        k    rd	| _        d
| _        n1|
t$          j        k    rd| _        d| _        nt/          d|
           | j                            |t          j        z   | j        z   dz   ||j	                  | _        |j	        | _        d | _        d | _        d S )N)r   r   r   r   r   zunsigned long
layer_nameoffsetz3Unable to check magic bytes for ELF file at offset z
 in layer z: iELFzunsigned charElf32_    Elf64_@   zUnsupported ei_class value Ehdr)super__init__volr   get_symbol_table_name_contextobjectr   BANGr   r
   PagedInvalidAddressExceptionInvalidAddressExceptionvollogdebughexr   EI_CLASSr   
ELFCLASS32_type_prefix_ei_class_size
ELFCLASS64
ValueError_hdr_offset_cached_symtab_cached_strtab)selfr   r   r   r   r   r   symbol_table_namemagicexcpei_class	__class__s              d/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/extensions/elf.pyr   zelf.__init__   s    	# 	 	
 	
 	
 X(
 6688	M((!IN2_D%") )  EE 3.
 	 	 	 LL}c+J\F]F]}}is}}w{}}   44444	 J4 =''	.@!%	(:: ( 
 
 y+++ (D"$D--- (D"$DE8EEFFF M((	.1BBVK!% ) 
 
	
 #)""s   	2A< <C5CCc                 j    t          | d          r"t          | d          r| j        duo| j        duS dS )z8
        Determine whether it is a valid object
        r*   r.   NF)hasattrr*   r.   r2   s    r8   is_validzelf.is_validY   sF     4(( 	WT6-B-B 	$D0JTYd5JJ5    c                     |dd         dk    r0|t          | j                  v r| j                            |          S |                     |          S )Nr      e_)dirr.   __getattr____getattribute__)r2   names     r8   rB   zelf.__getattr__b   sQ    !9TY!7!79((...((...r=   c                 >    | j                                         g dz   S )N)get_program_headersr<   get_section_headersget_symbols__dir__)r.   rI   r;   s    r8   rI   zelf.__dir__i   s,    y  "" &
 &
 &
 
 	
r=   c           	   #     K   | j                             |                                 t          j        z   dz   | j        j        | j        | j        z   | j         j	        
                    |                                 t          j        z   | j        z   dz             | j                  }|D ]*}| j        |_        | j        |_        | j        |_        |V  +d S )NarrayPhdrr   r   subtypecount)r    r!   r   r   r"   r   r   r/   e_phoffsymbol_spaceget_typer*   e_phnume_typeparent_e_typeparent_offsettype_prefix)r2   program_headersprog_headers      r8   rF   zelf.get_program_headersr   s      -..&&((9>9GCx*<$,.M.77**,,.!#$   , / 
 
 + 	 	K(,K%(,K%&*&7K#		 	r=   c           	      N   | j                             |                                 t          j        z   dz   | j        j        | j        | j        z   | j         j	        
                    |                                 t          j        z   | j        z   dz             | j                  }|S )NrK   ShdrrM   )r    r!   r   r   r"   r   r   r/   e_shoffrQ   rR   r*   e_shnum)r2   section_headerss     r8   rG   zelf.get_section_headers   s    -..&&((9>9GCx*<$,.M.77**,,.!#$   , / 
 
 r=   c           	   #     K   | j         dz  }|                                 }t                      }|                                 D ]y}	 |j        j        dk    rn=# t          $ r0 t                              t          j
        d|j                    Y Ow xY w|                                D ]}	 |j        j        dk    rn=# t          $ r0 t                              t          j
        d|j                    Y Ow xY w|j        }||z   }| j                            |t          j        z   dz   || j        j                  }	|	s*t                              t          j
        d|d	           |t          j        z   | j        z   d
z   }
	 | j                            |
|	| j        j                  }n?# t(          j        $ r- t                              t          j
        d|	d	           Y @w xY w|r|j        j        dk    r|j        j        |v rn|                    |j        j                   |V  	 | j                            |
|j        | j        j                  }nH# t(          j        $ r6 t                              t          j
        d| j        j        d	           Y nw xY w|r|j        j        dk    {dS )zGet the ELF link map objects for the given VMA address

        Args:
            kernel_symbol_table_name (str): Kernel symbol table name

        Yields:
            The ELF link map objects
           
PT_DYNAMIC*Skipping unknown ELF program header type: 	DT_PLTGOT+Skipping unknown ELF dynamic section type: pointer)r   r   z"Invalid ELF link map pointer at 0xxLinkMap)object_typer   r   z"Invalid ELF link map address at 0xr   z)ELF link map linked list is corrupt at 0xN)r+   r   setrF   p_typedescriptionr-   r%   logr   LOGLEVEL_VVVVdynamic_sectionsd_tagd_ptrr    r!   r"   r   r   r*   r
   r$   r   addl_next)r2   kernel_symbol_table_namegot_entry_sizeelf_symbol_tablelink_maps_seenphdrdsec	got_startlink_map_addrlink_map_ptrlinkmap_symnamelink_maps               r8   get_link_mapszelf.get_link_maps   sb      ,15577,,.. J	 J	D;*l:: ;   

+NNN    --// ? ?z-<<  =!   JJ!/RdjRR   H !J	 !*N :  $}33,y~=	I(#x2  4    
 $ JJ!/N]NNN    %y~58IIIU  #}33$3+#'8#6  4    HH
 "9   JJ!/M\MMM   H  8<#6!#;#;|*n<<"&&x|':;;;"NNN#'=#7#7(7#+?'+x': $8 $ $
 &=   

%3[[[[     8<#6!#;#;[?J	 J	sI   A7BB.C  7C:9C:'F//8G+*G+3,I  AJ%$J%c                 Z   d }d }d }|                                  D ]}	 |j        j        dk    rn=# t          $ r0 t                              t          j        d|j                    Y Nw xY w|                                D ]v}	 |j	        j        }n=# t          $ r0 t                              t          j        d|j	                    Y Iw xY w|dk    r|j
        }[|dk    r|j
        }i|dk    r|j
        }w |r|r|sd S || _        || _        ||k     r||z
  |z  | _        d S d| _        d S )Nra   rb   rd   	DT_STRTAB	DT_SYMTAB	DT_SYMENTi   )rF   rj   rk   r-   r%   rl   r   rm   rn   ro   rp   r0   r1   _cached_numsyms)r2   	dt_strtab	dt_symtab	dt_strentrw   rx   dtags          r8   _find_symbolszelf._find_symbols   s   			,,.. !	 !	D;*l:: ;   

+NNN    --// + +:1DD!   JJ!/RdjRR   H ;&& $
II[(( $
II[(( $
I 	i 	I 	4'' y  $-	$9i#GD   #'D   s!   07A*)A*B7C
Cc           	   #     K   | j         |                                  | j         d S | j                            |                                 t
          j        z   dz   | j        j        | j         | j        j	        
                    |                                 t
          j        z   | j        z   dz             | j                  }|D ]}| j        |_        |V  d S )NrK   SymrM   )r0   r   r    r!   r   r   r"   r   r   rQ   rR   r*   r   r1   cached_strtab)r2   
symtab_arrsyms      r8   rH   zelf.get_symbols#  s      &   &4]))&&((9>9GCx*&M.77**,,.!#$   & * 
 

  	 	C $ 3CIIII	 	r=   )__name__
__module____qualname____doc__r	   r   ContextInterfacestrr   ObjectInformationintr   r   Templater   r<   rB   rI   rF   rG   r~   r   rH   __classcell__r7   s   @r8   r   r      s%        
?##4?# ?#  '9	?#
 ?# c5j&8&A!ABBC?# 
?# ?# ?# ?# ?# ?#B  / / /
 
 
  (  X X Xt2( 2( 2(h      r=   r   c                   ^     e Zd ZdZ fdZed             Zej        d             Zd Z xZ	S )elf_symzAn elf symbol entryc                 H     t                      j        |i | d | _        d S N)r   r   r1   r2   argskwargsr7   s      r8   r   zelf_sym.__init__?  s-    $)&)))"r=   c                     | j         S r   r1   r;   s    r8   r   zelf_sym.cached_strtabC      ""r=   c                     || _         d S r   r   )r2   r   s     r8   r   zelf_sym.cached_strtabG  s    +r=   c                    | j         | j        z   }| j        j        | j        j                                     |dd          }|r<|                    d          }|dk    r
|d |         }|                    dd          S d S )	N   T)pad    zutf-8ignore)errors)	r1   st_namer    layersr   r   readfinddecode)r2   addr
name_bytesidxs       r8   get_namezelf_sym.get_nameK  s    "T\1 ])$(*=>CCD#SWCXX
 	//'**Cbyy'-
$$WX$>>> 4r=   )
r   r   r   r   r   propertyr   setterr   r   r   s   @r8   r   r   <  s        # # # # # # # X# , , ,      r=   r   c                        e Zd ZdZ fdZed             Zej        d             Zed             Zej        d             Zed             Z	e	j        d             Z	d	 Z
d
 Z xZS )elf_phdrzAn elf program headerc                 d     t                      j        |i | d | _        d | _        d | _        d S r   )r   r   _parent_e_type_parent_offsetr*   r   s      r8   r   zelf_phdr.__init___  s=    $)&)))"" r=   c                     | j         S r   r   r;   s    r8   rU   zelf_phdr.parent_e_typee  r   r=   c                     || _         d S r   r   )r2   rT   s     r8   rU   zelf_phdr.parent_e_typei      $r=   c                     | j         S r   r   r;   s    r8   rV   zelf_phdr.parent_offsetm  r   r=   c                     || _         d S r   r   r2   r   s     r8   rV   zelf_phdr.parent_offsetq  r   r=   c                     | j         S r   r*   r;   s    r8   rW   zelf_phdr.type_prefixu  s      r=   c                     || _         d S r   r   )r2   prefixs     r8   rW   zelf_phdr.type_prefixy  s    "r=   c                     |                      d          }	 | j        j        dk    r
| j        |z   }n=# t          $ r0 t
                              t          j        d| j                    Y nw xY w|S )Np_vaddrET_DYNz"Skipping unknown ELF object type: )	rB   r   rk   r   r-   r%   rl   r   rm   r   s     r8   	get_vaddrzelf_phdr.get_vaddr}  s    !!),,		".(::,v5 	 	 	 JJ'JT5HJJ    	 s   2 7A,+A,c              #   L  K   	 | j         j        dk    rd S n># t          $ r1 t                              t
          j        d| j                     Y d S w xY w|                                 }|                                 }| j	        j
                            |t
          j        z   | j        z   dz             j        }t          d          D ][}||z  }| j	                            |t
          j        z   | j        z   dz   | j        j        ||z             }|V  |j        dk    r d S \d S )Nra   rb   Dyn   r   r   )rj   rk   r-   r%   rl   r   rm   r   r   r    rQ   rR   r"   r*   r   ranger!   r   r   ro   )r2   	arr_startr3   rtsizeir   dyns          r8   rn   zelf_phdr.dynamic_sections  s\     
	{&,66t 7 	 	 	 JJ'JT[JJ   44	 NN$$	 6688+44	.1BBUJ
 

 	 s 	 	Af*C-&&!IN2T5FFN8. 3 '  C IIIyA~~ 	 	s    7AA)r   r   r   r   r   r   rU   r   rV   rW   r   rn   r   r   s   @r8   r   r   \  s
       ! ! ! ! ! # # X# % % % # # X# % % % ! ! X! # # #   $ $ $ $ $ $ $r=   r   c                       e Zd Zd ZdS )elf_linkmapc                 j   	 | j         j                            | j        j        | j        d          }nI# t          j        $ r7 t          	                    t          j        d| j        j        d           Y d S w xY w|                    d          }|dk    r
|d |         }|                                S )Nr   z-Invalid l_name address for ELF link map at 0xrf   r   r   )r    r   r   r   r   l_namer
   r#   r%   rl   r   rm   r   r   r   )r2   bufr   s      r8   r   zelf_linkmap.get_name  s    	-&++DH,?cRRCC6 	 	 	JJ'SSSS   44	 hhw"99dsd)Czz||s   03 AA98A9N)r   r   r   r    r=   r8   r   r     s#            r=   r   )Elf
Elf64_Phdr
Elf32_Phdr	Elf32_Sym	Elf64_SymElf32_LinkMapElf64_LinkMap)typingr   r   loggingvolatility3.frameworkr   %volatility3.framework.constants.linuxr   r   r   r	   r
   	getLoggerr   r%   
StructTyper   r   r   r   class_typesr   r=   r8   <module>r      s  
          + + + + + +        B A A A A A A A A A		8	$	$g g g g g'
 g g gT	    g    @U U U U Uw! U U Up    '$   &    r=   