
    *1f:                     ,   d dl mZmZ d dlZd dlmZ d dlmZmZ d dlm	Z	m
Z
mZ  ej                  e      Z G d de	j                        Z G d d	e	j                        Z G d
 de	j                        Z G d de	j                        ZeeeeeeedZy)    )DictTupleN)	constants)	ELF_IDENT	ELF_CLASS)objects
interfaces
exceptionsc                        e Zd ZdZdej
                  j                  dedej                  j                  de
deeee
ej                  j                  f   f   ddf fd	Zd
 Zd Zd Zd Zd Zd Zd Zd Z xZS )elfz
    Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`,
    depending on the corresponding value on e_ident
    context	type_nameobject_infosizemembersreturnNc           	         t         |   |||||       | j                  j                  }| j	                         }	 | j
                  j                  |t        j                  z   dz   ||j                        }|dk7  ry | j
                  j                  |t        j                  z   dz   ||j                  t         j"                  z         }
|
t$        j&                  k(  rd	| _        d
| _        n0|
t$        j,                  k(  rd| _        d| _        nt/        d|
       | j
                  j                  |t        j                  z   | j(                  z   dz   ||j                        | _        |j                  | _        d | _        d | _        y # t        j                  t        j                  f$ r;}	t        j                  dt        |j                         d| d|	        Y d }	~	y d }	~	ww xY w)N)r   r   r   r   r   zunsigned long
layer_nameoffsetz3Unable to check magic bytes for ELF file at offset z
 in layer z: iELFzunsigned charElf32_    Elf64_@   zUnsupported ei_class value Ehdr)super__init__volr   get_symbol_table_name_contextobjectr   BANGr   r
   PagedInvalidAddressExceptionInvalidAddressExceptionvollogdebughexr   EI_CLASSr   
ELFCLASS32_type_prefix_ei_class_size
ELFCLASS64
ValueError_hdr_offset_cached_symtab_cached_strtab)selfr   r   r   r   r   r   symbol_table_namemagicexcpei_class	__class__s              d/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/linux/extensions/elf.pyr   zelf.__init__   s    	# 	 	
 XX((
 668	MM((!INN2_D%")) ) E J ==''	.@!%%	(:(:: ( 
 y+++ (D"$D--- (D"$D:8*EFF MM((	.1B1BBVK!%% ) 
	
 #))""K 33..
 	 LLEc+J\J\F]E^^hishttvw{v|} 	s   <F #G*/1G%%G*c                 p    t        | d      r*t        | d      r| j                  duxr | j                  duS y)z8
        Determine whether it is a valid object
        r*   r.   NF)hasattrr*   r.   r2   s    r8   is_validzelf.is_validY   s9     4(WT6-B$$D0JTYYd5JJ    c                     |dd dk(  r2|t        | j                        v r| j                  j                  |      S | j                  |      S )Nr      e_)dirr.   __getattr____getattribute__)r2   names     r8   rB   zelf.__getattr__b   sE    !9TYY!799((..((..r=   c                 @    | j                   j                         g dz   S )N)get_program_headersr<   get_section_headersget_symbols__dir__)r.   rI   r;   s    r8   rI   zelf.__dir__i   s!    yy  " &
 
 	
r=   c           	   #     K   | j                   j                  | j                         t        j                  z   dz   | j
                  j                  | j                  | j                  z   | j                   j                  j                  | j                         t        j                  z   | j                  z   dz         | j                        }|D ]9  }| j                  |_        | j                  |_        | j                  |_        | ; y w)NarrayPhdrr   r   subtypecount)r    r!   r   r   r"   r   r   r/   e_phoffsymbol_spaceget_typer*   e_phnume_typeparent_e_typeparent_offsettype_prefix)r2   program_headersprog_headers      r8   rF   zelf.get_program_headersr   s     --..&&(9>>9GCxx**<<$,,.MM..77**,..!##$  ,, / 
 + 	K(,K%(,K%&*&7&7K#		s   D	Dc           	         | j                   j                  | j                         t        j                  z   dz   | j
                  j                  | j                  | j                  z   | j                   j                  j                  | j                         t        j                  z   | j                  z   dz         | j                        }|S )NrK   ShdrrM   )r    r!   r   r   r"   r   r   r/   e_shoffrQ   rR   r*   e_shnum)r2   section_headerss     r8   rG   zelf.get_section_headers   s    --..&&(9>>9GCxx**<<$,,.MM..77**,..!##$  ,, / 
 r=   c           	   #     K   | j                   dz  }| j                         }t               }| j                         D ]  }	 |j                  j
                  dk7  r	 |j                         D ]  }	 |j                  j
                  dk7  r	 |j                  }||z   }| j                  j                  |t        j                   z   dz   || j"                  j$                        }	|	s)t        j                  t        j                  d|d	       |t        j                   z   | j&                  z   d
z   }
	 | j                  j                  |
|	| j"                  j$                        }|s|j"                  j,                  dk7  s|j"                  j,                  |v r0|j/                  |j"                  j,                         | 	 | j                  j                  |
|j0                  | j"                  j$                        }|s|j"                  j,                  dk7  r  y# t        $ r5 t        j                  t        j                  d|j                          Y (w xY w# t        $ r5 t        j                  t        j                  d|j                          Y 9w xY w# t(        j*                  $ r, t        j                  t        j                  d|	d	       Y {w xY w# t(        j*                  $ r@ t        j                  t        j                  d| j"                  j,                  d	       Y w xY ww)zGet the ELF link map objects for the given VMA address

        Args:
            kernel_symbol_table_name (str): Kernel symbol table name

        Yields:
            The ELF link map objects
           
PT_DYNAMIC*Skipping unknown ELF program header type: 	DT_PLTGOT+Skipping unknown ELF dynamic section type: pointer)r   r   z"Invalid ELF link map pointer at 0xxLinkMap)object_typer   r   z"Invalid ELF link map address at 0xr   z)ELF link map linked list is corrupt at 0xN)r+   r   setrF   p_typedescriptionr-   r%   logr   LOGLEVEL_VVVVdynamic_sectionsd_tagd_ptrr    r!   r"   r   r   r*   r
   r$   r   addl_next)r2   kernel_symbol_table_namegot_entry_sizeelf_symbol_tablelink_maps_seenphdrdsec	got_startlink_map_addrlink_map_ptrlinkmap_symnamelink_maps               r8   get_link_mapszelf.get_link_maps   s     ,,1557,,. J	D;;**l: ; --/ ?zz--<  = !JJ	 !*N :  $}}33,y~~=	I(#xx22  4  
 $JJ!//<]1<MN  %y~~58I8IIIU  #}}33$3+#'88#6#6  4  H 8<<#6#6!#;||**n<"&&x||':':;"N#'==#7#7(7#+??'+xx':': $8 $ 8<<#6#6!#;[?J	  

++@N  " JJ!//Edjj\R D "99 JJ!//<\!<LM ( &== 

%33GXYGZ[ s   >MH'M1I(
B'M22J)$M'MAM<K+MM M':I%!M$I%%M(:J&"M%J&&M);K($M'K((M+AL>:M=L>>Mc                    d }d }d }| j                         D ]  }	 |j                  j                  dk7  r	 |j                         D ]O  }	 |j                  j                  }|dk(  r|j                  },|dk(  r|j                  }>|dk(  sD|j                  }Q  n |r|r|sy || _        || _        ||k  r||z
  |z  | _        y d| _        y # t        $ r4 t        j                  t        j                  d|j                          Y w xY w# t        $ r5 t        j                  t        j                  d|j                          Y w xY w)Nra   rb   rd   	DT_STRTAB	DT_SYMTAB	DT_SYMENTi   )rF   rj   rk   r-   r%   rl   r   rm   rn   ro   rp   r0   r1   _cached_numsyms)r2   	dt_strtab	dt_symtab	dt_strentrw   rx   dtags          r8   _find_symbolszelf._find_symbols   sd   			,,. !	D;;**l: ; --/ +::11D ;& $

I[( $

I[( $

I%+( C!	F iI'' y $-	$9i#GD #'D Q  

++@N  " JJ!//Edjj\R s#   C
D:DD:E	E	c           	   #     K   | j                   | j                          | j                   y | j                  j                  | j	                         t
        j                  z   dz   | j                  j                  | j                   | j                  j                  j                  | j	                         t
        j                  z   | j                  z   dz         | j                        }|D ]  }| j                  |_        |  y w)NrK   SymrM   )r0   r   r    r!   r   r   r"   r   r   rQ   rR   r*   r   r1   cached_strtab)r2   
symtab_arrsyms      r8   rH   zelf.get_symbols#  s     & &]]))&&(9>>9GCxx**&&MM..77**,..!##$  && * 

  	C $ 3 3CI	s   DD)__name__
__module____qualname____doc__r	   r   ContextInterfacestrr   ObjectInformationintr   r   Templater   r<   rB   rI   rF   rG   r~   r   rH   __classcell__r7   s   @r8   r   r      s    
?###44?# ?#  ''99	?#
 ?# c5j&8&8&A&A!ABBC?# 
?#B/
(Xt2(hr=   r   c                   \     e Zd ZdZ fdZed        Zej                  d        Zd Z xZ	S )elf_symzAn elf symbol entryc                 2    t        |   |i | d | _        y N)r   r   r1   r2   argskwargsr7   s      r8   r   zelf_sym.__init__?  s    $)&)"r=   c                     | j                   S r   r1   r;   s    r8   r   zelf_sym.cached_strtabC      """r=   c                     || _         y r   r   )r2   r   s     r8   r   zelf_sym.cached_strtabG  s
    +r=   c                    | j                   | j                  z   }| j                  j                  | j                  j
                     j                  |dd      }|r.|j                  d      }|dk7  r|d | }|j                  dd      S y )	N   T)pad    zutf-8ignore)errors)	r1   st_namer    layersr   r   readfinddecode)r2   addr
name_bytesidxs       r8   get_namezelf_sym.get_nameK  s    ""T\\1 ]]))$((*=*=>CCD#SWCX
//'*Cby'-
$$WX$>> r=   )
r   r   r   r   r   propertyr   setterr   r   r   s   @r8   r   r   <  s>    # # # , ,r=   r   c                        e Zd ZdZ fdZed        Zej                  d        Zed        Zej                  d        Zed        Z	e	j                  d        Z	d	 Z
d
 Z xZS )elf_phdrzAn elf program headerc                 N    t        |   |i | d | _        d | _        d | _        y r   )r   r   _parent_e_type_parent_offsetr*   r   s      r8   r   zelf_phdr.__init___  s-    $)&)"" r=   c                     | j                   S r   r   r;   s    r8   rU   zelf_phdr.parent_e_typee  r   r=   c                     || _         y r   r   )r2   rT   s     r8   rU   zelf_phdr.parent_e_typei  
    $r=   c                     | j                   S r   r   r;   s    r8   rV   zelf_phdr.parent_offsetm  r   r=   c                     || _         y r   r   r2   r   s     r8   rV   zelf_phdr.parent_offsetq  r   r=   c                     | j                   S r   r*   r;   s    r8   rW   zelf_phdr.type_prefixu  s       r=   c                     || _         y r   r   )r2   prefixs     r8   rW   zelf_phdr.type_prefixy  s
    "r=   c                     | j                  d      }	 | j                  j                  dk(  r| j                  |z   }|S # t        $ r5 t
        j                  t        j                  d| j                          Y |S w xY w)Np_vaddrET_DYNz"Skipping unknown ELF object type: )	rB   r   rk   r   r-   r%   rl   r   rm   r   s     r8   	get_vaddrzelf_phdr.get_vaddr}  s    !!),		""..(:,,v5   	 JJ''4T5H5H4IJ
 	s   (= :A;:A;c              #     K   	 | j                   j                  dk7  ry 	 | j                         }| j                         }| j                  j                  j                  |t
        j                  z   | j                  z   dz         j                  }t        d      D ]r  }||z  }| j                  j!                  |t
        j                  z   | j                  z   dz   | j"                  j$                  ||z         }| |j&                  dk(  sr y  y # t        $ r4 t        j	                  t
        j                  d| j                           Y y w xY ww)Nra   rb   Dyn   r   r   )rj   rk   r-   r%   rl   r   rm   r   r   r    rQ   rR   r"   r*   r   ranger!   r   r   ro   )r2   	arr_startr3   rtsizeir   dyns          r8   rn   zelf_phdr.dynamic_sections  s6    
	{{&&,6 7 NN$	 668++44	.1B1BBUJ

$ 	 s 	Af*C--&&!INN2T5F5FFN88.. 3 ' C IyyA~	%  	 JJ''<T[[MJ 	s.   ED C.EE:E
EEE)r   r   r   r   r   r   rU   r   rV   rW   r   rn   r   r   s   @r8   r   r   \  s    ! # # % % # # % % ! ! # # $r=   r   c                       e Zd Zd Zy)elf_linkmapc                    	 | j                   j                  j                  | j                  j                  | j
                  d      }|j                  d      }|dk7  r|d | }|j                         S # t        j                  $ r? t        j                  t        j                  d| j                  j                  d       Y y w xY w)Nr   z-Invalid l_name address for ELF link map at 0xrf   r   r   )r    r   r   r   r   l_namer
   r#   r%   rl   r   rm   r   r   r   )r2   bufr   s      r8   r   zelf_linkmap.get_name  s    	--&&++DHH,?,?cRC hhw"9ds)Czz| 66 	JJ''?PQ?RS 	s   AA2 2ACCN)r   r   r   r    r=   r8   r   r     s    r=   r   )Elf
Elf64_Phdr
Elf32_Phdr	Elf32_Sym	Elf64_SymElf32_LinkMapElf64_LinkMap)typingr   r   loggingvolatility3.frameworkr   %volatility3.framework.constants.linuxr   r   r   r	   r
   	getLoggerr   r%   
StructTyper   r   r   r   class_typesr   r=   r8   <module>r      s   
   + B A			8	$g'

 gT	g   @Uw!! Up'$$ &   r=   