
    Xf                     *   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
mZmZmZmZmZ d dlmZmZmZ d dlmZmZmZ d dlmZmZmZ  ej        e          Zi ddd	dd
d dfddd	ddddfddd	dd
ddfddd	ddddfddd	dd
ddfddd	ddddfddd	dd
ddfddd	dd
ddfddd	dd
ddfd d!d	ddddfd"dd	dd
ddfd#d!d	ddddfd$d%d	dd
ddfd&d'd	ddddfd(dd	dd
ddfd)d*d	ddddfd+d,d	dd
ddfd-d	ddddfd,d	dd
ddfd-d	ddddfd.d	dd
ddfd/d	ddddfd.d	dd
ddfd/d	ddddfd0d	d1d
ddfd2d	d1d
ddfd3d	d1d
ddfd4d	d1d
d5dfd6d	d1d
ddfd7d	d1d
d8dfd9d	d1d
ddfd:Zd;d	ddddfd<d	ddddfd=d	ddddfd>Z  G d? d@          Z! G dA dB          Z" G dC dD          Z#edEk    rd dl$Z$ G dF dGe%          Z& e$j'        dHI          Z(e()                    dJdKdLdMdN           e(*                    dOdPI          Z+e+)                    dQdRdSdTU           e(*                    dVdWI          Z,e,)                    dXdYdZd[U           e,)                    d\d]d^d_dN           e,)                    d`dadbddcd           e(-                                Z. e&            Z/dZ0dZ1e.j2        ee.j3        ^ e#            4                    e.j2        e.j3        e/e          Z1e1e(                    df            ej5        e1dO          j6        dOk    rd
Z0n$e.j7        re.j7        Z1ne(                    dg           e1se(                    dh            ej8                    Z9 ej5        e1dOi          Z:e:j6        dOk    r_ej;        <                    e1          se(                    dje1 dk           dl ej=        ej;        >                    e1                    z   Z?ne1Z? e"e9e?e.j3        e/m          Z@e@A                                ZBe.jC        ge.j2        re.j2        ddn         Z2e.j2        dnd         ZDn4eBdo         dp         dq         d^         Z2eBdo         dp         dq         dr         ZDe2 dseD dte._C        ej;        >                    e.jC                  ZEeFZGe.jC        H                    du          rejF        ZGnCe.jC        H                    dv          rejF        ZGn!e.jC        H                    dw          rejF        ZG eGeEdx          5 ZI ejJ        eBdd
y          ZKeIL                     eMeKdz                     ddd           n# 1 swxY w Y   e.jN        r eOd{e1            dS e0r ejP        e1           dS dS dS )|    N)bisect)TupleDictAnyOptionalUnionList)requesterrorparse)contexts
interfaces	constants)physicalmsf	resources   voidlittleTendiankindsignedsize   HRESULTintF      char       zunsigned charh   int8i   uint8p   q   wchar      short!   unsigned shortr   s      long"   unsigned longt   u   zunsigned int   z	long longzunsigned long longint128uint128f16floatf32f32ppf48   doublef80
   f128)#   v   w      $   x   y   F   @   E   D   A   B   C   	pointer16	pointer32	pointer64)      i   c                       e Zd Zd ZdS )ForwardArrayCountc                 "    || _         || _        d S N)element_typer   )selfr   r[   s      _/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/pdbconv.py__init__zForwardArrayCount.__init___   s    (			    N)__name__
__module____qualname__r^    r_   r]   rX   rX   ^   s#            r_   rX   c                      e Zd ZdZ	 	 dSdej        j        dedee         de	j
        ddf
dZed	             Zed
             Zedej        j        dedeeej        j        f         fd            Zd Zd ZdTdZd Zd ZdTdZd Zd ZdedefdZd Zd Zd Zdedee e!         e"ee!f         f         fdZ#dedefdZ$de"eef         ddfdZ%i ddd dd!dd"dd#dd$d%d&d%d'd(d)d(d*d+d,d+d-d+d.d/d0d1d2d1d3d4d5d6d7d8d9d:d;d<d=d>d?d@	Z&dAej        j'        dBedCedeeeej(        j)                 ee         ede ej(        j)        f         f         ef         fdDZ*dEedBedefdFZ+dGede"ee         e"ee!f         f         fdHZ,dI Z-e.	 	 dUdLej(        j)        dMe/dNedefdO            Z0dPej(        j)        dQej(        j)        dAej        j'        dCedeeej(        j)        ef         f
dRZ1dS )V	PdbReadera  Class to read Microsoft PDB files.

    This reads the various streams according to various sources as to how pdb should be read.
    These sources include:

    https://docs.rs/crate/pdb/0.5.0/source/src/
    https://github.com/moyix/pdbparse
    https://llvm.org/docs/PDB/index.html
    https://github.com/Microsoft/microsoft-pdb/

    In order to generate ISF files, we need the type stream (2), and the symbols stream (variable).
    The MultiStream Format wrapper is handled as a volatility layer, which constructs sublayers for each stream.
    The streams can then be read contiguously allowing the data to be accessed.

    Volatility's type system is strong when everything must be laid out in advance, but PDB data is reasonably dynamic,
    particularly when it comes to names.  We must therefore parse it after we've collected other information already.
    This is in comparison to something such as Construct/pdbparse which can use just-parsed data to determine dynamically
    sized data following.
    Ncontextlocationdatabase_nameprogress_callbackreturnc                     |                      ||          \  | _        | _        d | _        |sd }|| _        g | _        i | _        i | _        i | _        i | _	        g | _
        g | _        di d| _        || _        d S )Nc                     d S rZ   rc   )xys     r]   <lambda>z$PdbReader.__init__.<locals>.<lambda>   s    T r_   z6.1.0)formatwindows)load_pdb_layer_layer_name_context
_dbiheader_progress_callbacktypesbases
user_typesenumerationssymbols_omap_mapping	_sectionsmetadata_database_name)r\   rf   rg   rh   ri   s        r]   r^   zPdbReader.__init__y   s     +/*=*=gx*P*P'$-HL  	2 1 1"3  	
 &(
*,,.')46CE#*r::+r_   c                     | j         S rZ   )rt   r\   s    r]   rf   zPdbReader.context   s
    }r_   c                     | j         S rZ   )rs   r   s    r]   pdb_layer_namezPdbReader.pdb_layer_name   s    r_   c                    |j                             d          }t          j                            d|          }|                                }||j        t          j                            |d          <   t          j        |||          }|	                    |           |j                             d          }t          j                            d|          }||j        t          j                            |d          <   t          j        |||          }	|	                    |	           |	                                 ||fS )zLoads a PDB file into a layer within the context and returns the
        name of the new layer.

        Note: the context may be changed by this method
        	FileLayer	pdbreaderrg   MSFLayer
base_layer)layersfree_layer_namer   configuration	path_joincloneconfigr   r   	add_layerr   PdbMultiStreamFormatread_streams)
clsrf   rg   physical_layer_namephysical_config_pathnew_contextphysical_layermsf_layer_namemsf_config_path	msf_layers
             r]   rr   zPdbReader.load_pdb_layer   sN    &n<<[II)7AA, 
  
 mmoo  	$../CZPP	
 "+-/B
 
 	n--- !77
CC$2<<
 

   	$..MM	
 ,.
 
	 	i(((   {**r_   c                 Z    i | _         i | _        i | _        i | _        g | _        g | _        d S rZ   )rx   ry   rz   r{   r}   r|   r   s    r]   resetzPdbReader.reset   s4    
r_   c                     | j         d                             dd          s|                                  | j        s|                                  | j        s|                                  dS dS )zQRead streams to populate the various internal components for a PDB
        table.rq   pdbN)r~   getread_pdb_info_streamry   read_tpi_streamr{   read_symbol_streamr   s    r]   read_necessary_streamsz PdbReader.read_necessary_streams   s}     }Y'++E488 	(%%''' 	#  """| 	&##%%%%%	& 	&r_   c                 v    g | _         |                     dd| j                   }|                     |           dS )zReads the TPI type steam.r*   TPIN)rw   _read_info_streamprocess_types)r\   type_referencess     r]   r   zPdbReader.read_tpi_stream   s<    
00E4:FF?+++++r_   c                 ^   | j         s|                                  t                              d           g }	 |                     dd|          }|                                D ]7}|                    d          r |                    d          d         | _        8dS # t          $ r Y dS w xY w) zReading IPI layerr   IPIz.pdb\N)
ru   read_dbi_streamvollogdebugr   keysendswithsplitr   
ValueError)r\   ipi_listr   names       r]   read_ipi_streamzPdbReader.read_ipi_stream   s     	#  """()))	"44QxHHO',,.. ? ?==(( ?*.**T*:*:2*>D'? ?  	 	 	44	s   A#B 
B,+B,c                 &   t                               d|            | j        j                            | j        dz   t          |          z   d           }|st          d| d          | j                            |j	        |j
        d          }|                    dd          }d	|j        cxk    rd
k     sn t          | d          |j        dk     rt          d| d|j                   |j        |j        k     r.t          d                    ||j        |j                            i }|j        }d}	|                    |	          j        }
d}|j        |z
  dk    r|                     |dz  |j        z  d           |                    |	|          }t)          |t*                    st-          d          ||
z  }|                     |||          \  }}|\  }}}dD ]C}|d| dk    s	|d| k    r.d| dt1          t3          |          dz             dd          z   }D|rt3          |          ||<   |                    |||f           ||z  }|dz  }|j        |z
  dk    |j        |z
  dk    rt          d          |S )NzReading _streamzNo z stream availabler   module_name
layer_nameoffset
TPI_HEADERobject_typer   8   rV   z) Stream Header size outside normal bounds   zMinimum z index is 4096, found: zCMaximum {} index is smaller than minimum TPI index, found: {} < {} r.   r!   d   zReading TPI layerzNon-integer length provided)unnamed	anonymous<z-tag>___r*   z1Type values did not fill the TPI stream correctly)r   r   rt   r   r   rs   strr   modulepdb_symbol_tabler   objectheader_size	index_min	index_maxrp   get_typer   maximum_addressrv   
isinstancer   	TypeErrorconsume_typehexlenappend)r\   stream_numberstream_name	info_list
info_layerr   headerinfo_referencesr   length_type
length_len
info_indexlengthoutputconsumed	leaf_typer   valuetag_types                      r]   r   zPdbReader._read_info_stream   s.   ---...])--y(3}+=+==t
 

  	CA;AAABBB%%"3! & 
 

 <BBf(////4////VVVWWWd""Q;QQv?OQQ   f...U\\!163C    +-#&__[116

(61A55##z99;N   ]]{6]JJFfc** ? =>>>j F#00HHFH%+"ItU4 O O.x.....$/x//2I2I++++c#i..62I.J.J122.NND 7(+I%iu5666fF!OJ# (61A55& %.!33PQQQr_   c           
      .   t                               d           | j        j                            | j        dz   d          }|st          d          | j                            |j        |j	        d          }|
                    dd          | _        | j        st          d	          | j        j        j        | j        j        z   | j        j        z   | j        j        z   | j        j        z   | j        j        z   | j        j        z   }|
                    d
|          | _        g | _        g | _        | j        j        dk    r| j        dz   t1          | j        j                  z   }d| j        j        |         j        }}||k     ra| j        
                    |j        t6          j        z   dz   ||          }| j                            |           ||j        j        z  }||k     a| j        j        dk    r| j        dz   t1          | j        j                  z   }| j        j        |         j        }| j        j        |                             d|          }	tA          d|d          D ]m}
| j                            tB          "                    |	|
|
dz            d          tB          "                    |	|
dz   |
dz            d          f           ldS dS | j        j#        dk    r| j        dz   t1          | j        j#                  z   }d| j        j        |         j        }}||k     re| j        
                    |j        t6          j        z   dz   ||          }| j                            |           ||j        j        z  }||k     adS dS dS )zReads the DBI Stream.zReading DBI stream_stream3NzNo DBI stream availabler   r   
DBI_HEADERr   zDBI Header could not be readDBI_DBG_HEADERr   r   IMAGE_SECTION_HEADER)r   r   r   r   r   )	byteorder)$r   r   rt   r   r   rs   r   r   r   r   r   ru   volr   module_size
secconSize
secmapSize
filinfSize	tsmapSize
ecinfoSize_dbidbgheaderr}   r|   snSectionHdrOrigr   rf   r   r   BANGr   snOmapFromSrcreadranger   
from_bytessnSectionHdr)r\   	dbi_layerr   dbg_hdr_offsetsection_orig_layer_namer   r   sectionomap_layer_namedataisection_layer_names               r]   r   zPdbReader.read_dbi_stream,  s   )***M(,,T-=
-JDQQ	 	86777%%!2y~VW & 
 
 !--L-KK 	=;<<< O$o)*o() o() o(	)
 o'( o() 	 $]]( + 
 
 ."44 9,s43E3V/W/WW $ #$;<L H V##,--.n%,- $6 .   %%g...GK,, V## !/255$y03t7I7W3X3XX   ,_=M|*?;@@FKKq&!,,  A&--NN4AE	?hNOONN4AA+>(NSS    65  ,22 9,s43E3R/S/SS  #$67G H V##,--.n%,- $1 .   %%g...GK,, V#### 32 $#r_   c                 2   i | _         | j        s|                                  t                              d           | j        j                            | j        dz   t          | j        j
                  z   d          }|st          d          | j                            |j        |j        d          }d}|j        }||k     r|                     |dz  |z  d           |                    d	|
          }|                    d|j        j        j        
          }d}d}|j        t-          | j                  k     r|dk    rT|                     |j        d|j        |j        j        z
  dz             }| j        |j        dz
           j        |j        z   }n~|dk    s|dk    rT|                     |j        d|j        |j        j        z
  dz             }| j        |j        dz
           j        |j        z   }nt                              d|d           |rf| j        r|                     |          }|                     |          }	d|i| j         |	<   ||                     |          k    r|| j         |	         d<   ||j        dz   z  }||k     dS dS )zReads in the symbol stream.zReading Symbolsr   NzNo SymRec stream availabler   r   r   zReading Symbol layerGLOBAL_SYMBOLr   r.   i	  Tr*   r!   i  i'  Fz&Only v2 and v3 symbols are supported: rm   addresslinkage_name)r{   ru   r   r   r   rt   r   r   rs   r   symrecStreamr   r   r   r   r   rv   r   r   r   r   segmentr   r}   parse_stringr   r   VirtualAddressr|   omap_lookup
name_strip)
r\   symrec_layerr   r   max_addresssymr   r   r  stripped_names
             r]   r   zPdbReader.read_symbol_stream  s    	#  """&'''}+//y(3t/K+L+LLd
 
  	;9:::%%$5#( & 
 
 "2{""##FSL;$>@VWWW--OF-KKC,S]5F5M &  I DG{S0000&&,,$
SW\(AA(E D s{Q7FS G &((I,?,?,,%cgl)BQ)F D s{Q7FS G LL!W)!W!W!WXXX G% 8"..w77G $ 5 5/8'.B]+4??40000BFDL/?cj1n$FE {""""""r_   c                 $   | j         s|                                  | j        |                                  t                              d           | j        j                            | j	        dz   d          }|st          d          | j                            |j        |j        d          }|                    dd          }|                     |j                  | j         j        | j        pd	| j         j        d
| j        d         d<   dS )z$Reads in the pdb information stream.NzReading PDB Info_stream1zNo PDB Info Stream availabler   r   PDB_INFORMATIONr   zunknown.pdb)GUIDagedatabasemachine_typerq   r   )ru   r   r   r   r   r   rt   r   r   rs   r   r   r   r   r   convert_bytes_to_guidr  r  machiner~   )r\   pdb_info_layerr   pdb_infos       r]   r   zPdbReader.read_pdb_info_stream  s    	#  """&  """'(((-11$2BZ2OQUVV 	=;<<<%%&7%* & 
 

 ==->q=II ..x}==?&+<} O3	+
 +
i '''r_   originalc                     d |D             }g }dD ]}|                     ||                    t          t          j        t	          |                    d                                          S )z5Convert the bytes to the correct ordering for a GUID.c                     g | ]}|S rc   rc   ).0rm   s     r]   
<listcomp>z3PdbReader.convert_bytes_to_guid.<locals>.<listcomp>  s    ...!...r_   )r   r*   r!   r      r      r?   r   	   rB                  latin-1)r   r   binasciihexlifybytesupper)r\   r  orig_guid_list	guid_listr  s        r]   r  zPdbReader.convert_bytes_to_guid  st    ..X...	G 	0 	0A^A.////8#E)$4$455yAAGGIIIr_   c                     t          | j        |df          }| j        |         d         |k    r|dz  }| j        |         d         sdS | j        |         d         || j        |         d         z
  z   S )z+Looks up an address using the omap mapping.r   r   r!   )r   r|   )r\   r  poss      r]   r  zPdbReader.omap_lookup  s}    T''277c"1%//1HC!#&q) 	1!#&q)Wt7I#7Nq7Q-QRRr_   c                     |}|dd         dv r
|dd         }|                     d          }t          |          dk    r7|d                                         r|d         d         dk    r	|d         }n|}|S )z>Strips unnecessary components from the start of a symbol name.Nr!   )r   @r3  r*   r   ?)r   r   	isnumeric)r\   r   new_name
name_arrays       r]   r  zPdbReader.name_strip  s    BQB<///|H^^C((
z??a!}&&((  Z]1-=-D-D%a=r_   c                     |                                   t          j                                                                        dt          j        d| j        d<   | j        | j        | j	        | j
        | j        dS )z=Returns the intermediate format JSON data from this pdb file.volatility3)datetimer   versionproducer)ry   enums
base_typesr{   r~   )r   r;  now	isoformatr   PACKAGE_VERSIONr~   ry   rz   rx   r{   r   s    r]   get_jsonzPdbReader.get_json  s{    ##%%% !)--//99;;! 0%
 %
j! /&*|
 
 	
r_   indexc                 B   |dk     r}t           |dz           \  }}|| j        |<   d|d}|dz  }|rRt          |         \  }}| j                            dd          r| j        d         |k    rd|d}n|| j        |<   d||d	}|S | j        |dz
           \  }}	}
d
|	d}||j        fv r|                     |
j                  }n\||j        |j	        |j
        fv r8t          |
j        |
j                  d|                     |
j                  d}n||j        fv r*d|                     |
j                  |
j        |
j        d}n||j        fv r|                     |          }| j                            dd          ddd|d| j        d<   n&|| j        d         d         k    rt)          d          d|                     |
j                  d}nL||j        fv rddiS ||j        fv rd|	d}n.||j        fv rd|	d}n||j        fv r|
}n|	st)          d          |S )z6Takes a type index and returns appropriate dictionary.r      base)r   r      pointerN)r   subtype)r   rG  rJ  structarray)countr   rJ  bitfield)r   type
bit_lengthbit_positionr   r   Fr   r   z%Native pointers with different sizes!r   functionunionenumz*No name for structure that should be named)
primitivesrx   indirectionsr   rw   LF_MODIFIERget_type_from_indexsubtype_indexLF_ARRAYLF_ARRAY_STLF_STRIDED_ARRAYrX   r   r[   LF_BITFIELDunderlying_typer   position
LF_POINTERget_size_from_indexr   LF_PROCEDURELF_UNIONLF_ENUMLF_FIELDLIST)r\   rD  	base_namerG  resultindirectionpointer_namepointer_baser   r   r   r   s               r]   rX  zPdbReader.get_type_from_index
  s   6>>(6OIt$(DJy!!C CF  %-K -9+-F*lJNN9d33
9-==&/FCCFF/;DJ|, ) ,#) F
 M%)Z%?"ItU&55FY233311%2EFF"%*   /uz5;MNN##778JKK 
 y4555& 44U5JKK"',$)N	  y3444//66:>>)T22:"* %"' $	- -DJy)) tz)4V<<<()PQQQ%#778KLL  y5666
++y1222")488y0111"($77y5666 O !MNNNMr_   c           	         d}d}|dk     r6|dz  rt           |dz           \  }}nt          |dz           \  }}|d         }np| j        |dz
           \  }}}||j        |j        |j        |j        |j        |j        |j	        |j
        fv r|j        j        s|j        }n||j        |j        |j        fv r|j        }n||j        |j        |j        fv r|                     |j                  }n||j        fv r|                     |j                  }n||j        fv r|                     |j                  }nz||j        fv r3|j        }|s)|j        dk    rdS |j        d	k    rd
S t9          d          n=||j        fv rt9          d          t9          d|                                           |dk    rt9          d| d| d          |S )zKReturns the size of the structure based on the type index
        provided.r   r   r   rH  rF  r   rB   r   r%  r   z$Pointer size could not be determinedz)LF_PROCEDURE size could not be identifiedz&Unable to determine size of leaf_type r   zInvalid size identified: z ())rV  rU  rw   rc  LF_CLASSLF_CLASS_STLF_STRUCTURELF_STRUCTURE_STLF_INTERFACELF_CLASS_VS19LF_STRUCTURE_VS19
propertiesforward_referencer   rZ  r[  r\  rW  rd  
LF_ARGLISTra  rY  	LF_MEMBER
field_typer]  r^  r`  pointer_typer   rb  lookup)r\   rD  rg  r   r   rG  r   r   s           r]   ra  zPdbReader.get_size_from_indexV  s]     6>>u} 3&uu}544$UT\24&\FF%)Z%?"ItU""%&)&'+	 	 	 '9 ("ZF"%*  
 %!$  
 11%2EFFy233311%2BCCy455511%2GHHy3444 Q)T11 q+t33 q()OPPPQ y5666 !LMMM QY=M=M=O=OQQ   Q;;III$IIIJJJr_   r   c           	      ,   i | _         i | _        i | _        t          | j                  }t          |          D ]}|                     |dz  |z  d           | j        |         \  }}}||j        |j        |j	        |j
        |j        |j        |j        fv r=|j        j        s0|r.d|j        |                     |j        dz
            d| j        |<   ||j        fv r=|j        j        s0|r.d|j        |                     |j        dz
            d| j        |<   ||j        fv r|j        j        s|r|                     |j                  }t/          |t0                    st3          d          |                     |j                  }t/          |t4                    st3          d          |d	         |                     |j                  t9          d
 |D                       d| j        |<   |                     | j        |          | _        dS )zLReads the TPI and symbol streams to populate the reader's
        variables.r   zProcessing typesrK  r   )r   r   fieldsrS  z*Invalid base type returned for Enumerationz"Enumeration fields type not a listr   c                 (    g | ]\  }}}||j         fS rc   )r   )r  r   r   rT  s       r]   r   z+PdbReader.process_types.<locals>.<listcomp>  s%    OOOMAtTdDJ/OOOr_   )rG  r   r   N)rx   ry   rz   r   rw   r   rv   rm  rn  ro  rp  rq  rr  rs  rt  ru  r   convert_fieldsr|  rc  rd  rX  rY  r   r   r   listra  dictreplace_forward_references)	r\   r   max_lenrD  r   r   r   rG  r   s	            r]   r   zPdbReader.process_types  s]    
dj//7^^ (	 (	E##ECK'$9;MNNN%)Z%6"ItU"%&)&'+   '9 d  ( %
"&"5"5elV6K"L"L- -DOD)
 y1222'9 d  !( %
"&"5"5elV6K"L"L- -DOD)
 y0111'9 d 33E4GHHD%dD11 W()UVVV $ 8 8 F FI%i66 O()MNNN $V $ 8 89L M M%)OOYOOO& &/ /D%d+ 99O_
 
r_   rm  )ro  Tr   rn  ro  rp  rq  rr  )rs  Tr   rs  rw  )rw  Tr   LF_MEMBER_STrZ  )rZ  Tr   r[  r\  LF_ENUMERATE)r  Tr   rv  )rd  TNrd  rc  )rc  TNLF_STRING_ID)r  TN)
LF_FUNC_IDTN)rW  FN)r`  FN)rb  FN)re  FN)r]  FN)LF_UDT_SRC_LINEFN)LF_UDT_MOD_SRC_LINEFN)LF_BUILDINFOFN)	r  rW  r`  rb  re  r]  r  r  r  r   r   r   c                    | j                             |                    d          |j        |          }|j        j        j        }||z
  }| j                            |	                                d          \  }}}	|dv r{|}
||z   }g }||k    re| 
                    |||
          \  }}||                     |j        ||z             z  }|
|z  }
||z  }||z  }|                    |           ||k    e|d|f}nA|dv rE|                    |||z             }|j        |j        _        ||j        j        j        z  }|d|f}n|| j        v r|                    |||z             }|}|r|j        j        j        |j        j        z
  }|	ra|                     |t'          ||	          |||z
            \  }}}t)          ||	|           |j        j        t+          |          z   dz   |z   }n)|                     |j        ||j        k     ||z
  	          }||_        nd}|||f}||z  }nt1          d
|           ||fS )z_Returns a (leaf_type, name, object) Tuple for a type, and the number
        of bytes consumed.	LEAF_TYPEr   r   )
LF_UNKNOWNFN)re  N)r  r   r!   r   zUnhandled leaf_type: )rf   r   get_enumerationrs   r   	base_typer   type_handlersr   rz  r   consume_paddingr   r   rM  	argumentsr   r   determine_extended_valuegetattrsetattrr   r	  	LF_ST_MAXr   )r\   r   r   r   r   r   	remainingtype_handlerhas_namevalue_attribute
sub_length
sub_offsetr|  subfieldsub_consumedrg  
parsed_objcurrent_consumedname_offsetr   r   excesss                         r]   r   zPdbReader.consume_type  s    L''"";//) ( 
 
	
 =*/X%	262D2H2H ;3
 3
/h +++"J(*JF8##)-):):J
* *&,  4 4%zL'@! !  l*
l*
L(h''' 8## f,FF---((1B '  J *4)9J &
,055Hj0FFT///((1B '  J  ) (o18:>;PP" *.*G*G!
O<<!K/	+ +'D% J???'1~':SYY'F'JV'S$$,,"!I$77&4 -  D
 #'
j0F((HH?I??@@@xr_   r   c                     | j         j        |                             |d          }|d         dz  dk    sdS t          |d                   dz  S )z2Returns the amount of padding used between fields.r!   r      r(  )rf   r   r   r   )r\   r   r   vals       r]   r  zPdbReader.consume_padding9  sN    l!*-2261==Q$4''13q6{{T!!r_   r|  c                     i }| j         |         \  }}}t          |t                    st                              d           |S |D ]-}|\  }}}|j        |                     |j                  d||<   .|S )z,Converts a field list into a list of fields.z1Fields structure did not contain a list of fields)r   rO  )rw   r   r  r   warningr   rX  rx  )r\   r|  rg  r   fields_structfieldr   members           r]   r~  zPdbReader.convert_fields@  s    68"j01m-.. 	NNNOOOM" 	 	E#OAtV -001BCC F4LL r_   c                    t          |t                    r4|                                D ]\  }}|                     ||          ||<   nt          |t                    r3g }|D ]+}|                    |                     ||                     ,|}nt          |t                    r|j        }d}|rud}|dk    rk| j        |dz
           \  }}	}
|	sHt          |
t          j
        j                  r)|
j        j                            d          r
|
j        }d}n|	r||	         dz   }|u|j        |                     |          z  S |S )zcFinds all ForwardArrayCounts and calculates them once
        ForwardReferences have been resolved.TFr   rW  )r   r  itemsr  r  r   rX   r[   rw   r   objectsObjectInterfacer   	type_namer   rY  r   ra  )r\   rw   r   kv	new_typesr[   loopr   r   toplevel_types              r]   r  z$PdbReader.replace_forward_referencesO  s    eT"" 	H O O1::1oNNaOt$$ 	HI V V  !@!@O!T!TUUUUEE011 	H -LD F&((-1Zv8M-N*At] !F&):+=+M F
 *-7@@OOF (5'B# F'6t'<v'E#  F$ :!9!9,!G!GGGr_   Fr   	structureparse_as_pascalr   c                     |s|                      d|d          }n7|                      d          }|j                             d|j        d          }t          |          S )zQConsumes either a c-string or a pascal string depending on the
        leaf_type.stringr)  )
max_lengthencodingpascal_string)castr  r   r   )r  r  r   r   s       r]   r	  zPdbReader.parse_stringu  si      	>>(ti>PPDD>>/22D;##T[9 $  D 4yyr_   r   r   c                 V   d}||j         k    r@| j                            | j        j                            |j        j                  |j        j        |j        j                  }|j        j        |j        j	        j
        z   }||j         fv r|                    d|          }n||j        fv r|                    d|          }nu||j        fv r|                    d|          }nS||j        fv r|                    d|          }n1||j        fv r|                    d|          }nt          d	          |j        j	        j
        }|                    d
|j        j        |j        j	        j
        z             }|                     |||j        k     ||z
            }	|	||fS )zPReads a value and potentially consumes more data to construct the
        value.r   r  r    r   r,   r.   r2   r4   zUnexpected extended value typer  r  )LF_CHARrf   r   symbol_spacer  r   r  r   r   data_formatr   LF_SHORT	LF_USHORTLF_LONGLF_ULONGr   r	  r  )
r\   r   r   r   r   r  sub_leaf_typer   r   name_strs
             r]   r  z"PdbReader.determine_extended_value  s    I%%% L//)99)-:QRR$=3y' 0  M Y%	(=(DDF!2 333&HH9#5"666'&II9#6"7772B6RR9#4"555&HH9#5"666/&QQ @AAAY*1F}} )9EI<Q<X)X  
 
 $$)i11 % 
 
 &&r_   )NN)rj   N)Fr   )2r`   ra   rb   __doc__r   rf   ContextInterfacer   r   r   ProgressCallbackr^   propertyr   classmethodr   rr   r   r   r   r   r   r   r   r   r,  r  r  r  rC  r   r   r	   r   r   rX  ra  r   r  ModuleInterfacer  r  r   r  r~  r  staticmethodboolr	  r  rc   r_   r]   re   re   d   s7        0 (,8<, ,#4, ,  }	,
 %5, 
, , , ,8   X     X  (+ (9(+EH(+	sJ&77	8(+ (+ (+ [(+T     & & &, , , ,  $6 6 6pQ- Q- Q- Q-f9% 9% 9%v
 
 
2Je J J J J JS S S   
 
 
&J JtCy$sCx.7P1Q J J J JX: : : : : :|6
T#s(^ 6
 6
 6
 6
 6
p2 	5 	6	
 	9 	6 	< 	@ 	2 	5 	. 	1 	6 	7 	-  	*!" 	,#$ 	4%& 131553;C57  M<M  (8M BEM ORM 	Z'78SM$j0@@AC	

 		
M  M  M  M ^"# "s "s " " " "S T(3-c3h2O-P    " " "L  !& %5  
	   \ &'%5&' !1&' "2	&'
 &' 
sJ&6;	<&' &' &' &' &' &'r_   re   c            
       @    e Zd Z	 ddededej        dee         fdZdS )PdbRetreiverNguid	file_nameri   rj   c                    t                               d           d                    |                    d          d d         dgz             }dD ]}|d| d| dz   }d }||d d         dz   fD ]}	 t                               d||z               t          j        |                              ||z             5 }|                    d	           d
}d d d            n# 1 swxY w Y   nE# t          j
        t          j        f$ r'}	t                               d|	            Y d }	~	nd }	~	ww xY w|r nǌ| |dd||z               |sd S ||z   S )NzDownload PDB file....r   r   )z*http://msdl.microsoft.com/download/symbols/r   zAttempting to retrieve rB   TzFailed with r   zDownloading )r   infojoinr   r   r   ResourceAccessoropenr   r   	HTTPErrorURLError)
r\   r  r  ri   sym_urlurlrg  suffixfpexcps
             r]   retreive_pdbzPdbRetreiver.retreive_pdb  s    	*+++HHY__S11#2#6%@AA	E 	 	G3	33D3333CF$ins&:;  	8LL!I3<!I!IJJJ"34EFFKKf  &!%	& & & & & & & & & & & & & & &
 8 8 8 8LL!6!6!6777777778 E(c#@#,#@#@AAA 	4V|s=   3A
C-=C!C-!C%%C-(C%)C--D/D**D/rZ   )r`   ra   rb   r   r   r  r   r  rc   r_   r]   r  r    s_        
 9=	   %5	
 
#     r_   r  __main__c                   :    e Zd ZdZd Zddeeef         defdZ	dS )PrintedProgresszdA progress handler that prints the progress value and the
        description onto the command line.c                     d| _         d S )Nr   )_max_message_lenr   s    r]   r^   zPrintedProgress.__init__  s    $%D!!!r_   Nprogressdescriptionc                     dt          |d          dd|pd }t          |          }t          | j        |g          | _        t	          |d| j        |z
  z  dz              d	S )
zA simple function for providing text-based feedback.

            .. warning:: Only for development use.

            Args:
                progress: Percentage of progress of the current procedure
            zProgress: r*   z 7.2fz		r    )endN)roundr   maxr  print)r\   r  r  messagemessage_lens        r]   __call__zPrintedProgress.__call__  s{     WU8Q%7%7VVV;CTRTVVGg,,K$')>(L$M$MD!'t'<{'J KtSTTTTTTr_   rZ   )
r`   ra   rb   r  r^   r   r   r;   r   r  rc   r_   r]   r  r    sf        	. 	.	& 	& 	&	U 	UU3:%6 	US 	U 	U 	U 	U 	U 	Ur_   r  zERead PDB files and convert to Volatility 3 Intermediate Symbol Format)r  z-oz--outputOUTPUTzFilename for data output)metavarhelpdefaultfilez#File-based conversion of PDB to ISFz-fz--fileFILEzPDB file to translate to ISF)r  r  r   z,Convert based on a GUID and filename patternz-pz	--patternPATTERNz$Filename pattern to recover PDB filez-gz--guidr  z+GUID + Age string for the required PDB filez-kz--keep
store_truezKeep the downloaded PDB file)actionr  r  )r  r  ri   z1PDB file could not be retrieved from the internetz No GUID/pattern or file providedz*No suitable filename provided or retrieved)schemezFile z does not existszfile:)rh   ri   r   r~   rq   r   r  -z.json.xzz.gzz.bz2z.xzwb)indent	sort_keysr)  zTemporary PDB file: )Qr*  bz2r;  gzipjsonlogginglzmaosr   typingr   r   r   r   r   r	   urllibr
   r   r   volatility3.frameworkr   r   r   volatility3.framework.layersr   r   r   	getLoggerr`   r   rU  rV  rX   re   r  argparser   r  ArgumentParserparseradd_argumentadd_argument_group
file_group
data_group
parse_argsargspg_cbdelfilefilenamer  patternr  urlparser  r  Contextctxr  pathexistspathname2urlabspathrg   	convertorrC  converted_jsonr   r  
output_urlr  open_methodr   fdumpsjson_stringwriter,  keepr  removerc   r_   r]   <module>r+     sK
    



      				       : : : : : : : : : : : : : : : : ( ( ( ( ( ( ( ( ( ( A A A A A A A A A A A A A A A A A A A A		8	$	$76h$PQRR
S795ESTUU
V7 	6h$PQRR
S7 	VuaHH	7 	6hqQQ
R7 	7x%QRSS
T7 	6h$PQRR
S7 	7x$PQRR
S7 	7x$PQRR
S7 	UeQGG7& 	7x$PQRR
S'7( 	UeQGG)70 	6hqQQ
R172 	UeQGG37: 	5XuaPP
Q;7< 	UeQGG=7D 	;8UdTUVV
WE7H 	UeQGG 8UdTUVV
WUeQGG %4QSTT
U5ESUVV
W%4QSTT
U5ESUVV
WXw$PQRR
SXw$PQRR
SxDRSTT
UXw$PQRR
S'TSTUU
VXw$PRSS
Th4QSTT
Um7 7 7
v 	UeQGG
 	UeQGG
 	UeQGG         H' H' H' H' H' H' H' H'V       B zOOOU U U U U& U U U( %X$[  F '     **A +  J h-K     **J +  J 3	     :     +     DOEGHy!9<>>..dle / 
 
 LLLMMM5>(F++2f<<G	 997888 CABBB
(


C
%.&
1
1
1C
zVw~~h'' 	=LL;;;;<<<1W1"'//(2K2KLLL	XT\U  I ''))N{9 	F9SbS>D)BCC.CC!*-i8?GD ,Y7>uEC-------JK{E""  i			f	%	%  h			e	$	$  i	Z	&	& /! djTJJJ	k9--.../ / / / / / / / / / / / / / / y /X//00000	 	(y v s   3UU"U