X fVVddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZmZddlmZmZddlmZddlmZmZmZmZddlmZddlmZdd lmZdd l m!Z!dd l"m#Z#ej$e%Z&Gd d ej'j(Z)Gddej*j+Z,dS)N)PureWindowsPath)AnyDict GeneratorListOptionalTupleUnion)parserequest)symbols) constantscontexts exceptions interfaces) symbol_cache) requirements)SymbolTableRequirement)intermed)pdbconvcdeZdZdZdZdZe d$dejj de de d e d e d e j d ee fd Ze d%dejj de de de d e d e d e j fdZedejj de de d eee e e ffdZe d&dejj de de de d e j d df dZe d'dejj de de deed e j dee dee de d eee eeee e ffddffdZe d(dejj d e de de de de d e fdZe d)dejj d e de de de de d!ed eee ee ffd"Ze d(dejj d e de de de de d e fd#ZdS)* PDBUtilityzAClass to handle and manage all getting symbols based on MZ header)rr)rr>volatility3.framework.symbols.intermed.IntermediateSymbolTableNcontext layer_nameoffsetsymbol_table_class config_pathprogress_callbackreturnc :||||}|,tdt|dS|\}} } |4tjd| dd}|||| | |||S)aProduces the name of a symbol table loaded from the offset for an MZ header Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins symbol_table_class: The class to use when constructing the SymbolTable config_path: New path for the produced symbol table configuration with the config tree progress_callback: Callable called to update ongoing progress Returns: None if no pdb information can be determined, else returned the name of the loaded symbols for the MZ NzCould not get GUID for pdbutility._) get_guid_from_mzvollogdebughexr configuration path_joinreplaceload_windows_symbol_table) clsrrrrr r!resultguidagepdb_names _/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/pdbutil.pysymbol_table_from_offsetz#PDBUtility.symbol_table_from_offset s.%%gz6BB > LL@3v;;@@ A A A4$c8  $2<<h..sC88K,,          r$r1r2r3c tj|d|dzt |z}d} t jdtj j st ddStjtjtj} tj | tj|d||d} | r| } nP||||||t*jd|D]} | } | st d|td|d|t |zdSt d |t4jj} ||j| |d <| |j| |d <t4j|} t4j|}tA|d }|!|| |j|S)z7Loads (downloading if necessary) a windows symbol table-N)rrrz)Required version of SQLiteCache not foundwindowsz(Required symbol library path not found: z@The symbols can be downloaded later using pdbconv.py -p {} -g {}zUsing symbol library: classisf_urlz!PDBUtility generated symbol table)name description)"ospathjoinstripupperstrrVersionRequirementmatches_requiredr SqliteCacheversionr(r)r CACHE_PATHIDENTIFIERS_FILENAME find_locationWindowsIdentifiergeneratedownload_pdb_isfrIntermediateSymbolTablefile_symbol_urlinfoformatrr+r,config parent_path path_headr construct)r/rr1r2r3rr r! filter_stringisf_pathidentifiers_pathvaluerAparent_config_pathrequirement_name requirements r4r.z$PDBUtility.load_windows_symbol_tableKs NN6 " "DJJLL3$6S$A  .?? |/7    LLE F F F47<<  )"@  ()9::HH  * 3 3v&& c        HH  sH6G   "9II=  !  LLSMSS T T T KKRYYNN6**DJJLL3s88,C    4 =m==>>>'15GttK1127?ttK334'5AA+NN%3==kJJ-!/R    g'9:::~k**r6c ddl}n+#t$rtdYdSwxYw|j|}||d}|dkrdSt jd||dzd\}|||zd}|d krdSt jd |||zd zd\} |||d z| z} || } | j j } ||| d} || } | j j }| d|}| j D]!}|| |j |j |jzz }"|| } t| drt!| jsdSd}t%t!| jD]}| j|jjdkrk| j|}| |jd|jj| | j|j}|dS|jdd}t9|j}|j}|jdd}|||fS)aTakes the offset to an MZ header, locates any available pdb headers, and extracts the guid, age and pdb_name from them Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins Returns: A tuple of the guid, age and pdb_name, or None if no PDB record can be found rNz=Get_guid_from_mz requires the following python module: pefilerMZz> I IE,U3:?1DD$:5A ++%??@RSS%6!!###%;EBH  4*11'::@@HH#8,,1o+CRC0S(""s $//c tj||dzt|z}tjD]}g}tj|d|dz} d} tjtj| dtj | d5} tj |t|z||} | rtj| d } | jd kst!| jd krP|| d t%jtj|d z}n| }tj||||}| t1t3j|dddd} nt6ddddn #1swxYwY | s3tj| rtj| |D]D} tj| #t>$r t6d| YAwxYwdS#t>$rt6d | Y| s3tj| rtj| |D]D} tj| #t>$r t6d| YAwxYwwxYw#| s3tj| rtj| |D]D} tj| #t>$r t6d| YAwxYwwxYwt6ddS)zpAttempts to download the PDB file, convert it to an ISF file and save it to one of the symbol locations.r9r:z.json.xzFT)exist_okw) file_namer!file)schemerzfile:r)indent sort_keysrhzSymbol file could not be downloaded from remote server Nz%Temporary file could not be removed: zBCannot write necessary symbol file, please check permissions on {}zvCannot write downloaded symbols, please add the appropriate symbols or add/modify a symbols directory that is writable)!r?r@rArDr __path__makedirsdirnamelzmaopenr PdbRetreiver retreive_pdbr urlparserryappendr pathname2urlabspath PdbReaderget_jsonwritebytesjsondumpsr(warningexistsremovePermissionErrorrR)r/rr1r2r3r!rWr@ tmp_filespotential_output_filename data_writtenoffilenameurllocation json_outputs r4rNzPDBUtility.download_pdb_isfs XtczCHH/DEE $A A DI(* i!;)) %!L5  BGOO,EFFQUVVVVY8#>>"&355BBs3xx"**; C  H  #nXfEEE://3sz??a3G3G%,,X666'.1E " " > >22(HH(0H&-&7#Xx9J''"(**$! $ ;qD Q Q Q '(, *9@$97P(Q(Q9I7888 )H (++++*NHNN#   X__1 $97P(Q(Q9I7888 )H (++++*NHNN $97P(Q(Q9I7888 )H (++++*NHNN NNF     s,AJ4EH9 JH J H J I  'J  J 7MM L'MMMM  :ONO'O OO Odctx page_size pdb_namesstartendmaximum_invalid_countc #Kd} ||j|j}||j|j}|j||t |||||z fgD]\} } } } d}| |z}d}t || dD]e}||krn\|j|||zds|dz }4|j|||zd}|dkr||z}nf|} | | t| d| |d VdS) aScans through `layer_name` at `ctx` looking for RSDS headers that indicate one of four common pdb kernel names (as listed in `self.pdb_names`) and returns the tuple (GUID, age, pdb_name, signature_offset, mz_offset) .. note:: This is automagical and therefore not guaranteed to provide correct results. The UI should always provide the user an opportunity to specify the appropriate types and PDB values themselves Args: layer_name: The layer name to scan page_size: Size of page constant pdb_names: List of pdb names to scan progress_callback: Means of providing the user with feedback during long processes start: Start address to start scanning from the pdb_names end: Minimum address to scan the pdb_names maximum_invalid_count: Amount of pages that can be invalid during scanning before aborting signature search rN)r!rurrrr_rh)GUIDr2r3signature_offset mz_offset) rmminimum_addressmaximum_addressscanPdbSignatureScannerrzis_validrnrD)r/rrrrr!rrrmin_pfnrr2r3rrsig_pfncurrent_invalid_counterirds r4 pdbname_scanzPDBUtility.pdbname_scan=s< =Jz*:E ;*Z(8C58Z 5K5P5P   * */cEk*+ 6Q6 6    1D#x!1 I&)3G&' #7GR00  *-BBBEz*-66q9}aHH+q0+z*-221y=!DD5== !I IE!G'22$4&     1  r6 module_offset module_sizec@|||||||\}}|S)aCreates symbol table for a module in the specified layer_name. Searches the memory section of the loaded module for its PDB GUID and loads the associated symbol table into the symbol space. Args: context: The context to retrieve required elements (layers, symbol tables) from config_path: The config path where to find symbol files layer_name: The name of the layer on which to operate module_offset: This memory dump's module image offset module_size: The size of the module for this dump Returns: The name of the constructed and loaded symbol table _modtable_from_pdb) r/rr rr3rrr&symbol_table_names r4symbol_table_from_pdbz PDBUtility.symbol_table_from_pdbs42 #55 [*h {   ! r6F create_modulec ||j|j}||j|j|z }t||||j|jt |dg|||z}|stjd|d|dd|d} t d| d d | d d | d | d  dd} | || d | d | d d|} d} |r1tj|| || d| } | j} | | fS)Nzlatin-1)rrzDid not find GUID of z in module @ 0xx!rzFound r3z: rr9r2z.pdbr)r r)rr)rmrrlistrrrrVolatilityExceptionr(r)r-r.rModulecreater=)r/rr rr3rrrguidsr1 module_namernew_module_name new_modules r4rzPDBUtility._modtable_from_pdbs  #N:6FM  !.4D}TK   z*4x++,#!K/       0SSSSSSS Qx Nd:.NN$v,NNeNNOOO:&..vr:: 99  L K   L# :    .!//K("3 0J)oO 111r6c D|||||||d\}}|S)aCreates a module in the specified layer_name based on a pdb name. Searches the memory section of the loaded module for its PDB GUID and loads the associated symbol table into the symbol space. Args: context: The context to retrieve required elements (layers, symbol tables) from config_path: The config path where to find symbol files layer_name: The name of the layer on which to operate module_offset: This memory dump's module image offset module_size: The size of the module for this dump Returns: The name of the constructed and loaded symbol table T)rr) r/rr rr3rrrr&s r4module_from_pdbzPDBUtility.module_from_pdbs?4//      0   Qr6)rNN)r$NN)NNNr)NN)NNF)__name__ __module__ __qualname____doc___version_required_framework_version classmethodrrContextInterfacerDintrProgressCallbackrr5r.r r'rNrrrrr rrboolrrr6r4rrs_KKH"+ #c8<( ( #4( (  (  (  ( %5(  #( ( ( [( T(8<G+G+#4G+G+ G+  G+  G+G+%5G+G+G+[G+RU# (9U#GJU#TWU# %S# & 'U#U#U#[U#n9= MM#4MM M  M %5 M MMM[M^9=#!%(BB   0BB B ; B %5 B}Bc]B #B 4XeE3O&<==>dJ KBBB[BH"!!#4!! !  !  !! !!![!:"#9292#49292 92  92  929292 x}hsm+ ,929292[92v"###4## #  #  ## ###[###r6rc eZdZdZdZ dZ ejdZde e ddffd Z d e d e de eeee e fddffd ZxZS) ranA :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: pdb_names: A list of bytestrings, used to match pdb signatures against the pdb names within the records. .. note:: The pdb_names must be a list of byte strings, unicode strs will not match against the data scanned i@Tz<16BIrr"NcVt||_dSr)super__init__ _pdb_names)selfr __class__s r4rzPdbSignatureScanner.__init__s$ #r6rd data_offsetc#FKdd|jjzzdzdd|jDzdz}t j||tjD]>}||dd z|jjz|dt| zd z }||jvr|j ||dd z|dd z|jjz\}}}} } } } } }}}}}}}}}d | |||| | | | ||||||||}|d|j kr|||||dzfV@dS) NsRSDS.(|c6g|]}tj|Sr)reescape).0rs r4 z0PdbSignatureScanner.__call__..s ???!1???r6s))flagsrrarz`{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}) _RSDS_formatsizerArrfinditerDOTALLrrygrouprprR chunk_size)rrdrpatternmatchr3g3g2g1g0g5g4g7g6g8g9gagbgcgdgegfar1s r4__call__zPdbSignatureScanner.__call__s d',, . ii??t???@@ A   [$bi@@@& L& LE A#()+0;;q>>ekkmm$$,%,H4?**(%,, A*U[[^^a-?$BSBX-XX%&--BBBBBBBPR;;q>>DO33HkEKKNN.JKKKKM& L& Lr6)rrrroverlap thread_saferoStructrrrrrrr rDrr __classcell__)rs@r4rrsGlKA 6=))L$$u+$$$$$$$$0L0L(+0L 5c5#-.d: ;0L0L0L0L0L0L0L0Lr6r)-rloggingrr?rropathlibrtypingrrrrrr r urllibr r volatility3r volatility3.frameworkrrrrvolatility3.framework.automagicr#volatility3.framework.configurationr0volatility3.framework.configuration.requirementsrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr getLoggerrr(r+VersionableInterfacerrmScannerInterfacerrr6r4r0s   ######EEEEEEEEEEEEEEEEEE!!!!!!!!MMMMMMMMMMMM888888<<<<<<SSSSSS222222999999  8 $ $fffff)>fffRELELELELEL*+<ELELELELELr6