X fVtddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZmZddlmZmZddlmZddlmZmZmZmZddlmZddlmZdd lmZdd l m!Z!dd l"m#Z#ejHe%Z&Gd d ejNjPZ)GddejTjVZ,y)N)PureWindowsPath)AnyDict GeneratorListOptionalTupleUnion)parserequest)symbols) constantscontexts exceptions interfaces) symbol_cache) requirements)SymbolTableRequirement)intermed)pdbconvceZdZdZdZdZe d dejjde de de d e d e jd ee fd Ze d!dejjd e de de de d e d e jfdZedejjde de d eee e e ffdZe d"dejjd e de de d e jd df dZe d#dejjde de deed e jdee dee de d eee eeee e ffddffdZe d$dejjd e de de de de d e fdZe d%dejjd e de de de de ded eee ee ffdZe d$dejjd e de de de de d e fdZy)& PDBUtilityzAClass to handle and manage all getting symbols based on MZ header)rr)rrNcontext layer_nameoffsetsymbol_table_class config_pathprogress_callbackreturnc |j|||}|"tjdt|y|\}} } |0tj j d| jdd}|j||| | |||S)aProduces the name of a symbol table loaded from the offset for an MZ header Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins symbol_table_class: The class to use when constructing the SymbolTable config_path: New path for the produced symbol table configuration with the config tree progress_callback: Callable called to update ongoing progress Returns: None if no pdb information can be determined, else returned the name of the loaded symbols for the MZ NzCould not get GUID for pdbutility._) get_guid_from_mzvollogdebughexr configuration path_joinreplaceload_windows_symbol_table) clsrrrrrr resultguidagepdb_names _/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/pdbutil.pysymbol_table_from_offsetz#PDBUtility.symbol_table_from_offset s.%%gz6B > LL23v;-@ A$c8  $22<<h..sC8K,,         r0r1r2c ztjj|jd|j dzt |z}d} t jjdtjjstjdytjjtjtj } tj| j#tj$j'|jd|j |d} | r| } nK|j)||j |||t*j,j/d|D]} | } n| sgtjd|tj1dj3|jd|j t |zytjd |t4j6j8} ||j:| |d <| |j:| |d <t4j6j=|} t4j6j?|}tA|d }|jC|| |j:|S)z7Loads (downloading if necessary) a windows symbol table-N)rrrz)Required version of SQLiteCache not foundwindowsz(Required symbol library path not found: z@The symbols can be downloaded later using pdbconv.py -p {} -g {}zUsing symbol library: classisf_urlz!PDBUtility generated symbol table)name description)"ospathjoinstripupperstrrVersionRequirementmatches_requiredr SqliteCacheversionr'r(r CACHE_PATHIDENTIFIERS_FILENAME find_locationWindowsIdentifiergeneratedownload_pdb_isfrIntermediateSymbolTablefile_symbol_urlinfoformatrr*r+config parent_path path_headr construct)r.rr0r1r2rrr filter_stringisf_pathidentifiers_pathvaluer@parent_config_pathrequirement_name requirements r3r-z$PDBUtility.load_windows_symbol_tableKsL NN6 "DJJL3$6S$A ..?? |//77  LLD F77<<  )"@"@ (()9:HH  * * 3 3v& c     H  sH6G "99II= !    LLCM?S T KKRYYNN6*DJJL3s8,C   -m_=>''115GtK127?tK34'55AA+N%33==kJ-!/R  g'9:~~k**r5c ddl}|j|}|j |d}|dk7ryt jd|j |dzd\}|j ||zd}|d k7ryt jd |j ||zd zd\} |j ||d z| z} |j| } | jj} |j || d} |j| } | jj}| d|}| jD]+}|| |j|j|jzz }-|j| } t| drt!| j"syd}t%t!| j"D]}| j"|j j&dk(s*| j"|}| j)|j j+d|j j,| j/| j"|j0}|y|j2j5dj7d}t9|j:}|j<}|j>dd}|||fS#t$rtjdYywxYw)aTakes the offset to an MZ header, locates any available pdb headers, and extracts the guid, age and pdb_name from them Args: context: The context on which to operate layer_name: The name of the (contiguous) layer within the context that contains the MZ file offset: The offset in the layer at which the MZ file begins Returns: A tuple of the guid, age and pdb_name, or None if no PDB record can be found rNz=Get_guid_from_mz requires the following python module: pefilerMZz IE,,U3::??1D$::5A ++%%??@RS%%66!!#%;;EBHH  I  **11':@@H#8,11oo++CR0S(""M  LLO   sJ55KKc ttjj||dzt|z}tj D]}g}tjj|d|dz} d} tj tjj| dtj| d5} tjj|t|z||} | rtj| d } | jd k(st!| jd k(rJ|j#| d t%j&tjj)|d z}n| }tj*||||j-}| j/t1t3j4|dddd} nt6j9dddd | s4tjj;| rtj<| |D]} tj<| yt6j9dy#1swYvxYw#t>$rt6j9d| YcwxYw#t>$rt6j9djA| Y| s4tjj;| rtj<| |D]?} tj<| #t>$rt6j9d| Y=wxYwwxYw#| s4tjj;| rtj<| |D]?} tj<| #t>$rt6j9d| Y=wxYwwxYw)zpAttempts to download the PDB file, convert it to an ISF file and save it to one of the symbol locations.r8r9z.json.xzFT)exist_okw) file_namer file)schemerzfile:r)indent sort_keysrgzSymbol file could not be downloaded from remote server Nz%Temporary file could not be removed: zBCannot write necessary symbol file, please check permissions on {}zvCannot write downloaded symbols, please add the appropriate symbols or add/modify a symbols directory that is writable)!r>r?r@rCr __path__makedirsdirnamelzmaopenr PdbRetreiver retreive_pdbr urlparserrxappendr pathname2urlabspath PdbReaderget_jsonwritebytesjsondumpsr'warningexistsremovePermissionErrorrQ)r.rr0r1r2r rVr? tmp_filespotential_output_filename data_writtenoffilenameurllocation json_outputs r3rMzPDBUtility.download_pdb_isfs; XtczCH/DE $$A DI(* i!;) %!L5  BGGOO,EFQUVYY8#>"&335BBs3x"**; C H  #nnXfE::/3szz?a3G%,,X6'.1E1E " " >2(H(0H&-&7&7#Xx9J'"(*$! $ ;qD Q '(, *9@$7P(QII78 )H (+mA | NNF k`+CH:N# X__1 $7P(QII78 )H (+*CH:N $7P(QII78 )H (+*CH:Ns-A J 7D.I%J *I&I# J &!J  J  -L8:L;7L  !L10L17L88L;;volatility3.framework.symbols.intermed.IntermediateSymbolTable)rr)rr)rlrrlistrrrrVolatilityExceptionr'r(r,r-rModulecreater<)r.rrrr2rrrguidsr0 module_namernew_module_name new_modules r3rzPDBUtility._modtable_from_pdbs  #NN:6FFM  !..4DD}TK   z*44x+,#!K/    00'zq@QQRS Qx vd:./r$v,qe NO:&..vr: 99  L K   L# :  !//K("3 0J)ooO 111r5c <|j||||||d\}}|S)aCreates a module in the specified layer_name based on a pdb name. Searches the memory section of the loaded module for its PDB GUID and loads the associated symbol table into the symbol space. Args: context: The context to retrieve required elements (layers, symbol tables) from config_path: The config path where to find symbol files layer_name: The name of the layer on which to operate module_offset: This memory dump's module image offset module_size: The size of the module for this dump Returns: The name of the constructed and loaded symbol table T)rr) r.rrrr2rrrr%s r3module_from_pdbzPDBUtility.module_from_pdbs:4//      0  Qr5)rNN)r#NN)NNNd)NN)NNF)__name__ __module__ __qualname____doc___version_required_framework_version classmethodrrContextInterfacerCintrProgressCallbackrr4r-r r&rMrrrrr rrboolrrr5r3rrsKH"+ #c8<( ##44( (  (  (  ( %55(  #( ( T(8<G+##44G+G+ G+  G+  G+G+%55G+G+RU# ((99U#GJU#TWU# %S# & 'U#U#n9= M##44MM M  M %55 M MM^9=#!%(B    0 0BB B ; B %55 B}Bc]B #B 4XeE3O&<==>dJ KBBH"!##44!! !  !  !! !!:"#92##449292 92  92  929292 x}hsm+ ,9292v"###44## #  #  ## ##r5rc eZdZdZdZ dZ ejdZde e ddffd Z d e d e de eeee e fddffd ZxZS) ranA :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner use to identify Windows PDB records. Args: pdb_names: A list of bytestrings, used to match pdb signatures against the pdb names within the records. .. note:: The pdb_names must be a list of byte strings, unicode strs will not match against the data scanned i@Tz<16BIrr!Nc0t|||_yr)super__init__ _pdb_names)selfr __class__s r3rzPdbSignatureScanner.__init__s #r5rc data_offsetc#Kdd|jjzzdzdj|jDcgc]}t j |c}zdz}t j ||tjD]1}||jddz|jjz|jdt|jzd z }||jvsm|jj||jddz|jddz|jjz\}}} } } } } }}}}}}}}}}d j| | ||| | || ||||||||}|jd|jks|||||jdzf4ycc}ww) NsRSDS.(|s))flagsrr`rz`{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}) _RSDS_formatsizer@rreescapefinditerDOTALLrrxgrouprorQ chunk_size)rrcrrpatternmatchr2g3g2g1g0g5g4g7g6g8g9gagbgcgdgegfar0s r3__call__zPdbSignatureScanner.__call__s d'',,, . iit?!1?@ A   [[$bii@& LE A##(()+0;;q>ekkm$,%,H4??*(%%,, A*U[[^a-?$BSBSBXBX-X%&--BBBBBBBPR;;q>DOO3HkEKKN.JKKM& L@s8GF> BG5B)G #G)rrrroverlap thread_safernStructrrrrrrr rCrr __classcell__)rs@r3rrsGlKA 6==)L$$u+$$$0L0L(+0L 5c5#-.d: ;0Lr5r)-rloggingrr>rrnpathlibrtypingrrrrrr r urllibr r volatility3r volatility3.frameworkrrrrvolatility3.framework.automagicr#volatility3.framework.configurationr0volatility3.framework.configuration.requirementsrvolatility3.framework.symbolsr%volatility3.framework.symbols.windowsr getLoggerrr'r*VersionableInterfacerrlScannerInterfacerrr5r3r-s   #EEE!MM8<S29   8 $f))>>fREL*++<<ELr5