
    *1fQ                     j   d dl Z d dlmZmZmZmZ d dlmZmZm	Z	  e j
        e          Z G d d          Z ed dg          Z ed	 d
g          Z ed ddg          Z ed ddg          Z ed ddg          Z ed g d          Z ed g d          Z ed g d          Z ed ddg          Z ed g d          Z ed dg          Z ed g d           Z ed! d"d#g          Z ed$ dg          Z ed% dg          Z ed& d'dg          ZdS )(    N)CallableTupleListOptional)
interfaces	constants
exceptionsc                       e Zd ZdZdeeedf         gef         deee	e
e	         ef                  ddfdZdej        j        d	e	defd
ZdS )OsDistinguishera  Distinguishes a symbol table as being above a particular version or
    point.

    This will primarily check the version metadata first and foremost.
    If that metadata isn't available then each item in the fallback_checks is tested.
    If invert is specified then the result will be true if the version is less than that specified, or in the case of
    fallback, if any of the fallback checks is successful.

    A fallback check is made up of:
     * a symbol or type name
     * a member name (implying that the value before was a type name)
     * whether that symbol, type or member must be present or absent for the symbol table to be more above the required point

    Note:
        Specifying that a member must not be present includes the whole type not being present too (ie, either will pass the test)

    Args:
        version_check: Function that takes a 4-tuple version and returns whether whether the provided version is above a particular point
        fallback_checks: A list of symbol/types/members of types, and whether they must be present to be above the required point

    Returns:
        A function that takes a context and a symbol table name and determines whether that symbol table passes the distinguishing checks
    version_check.fallback_checksreturnNc                 "    || _         || _        d S )N)_version_check_fallback_checks)selfr   r   s      `/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/versions.py__init__zOsDistinguisher.__init__"   s    
 , /    contextsymbol_tablec                    	 |j         |         j        j        }|\  }}}}|                     ||||f          S # t          t
          t          f$ r( t                              t          j
        d           Y nw xY w| j        D ]\  }}	}
|	\|j                             |t          j        z   |z             p)|j                             |t          j        z   |z             |
k    r dS d	 |j                             |t          j        z   |z             }|                    |	          |
k    r dS # t"          j        $ r	 |
sY  dS Y w xY wdS )a#  

        Args:
            context: The context that contains the symbol table named `symbol_table`
            symbol_table: Name of the symbol table within the context to distinguish the version of

        Returns:
            True if the symbol table is of the required version
        z(Windows PE version data is not availableNFT)symbol_spacemetadata
pe_versionr   AttributeError
ValueError	TypeErrorvolloglogr   LOGLEVEL_VVVr   
has_symbolBANGhas_typeget_type
has_memberr	   SymbolError)r   r   r   r   majorminorrevisionbuildnamememberresponsesymbol_types               r   __call__zOsDistinguisher.__call__+   s   	 -l;DOJ,6)E5(E&&uh'FGGG
I6 	 	 	JJ&(R    	 '+&; 	% 	%"D&(~(33$y~5<   +44$y~5<    !55%")"6"?"?$y~5<# #K #--f55AA$uu B!- % % %# %$uuu% %% ts"   69 <A87A8'AD..EE)__name__
__module____qualname____doc__r   r   intboolr   strr   r   r   r   ContextInterfacer0    r   r   r   r   	   s         00sCx 14 780 eC#$<=>0 
	0 0 0 0-!):-JM-	- - - - - -r   r   c                     | dk    S )N)      r9   xs    r   <lambda>r?   \   
    AK r   )_KPRCBPendingTickFlagsT)r   r   c                     | dk    S )Nr;   r   r9   r=   s    r   r?   r?   a   r@   r   )KdCopyDataBlockNTc                     d| k    S N
   r   r9   r=   s    r   r?   r?   f   s
    GqL r   ObHeaderCookieNT_HANDLE_TABLEHandleCountFc                 "    d| cxk    odk     nc S )N      )rQ      r9   r=   s    r   r?   r?   n   "    Fa0000&0000 r   )rE   NF)rM   rN   Tc                 "    d| cxk    odk     nc S )NrP   rD   r9   r=   s    r   r?   r?   v   rT   r   c                 "    d| cxk    odk     nc S )NrH   rI   r   i:  r9   r=   s    r   r?   r?   ~   s"    Gq9999>9999 r   )rJ   rL   )	_EPROCESSKeepAliveCounterTc                     | dk    S )NrW   r9   r=   s    r   r?   r?          A/ r   )rJ   rL   rX   rY   F)rX   ControlFlowGuardEnabledTc                     | dk    S )N)rI   r   i?  r9   r=   s    r   r?   r?      r[   r   )rJ   rL   r\   )rX   r]   Fc                     | dk    S )N)rI   r   icE  r9   r=   s    r   r?   r?      r[   r   )rX   TrustletIdentityF)ParentSecurityDomainNTc                     | dk    S )N)rI   r   iG  r9   r=   s    r   r?   r?      r[   r   )rJ   )_CM_CACHED_VALUE_INDEXNF)_WNF_PROCESS_CONTEXTNTc                     | dk    S )N)rI   r   iG  r9   r=   s    r   r?   r?      r[   r   _KQOS_GROUPING_SETSNTc                     | dk    S )N)rI   r   iaJ  r9   r=   s    r   r?   r?      r[   r   ))rX   TimerResolutionIgnoreT)rX   VmProcessorHostTransitionTrf   c                     | dk    S )N)rI   r   i6c  r9   r=   s    r   r?   r?      r[   r   )rX   MmSlabIdentityT)rX   !EnableProcessImpersonationLoggingTc                     | dk    S rG   r9   r=   s    r   r?   r?      s
    AL r   c                     | dk    S )N)r;   rS   r9   r=   s    r   r?   r?      r@   r   c                     | dk    S )N)r;   rR   r9   r=   s    r   r?   r?      r@   r   )_OBJECT_HEADER	TypeIndexT)loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   	getLoggerr1   r   r   is_windows_8_1_or_lateris_vista_or_lateris_win10is_windows_xpis_xp_or_2003is_win10_up_to_15063is_win10_15063is_win10_16299_or_lateris_win10_17763_or_lateris_win10_18362_or_lateris_win10_18363_or_lateris_win10_19041_or_lateris_win10_25398_or_lateris_windows_10is_windows_8_or_lateris_windows_7r9   r   r   <module>r      s,    2 2 2 2 2 2 2 2 2 2 2 2 C C C C C C C C C C		8	$	$O O O O O O O Od */''9:   
 $O''45   
 ?((&/    00(.    00(.   '99      !//     *///      *///0,    *///      *///89   
 *///      *///-@     ((34  
 (''<=   
 ''-.  r   