
    *1f                        d dl Zd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	m
Z
mZmZmZmZ d dlmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZm Z m!Z!  ej"        e#          Z$ G d	 d
ej%                  Z& G d dej%                  Z' G d de'          Z( G d dej%                  Z) G d dej%        e!j*                  Z+ G d dej%        e!j*                  Z, G d dej%        e!j*                  Z- G d dej%        e!j*                  Z. G d dej%        e!j*                  Z/ G d dej%        e!j*                  Z0 G d dej%                  Z1 G d d ej2        e!j*                  Z3 G d! d"ej%        ej4        j	                  Z5 G d# d$ej%                  Z6 G d% d&ej%                  Z7 G d' d(ej%                  Z8 G d) d*ej%                  Z9 G d+ d,ej%                  Z:dS )-    N)	GeneratorIterableIteratorListOptionalTupleUnion)	constants
exceptions
interfacesobjects	rendererssymbols)ObjectInterface)intel)
conversion)generic)kdbgpepoolc                       e Zd ZdZd ZdS )KSYSTEM_TIMEz8A system time structure that stores a high and low part.c                 N    | j         dz  | j        z  }t          j        |          S )N    )	High1TimeLowPartr   wintime_to_datetime)selfwintimes     k/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/__init__.pyget_timezKSYSTEM_TIME.get_time$   s&    >R'4<7-g666    N)__name__
__module____qualname____doc__r!    r"   r    r   r   !   s)        BB7 7 7 7 7r"   r   c                       e Zd ZdZ ej        d          d             ZddZd Zd Z	d	 Z
d
efdZd
efdZd
efdZd Zd Zd Zd ZdS )MMVAD_SHORTzA class that represents process virtual memory ranges.

    Each instance is a node in a binary tree structure and is pointed to
    by VadRoot.
    N)maxsizec                    | j         j        }| j         j                            t          j                  d         }t          j        | j        |          s|dz  }n|dz  }	 | j        	                    |t          j        z   dz   | j         j
        || j         j        d          }|                                S # t          j        $ r Y d S t          $ r Y d S w xY w)Nr         bytes)
layer_nameoffsetnative_layer_namelength)volr0   	type_namesplitr
   BANGr   symbol_table_is_64bit_contextobjectr/   r1   decoder   InvalidAddressExceptionUnicodeDecodeError)r   vad_addresssymbol_table_namebytesobjs       r    get_tagzMMVAD_SHORT.get_tag0   s    ho !H.44Y^DDQG,T]<MNN 	1KK2K	}++!IN2W<8.""&("< ,  H ??$$$1 	 	 	44! 	 	 	44	s   "AB9 9C	CCr   c           	   #     K   |dk    r4t                               t          j        d           t	          d          |t                      }| j        j        }||v r't                               t          j        d           dS |                    |           | 	                                }|dv rd}n]||
                    d          rd	}nC|d
k    rd}n:t                               t          j        d| j        j         d| d|            dS |r|                     |          }|V  	 |                                                                                     ||dz             D ]}|V  nJ# t          j        $ r8}t                               t          j        d|j        d           Y d}~nd}~ww xY w	 |                                                                                     ||dz             D ]}|V  dS # t          j        $ r9}t                               t          j        d|j        d           Y d}~dS d}~ww xY w)zTraverse the VAD tree, determining each underlying VAD node type by
        looking up the pool tag for the structure and then casting into a new
        object.d   z+Vad tree is too deep, something went wrong!zVad tree is too deepNzVAD node already seen!)VadSVadF_MMVAD_SHORTVad_MMVADr   zSkipping VAD at z depth z
 with tag    zInvalid address on LeftChild: #xzInvalid address on RightChild: )volloglogr
   LOGLEVEL_VVVRuntimeErrorsetr3   r0   addr@   
startswithcastget_left_childdereferencetraverser   r;   invalid_addressget_right_child)	r   visiteddepthr=   tagtarget
vad_objectvad_nodeexcps	            r    rT   zMMVAD_SHORT.traverseK   s      3;;JJ&(U   5666?eeGho'!!JJy-/GHHH4K   llnn"""#FF_!6!6_FFaZZ FF JJ&Q48?QQ5QQCQQ   4 	6**J		##%%1133<<WeaiPP   1 	 	 	JJ&J1EJJJ       			$$&&2244==guqyQQ    1 	 	 	JJ&K$2FKKK        	s2   -AE2 2F9.F44F9=AH I.IIc                 r   |                      d          r| j        S |                      d          r| j        S |                      d          rM| j                             d          r| j        j        S | j                             d          r| j        j        S n|                      d          rz| j                             d          r`| j        j                             d          r| j        j        j        S | j        j                             d          r| j        j        j        S t          d          )zGet the right child member.
RightChildRightVadNodeCorez%Unable to find the right child member)
has_memberr_   r`   ra   rb   AttributeErrorr   s    r    rV   zMMVAD_SHORT.get_right_child   s,    ??<(( 	3?"__W%% 	3: __Y'' 	3|&&|44 /|..|&&w// *|))* __V$$ 	3y##I.. 39$//== 89,779$//88 39,22DEEEr"   c                 r   |                      d          r| j        S |                      d          r| j        S |                      d          rM| j                             d          r| j        j        S | j                             d          r| j        j        S n|                      d          rz| j                             d          r`| j        j                             d          r| j        j        j        S | j        j                             d          r| j        j        j        S t          d          )zGet the left child member.	LeftChildLeftra   rb   z$Unable to find the left child member)rc   rg   rh   ra   rb   rd   re   s    r    rR   zMMVAD_SHORT.get_left_child   s*    ??;'' 	2>!__V$$ 	29__Y'' 	2|&&{33 .|--|&&v.. )|(() __V$$ 	2y##I.. 29$//<< 79,669$//77 29,11CDDDr"   c                    |                      d          r| j        S |                      d          r)| j                             d          r| j        j        dz  S |                      d          rX| j                             d          r| j        j        j        dz  S | j                             d          r| j        j        dz  S n|                      d          rk| j        j                             d          r| j        j        j        j        dz  S | j        j                             d          r| j        j        j        dz  S t          d          )zGet the VAD's parent member.Parentu1ra   ParentValuerb   z Unable to find the parent member)rc   rj   rk   ra   rm   rb   rd   re   s    r    
get_parentzMMVAD_SHORT.get_parent   sM    ??8$$ 	<; __T"" 	<tw'9'9('C'C 	<7>D(( __Y'' 	<|&&t,, 7|-44((77 7|/$667 __V$$ 	<y ++D11 <y(+2T99"--m<< <y(4t;;?@@@r"   returnc                 l   |                      d          r4|                      d          r| j        dz  | j        dz  z  S | j        dz  S |                      d          rH| j                             d          r| j        j        dz  | j        j        dz  z  S | j        j        dz  S t	          d          )zWGet the VAD's starting virtual address. This is the first accessible byte in the range.StartingVpnStartingVpnHighr-   ,   rb   z&Unable to find the starting VPN member)rc   rq   rr   rb   rd   re   s    r    	get_startzMMVAD_SHORT.get_start   s     ??=)) 
	3011 .(B.43G23MNN'2--__V$$ 	3y##$566 3	-3	8QUW8WXXy,22EFFFr"   c                    |                      d          r@|                      d          r| j        dz   dz  | j        dz  z  dz
  S | j        dz   dz  dz
  S |                      d          rT| j                             d          r%| j        j        dz   dz  | j        j        dz  z  dz
  S | j        j        dz   dz  dz
  S t	          d          )zTGet the VAD's ending virtual address. This is the last accessible byte in the range.	EndingVpnEndingVpnHighrH   r-   rs   rb   z$Unable to find the ending VPN member)rc   rv   rw   rb   rd   re   s    r    get_endzMMVAD_SHORT.get_end   s     ??;'' 	=// 8.1,38Jb8PQUVVV!+2a77__V$$ 	=y##O44 =i)A-"49PTV9VW  ,q0R71<<CDDDr"   c                 Z    |                                  |                                 z
  dz   S )z@Get the size of the VAD region. The OS ensures page granularity.rH   )rx   rt   re   s    r    get_sizezMMVAD_SHORT.get_size  s$    !1!11Q66r"   c                 v   |                      d          r+| j                             d          r| j        j        j        S |                      d          r+| j                             d          r| j        j        j        S |                      d          r| j        j        j        j        S t          d          )z7Get the VAD's commit charge (number of committed pages)rk   	VadFlags1uVadFlagsrb   z'Unable to find the commit charge member)rc   rk   r|   CommitCharger}   r~   rb   rd   re   s    r    get_commit_chargezMMVAD_SHORT.get_commit_charge  s     ??4   	7TW%7%7%D%D 	77$11__S!! 	7df&7&7
&C&C 	76?//__V$$ 	79<)66FGGGr"   c                    |                      d          rJ| j                             d          r0| j        j                             d          r| j        j        j        S |                      d          rJ| j                             d          r0| j        j                             d          r| j        j        j        S |                      d          r| j                             d          rY| j        j                             d          r:| j        j        j                             d          r| j        j        j        j        S | j                             d          rY| j        j                             d          r:| j        j        j                             d          r| j        j        j        j        S t          d          )z%Get the VAD's private memory setting.rk   r|   PrivateMemoryr}   r~   rb   z(Unable to find the private memory member)rc   rk   r|   r   r}   r~   rb   rd   re   s    r    get_private_memoryzMMVAD_SHORT.get_private_memory  s    OOD!!	:"";//	: !,,_==	:
 7$22 OOC  	:!!*--	: **?;;	:
 6?00__V$$ 	:	$$T**:IL++K88: IL*55oFF:
 y|-;; 	$$S)):IK**:66: IK(33ODD:
 y{+99GHHHr"   c                    d}|                      d          r| j        j        j        }n+|                      d          r| j        j        j        j        }	 ||         }n# t
          $ r d}Y nw xY wg }|                                D ]#\  }}||z  dk    r|                    |           $d                    |          S )z/Get the VAD's protection constants as a string.Nr}   rb   r   |)	rc   r}   r~   
Protectionrb   
IndexErroritemsappendjoin)r   protect_valueswinnt_protectionsprotectvaluenamesnamemasks           r    get_protectionzMMVAD_SHORT.get_protection5  s     ??3 	6fo0GG__V$$ 	6ik*5G	"7+EE 	 	 	EEE	 +1133 	# 	#JD$t|q  T"""xxs   A A.-A.c                 (    t          j                    S )z%Only long(er) vads have mapped files.)r   NotApplicableValuere   s    r    get_file_namezMMVAD_SHORT.get_file_nameM  s    +---r"   )Nr   )r#   r$   r%   r&   	functools	lru_cacher@   rT   rV   rR   rn   intrt   rx   rz   r   r   r   r   r'   r"   r    r)   r)   )   s7         Y&&&  '&4A A A AFF F F2E E E2A A A:G3 G G G G"E E E E E&7# 7 7 7 7H H H I  I  ID  0. . . . .r"   r)   c                       e Zd ZdZd ZdS )MMVADz}A version of the process virtual memory range structure that contains
    additional fields necessary to map files from disk.c                    t          j                    }t          j        t          j                  5  |                     d          r| j        j        j	        }n;| j
        j        j                                                            d          j	        }|j        dk    r|                                }ddd           n# 1 swxY w Y   |S )z>Get the name of the file mapped into the memory range (if any)ControlArea_FILE_OBJECTr   N)r   r   
contextlibsuppressr   r;   rc   r   FilePointerFileName
SubsectionrS   rQ   Length
get_string)r   	file_namefilename_objs      r    r   zMMVAD.get_file_nameV  s     022	 !CDD 	6 	6}-- 	#/;D
 O/;GGIIT.))  "Q&&(3355		6 	6 	6 	6 	6 	6 	6 	6 	6 	6 	6 	6 	6 	6 	6  s   BC  CCN)r#   r$   r%   r&   r   r'   r"   r    r   r   R  s-        ; ;    r"   r   c                   2    e Zd ZdZdej        j        fdZdS )EX_FAST_REFzThis is a standard Windows structure that stores a pointer to an object
    but also leverages the least significant bits to encode additional details.

    When dereferencing the pointer, we need to strip off the extra bits.
    ro   c                    t           j        | j        j        vrt	          dt           j         d          | j        j                            t           j                  d         }t          j        | j        |          sd}nd}| j        	                    |t           j        z   dz   | j        j
        | j        | z  | j        j                  S )N%Invalid symbol table name syntax (no  found)r         pointerr/   r0   r1   )r
   r6   r3   r4   
ValueErrorr5   r   r7   r8   r9   r/   Objectr1   )r   r>   max_fast_refs      r    rS   zEX_FAST_REF.dereferenceu  s    >!333O	OOO  
 !H.44Y^DDQG,T]<MNN 	LLL}##	.:x*;,."h8	 $ 
 
 	
r"   N)r#   r$   r%   r&   r   r   r   rS   r'   r"   r    r   r   n  s?         
Z/? 
 
 
 
 
 
r"   r   c                   <    e Zd ZdZdefdZdeeddf         fdZdS )DEVICE_OBJECTz"A class for kernel device objects.ro   c                 L    |                                  }|j        j        j        S )z)Get device's name from the object header.get_object_headerNameInfoNameStringr   headers     r    get_device_namezDEVICE_OBJECT.get_device_name  !    ''))#**r"   Nc              #      K   | j                                         }|r!|V  |j                                         }|dS dS )z'Enumerate the attached device's objectsN)AttachedDevicerS   r   devices     r    get_attached_devicesz"DEVICE_OBJECT.get_attached_devices  s]      $0022 	9LLL*6688F  	9 	9 	9 	9 	9r"   )	r#   r$   r%   r&   strr   r   r   r   r'   r"   r    r   r     s\        ,,+ + + + +
9it0K&L 9 9 9 9 9 9r"   r   c                   H    e Zd ZdZdefdZdeeddf         fdZde	fdZ
dS )DRIVER_OBJECTz"A class for kernel driver objects.ro   c                 L    |                                  }|j        j        j        S )z)Get driver's name from the object header.r   r   s     r    get_driver_namezDRIVER_OBJECT.get_driver_name  r   r"   Nc              #      K   | j                                         }|r!|V  |j                                        }|dS dS )z%Enumerate the driver's device objectsN)DeviceObjectrS   
NextDevicer   s     r    get_deviceszDRIVER_OBJECT.get_devices  s]      "..00 	5LLL&2244F  	5 	5 	5 	5 	5r"   c                     dS !Determine if the object is valid.Tr'   re   s    r    is_validzDRIVER_OBJECT.is_valid      tr"   )r#   r$   r%   r&   r   r   r   r   r   boolr   r'   r"   r    r   r     sw        ,,+ + + + +
5Yd'BC 5 5 5 5$      r"   r   c                   0    e Zd ZdZdefdZdefdZd ZdS )OBJECT_SYMBOLIC_LINKz A class for kernel link objects.ro   c                 L    |                                  }|j        j        j        S Nr   r   s     r    get_link_namez"OBJECT_SYMBOLIC_LINK.get_link_name  s!    ''))#**r"   c                     dS r   r'   re   s    r    r   zOBJECT_SYMBOLIC_LINK.is_valid  r   r"   c                 >    t          j        | j        j                  S r   )r   r   CreationTimeQuadPartre   s    r    get_create_timez$OBJECT_SYMBOLIC_LINK.get_create_time  s    -d.?.HIIIr"   N)	r#   r$   r%   r&   r   r   r   r   r   r'   r"   r    r   r     sd        **+s + + + +$    J J J J Jr"   r   c                   T    e Zd ZdZdefdZdeeej	        j
        f         fdZd ZdS )FILE_OBJECTz!A class for windows file objects.ro   c                     | j         j        dk    oB| j        j        | j         j        j        j                                     | j         j                  S )r   r   )r   r   r8   layersBufferr3   r1   r   re   s    r    r   zFILE_OBJECT.is_valid  sE    }#a' )DM,@M $6-

(4='
(
(	)r"   c                    t          j                    }| j        j        | j        j                                     | j                  rMt          j	        t                    5  d| j                                         }d d d            n# 1 swxY w Y   t          j	        t          t          j                  5  || j        j        z  }d d d            n# 1 swxY w Y   |S )Nz\Device\)r   UnreadableValuer8   r   r3   r1   r   r   r   r   r   r   	TypeErrorr   r;   r   r   )r   r   s     r    file_name_with_devicez!FILE_OBJECT.file_name_with_device  sT   %'' 	 = :;DDTEVWW 	J$Z00 J JID$5$E$E$G$GIIJ J J J J J J J J J J J J J J  J,NOO 	) 	)DM((D	) 	) 	) 	) 	) 	) 	) 	) 	) 	) 	) 	) 	) 	) 	) s$   !B

BB9CCCc                     | j         rdnd| j        rdndz   | j        rdndz   | j        rdndz   | j        rdndz   | j        rdndz   S )NR-WDrwd)
ReadAccessWriteAccessDeleteAccess
SharedReadSharedWriteSharedDeletere   s    r    access_stringzFILE_OBJECT.access_string  s     O,SS&/ssC1'0ssS2 o.ss30 &/ssC	1
 '0ssS2	
r"   N)r#   r$   r%   r&   r   r   r	   r   r   r   BaseAbsentValuer   r   r'   r"   r    r   r     so        ++)$ ) ) ) )uS*2F2V-V'W     	
 	
 	
 	
 	
r"   r   c                   *    e Zd ZdZdefdZdefdZdS )KMUTANTz#A class for windows mutant objects.ro   c                     dS r   r'   re   s    r    r   zKMUTANT.is_valid  r   r"   c                 L    |                                  }|j        j        j        S )z-Get the object's name from the object header.r   r   s     r    get_namezKMUTANT.get_name  r   r"   N)r#   r$   r%   r&   r   r   r   r   r'   r"   r    r   r     sP        --$    +# + + + + + +r"   r   c                   V    e Zd ZdZdefdZd Zd Zdej	        j
        fdZdefdZdS )	ETHREADz%A class for executive thread objects.ro   c                 6   	 | j         j        dz  dk    rdS | j         j        dz  dk    rdS | j         j        dk    rF|                                 }t	          |t
          j                  sdS d|j        cxk     rdk     sn dS n# t          j        $ r Y dS w xY wdS )r   r,   r   F    T)	CidUniqueThreadUniqueProcessr   
isinstancedatetimeyearr   r;   )r   ctimes     r    r   zETHREAD.is_valid  s    	x$q(A--u x%)Q..u &!++,,..!%):;; ! 5uz0000D0000 51 	 	 	55	 ts!   B B >B ,B BBc                     |                      d          r!t          j        | j        j        dz	            S t          j        | j        j                  S )NThreadsProcess   )rc   r   r   
CreateTimer   re   s    r    r   zETHREAD.get_create_time  sI    ??+,, 	Q1$/2Ja2OPPP-do.FGGGr"   c                 >    t          j        | j        j                  S r   r   r   ExitTimer   re   s    r    get_exit_timezETHREAD.get_exit_time      -dm.DEEEr"   c                 b   |                      d          r,| j                                                            d          S |                      d          rK| j                             d          r1| j        j                                                            d          S t          d          )z*Return the EPROCESS that owns this thread.r  	_EPROCESSTcbProcessz,Unable to find the owning process of ethread)rc   r  rS   rQ   r  r  rd   re   s    r    owning_processzETHREAD.owning_process  s     ??+,, 	Q&224499+FFF__U## 	Q(;(;I(F(F 	Q8#//1166{CCC !OPPPr"   c           
      ~    ddddddddd	d
	}| j         }d}|D ]}|d||         z  z  r|| dz  }|r
|d d         n|S )Nr   rH      r	  r,         r      )	 PS_CROSS_THREAD_FLAGS_TERMINATED PS_CROSS_THREAD_FLAGS_DEADTHREAD!PS_CROSS_THREAD_FLAGS_HIDEFROMDBG#PS_CROSS_THREAD_FLAGS_IMPERSONATINGPS_CROSS_THREAD_FLAGS_SYSTEM*PS_CROSS_THREAD_FLAGS_HARD_ERRORS_DISABLED*PS_CROSS_THREAD_FLAGS_BREAK_ON_TERMINATION'PS_CROSS_THREAD_FLAGS_SKIP_CREATION_MSG*PS_CROSS_THREAD_FLAGS_SKIP_TERMINATION_MSG  )CrossThreadFlags)r   dictCrossThreadFlagsflagsstringCrossThreadFlagsflags        r    get_cross_thread_flagszETHREAD.get_cross_thread_flags$  s    01011234,-:;:;78:;
 
 
 
 %!#( 	5 	5Dq0666 5&T***4& &("3B3'''	
r"   N)r#   r$   r%   r&   r   r   r   r  r   r   r   r  r   r+  r'   r"   r    r   r     s        //$    :H H HF F F
Q
 2 B 
Q 
Q 
Q 
Q
 
 
 
 
 
 
r"   r   c                   H    e Zd ZdZdej        j        fdZ ee          Z	dS )UNICODE_STRINGz.A class for Windows unicode string structures.ro   c                     | j                             | j        j                            t
          j                  d         t
          j        z   dz   | j        j        j        | j        | j	        dd          S )Nr   stringreplaceutf16)r/   r0   
max_lengtherrorsencoding)
r8   r9   r3   r4   r5   r
   r6   r   r1   r   re   s    r    r   zUNICODE_STRING.get_stringA  sf     }##H$$Y^44Q7).H8S{8;{ $ 
 
 	
r"   N)
r#   r$   r%   r&   r   r   r   r   propertyr   r'   r"   r    r-  r-  >  sF        88
J.> 
 
 
 
  Xj!!FFFr"   r-  c                      e Zd ZdZdefdZddedefdZdej	        j
        fdZdeej	        j
                 fd	Zdeej	        j
                 fd
Zdeej	        j
                 fdZd Zd Zd Zd Zd Zd Zd Zd ZdS )EPROCESSz/A class for executive kernel processes objects.ro   c                    	 t           j                            | j                  }|rt	          |          dk    s|d         dk    rdS t          |          dk    r| j        dk    sX| j        j        dk    rdS | 	                                }t          |t          j                  sdS d|j        cxk     rdk     sn dS | j        dz  dk    rdS t          | j        j        t           j                  r | j        j                            d          }n| j        j        }|dk    rdS |d	z  dk    rdS n# t"          j        $ r Y dS w xY wd
S )r   r    FSystemr,   r   r   r   i T)r   utilityarray_to_stringImageFileNamelenr   UniqueProcessIdr
  r   r   r  r  r  PcbDirectoryTableBaseArrayrQ   r   r;   )r   r   r  dtbs       r    r   zEPROCESS.is_validW  s~   %	?2243EFFD 3t99>>T!W->->u II))d.Ba.G.G?+q00 5,,..!%):;; ! 5uz0000D0000 5 #a'1,,u $(5w}EE 2h166yAAh1axxu V|q  u !
 1 	 	 	55	 ts7   AD3 	.D3 9.D3 )D3 ?D3 AD3 '	D3 3EENconfig_prefixpreferred_namec                    | j         j        | j        j                 }t	          |t
          j                  st          d          d}t	          | j        j	        t          j                  r | j        j	                            d          }n| j        j	        }|d|j        z  dz
  z  }|| j        j        d| j         z   }|                     | j         |||          S )zAConstructs a new layer based on the process's DirectoryTableBase.zJParent layer is not a translation layer, unable to construct process layerr   zunsigned long longrH   N_Process)r8   r   r3   r/   r  r   Intelr   r@  rA  r   rB  rQ   bits_per_registerr?  _add_process_layer)r   rD  rE  parent_layerrC  s        r    add_process_layerzEPROCESS.add_process_layer  s     }+DH,?@,44 	\  
 dh17=AA 	.(-223GHHCC(-Ca<99Q>?!!X03Td>R3T3TTN &&M3~
 
 	
r"   c                    t           j        | j        j        vrt	          dt           j         d          |                                 }| j        j        |         }|                    | j	                  s$t          j        || j	        d| j	        d          |                                 }| j                            | t           j         d|| j	                  }|S )zConstructs a PEB objectr   r   zInvalid Peb address at 0x_PEBr/   r0   )r
   r6   r3   r4   r   rL  r8   r   r   Pebr   r;   get_symbol_table_namer9   )r   proc_layer_name
proc_layer	sym_tablepebs        r    get_pebzEPROCESS.get_peb  s    >!333O	OOO   0022])/:
""48,, 	4+RTX+R+R+R   ..00	m"".)....&8 # 
 

 
r"   c              #      K   	 |                                  }|j        j                            |                                  t
          j         dd          D ]}|V  dS # t          j        $ r Y dS w xY w)z6Generator for DLLs in the order that they were loaded._LDR_DATA_TABLE_ENTRYInLoadOrderLinksN)	rW  LdrInLoadOrderModuleListto_listrR  r
   r6   r   r;   r   rV  entrys      r    load_order_moduleszEPROCESS.load_order_modules  s      	,,..C6>>--//VVVV"    	 
 1 	 	 	44	   AA" "A54A5c              #      K   	 |                                  }|j        j                            |                                  t
          j         dd          D ]}|V  dS # t          j        $ r Y dS w xY w)z:Generator for DLLs in the order that they were initializedrY  InInitializationOrderLinksN)	rW  r[  InInitializationOrderModuleListr]  rR  r
   r6   r   r;   r^  s      r    init_order_moduleszEPROCESS.init_order_modules  s      	,,..C@HH--//VVVV,    	 
 1 	 	 	44	ra  c              #      K   	 |                                  }|j        j                            |                                  t
          j         dd          D ]}|V  dS # t          j        $ r Y dS w xY w)z:Generator for DLLs in the order that they appear in memoryrY  InMemoryOrderLinksN)	rW  r[  InMemoryOrderModuleListr]  rR  r
   r6   r   r;   r^  s      r    mem_order_moduleszEPROCESS.mem_order_modules  s      	,,..C8@@--//VVVV$    	 
 1 	 	 	44	ra  c                 2   	 |                      d          r&| j                             d          r| j        j        S nH# t          j        $ r6 t
                              t          j        d| j	        j
        d           Y nw xY wt          j                    S )NObjectTableHandleCountz3Cannot access _EPROCESS.ObjectTable.HandleCount at rI   )rc   rk  rl  r   r;   rJ   rK   r
   rL   r3   r0   r   r   re   s    r    get_handle_countzEPROCESS.get_handle_count  s    		}-- 8#..}== 8+771 	 	 	JJ&ZdhoZZZ    	 (***s   :> ABBc                 n   	 |                      d          r| j        dk    rt          j                    S |                                 }| j        j        | j        j                 j	        d         }| j        
                    || j        j        || j        j                  }|                    d| j        d          }|                     d          r|j        S nH# t          j        $ r6 t                              t"          j        d	| j        j        d
           Y nw xY wt          j                    S )NSessionr   kernel_virtual_offsetr   _MM_SESSION_SPACET)object_typer0   absolute	SessionIdz-Cannot access _EPROCESS.Session.SessionId at rI   )rc   ro  r   r   rR  r8   r   r3   r1   configmoduler9   rt  r   r;   rJ   rK   r
   rL   r0   r   )r   r>   kvontkrnlmpsessions        r    get_session_idzEPROCESS.get_session_id  sI   	y)) -<1$$$7999$($>$>$@$@!m*48+EFM+  =//%#x9&*h&@	 0   #// 3DLSW *   %%k22 -",,1 	 	 	JJ&TTTT    	 (***s   2C B%C AD! D!c                 >    t          j        | j        j                  S r   )r   r   r
  r   re   s    r    r   zEPROCESS.get_create_time  s    -do.FGGGr"   c                 >    t          j        | j        j                  S r   r  re   s    r    r  zEPROCESS.get_exit_time  r  r"   c                     |                      d          r| j        S |                      d          r| j        S t          d          )NWow64ProcessWoW64ProcesszUnable to find Wow64Process)rc   r~  r  rd   re   s    r    get_wow_64_processzEPROCESS.get_wow_64_process  sK    ??>** 	%$$__^,, 	%$$:;;;r"   c                 \    	 |                                  }n# t          $ r Y dS w xY w|rdS dS )NFT)r  rd   )r   r   s     r    get_is_wow64zEPROCESS.get_is_wow64  sP    	++--EE 	 	 	55	  	4us    
%%c                    | j                             d          r| j         j        S | j                             d          r| j         j                                        S | j                                                             d          S )NBalancedRootRootrG   )VadRootrc   r  r  rS   rQ   re   s    r    get_vad_rootzEPROCESS.get_vad_root%  sz    <"">22 		=<,, \$$V,, 	=<$00222 <++--228<<<r"   c              #   `  K   | j         }|                                 }	 |                                 j        j        }	 |                                 j        j        }n.# t          $ r! |                                 j        j        }Y nw xY w|j        |         	                    ||          
                    dd                              d          dd         }n# t          j        $ r Y dS w xY w|D ]8}|                    d          }|d|         }||dz   d         }	|r|	r||	fV  9dS )	zGenerator for environment variables.

        The PEB points to our env block - a series of null-terminated
        unicode strings. Each string cannot be more than 0x7FFF chars.
        End of the list is a quad-null.
        z	utf-16-ler0  )r3  r9  Nr%  =rH   )r8   rL  rW  ProcessParametersEnvironmentEnvironmentSizerd   r   r   readr:   r5   r   r;   find)
r   contextprocess_spaceblock
block_sizeenvarsenvarsplit_indexenvvars
             r    environment_variableszEPROCESS.environment_variables2  s_      -..00	LLNN4@EE!\\^^=M

! E E E!\\^^=D


E }-eZ((I66vss$ F 1 	 	 	FF	  	 	E**S//K%Ca))*C  s 3hs5   C A C (BC BAC C0/C0)NN)r#   r$   r%   r&   r   r   r   rL  r   r   r   rW  r   r`  re  ri  rm  rz  r   r  r  r  r  r  r'   r"   r    r7  r7  T  sn       99*$ * * * *X
 
s 
3 
 
 
 
6+;    2HZ-?-O$P    HZ-?-O$P    8J,>,N#O    + + ++ + +>H H HF F F< < <	 	 	= = =! ! ! ! !r"   r7  c                       e Zd ZdZ	 	 	 ddededededee         d	eej	        j
                 fd
Zd	eej	        j
                 fdZdS )
LIST_ENTRYz+A class for double-linked lists on Windows.TNsymbol_typememberforwardsentinellayerro   c              #     K   |p| j         j        }| j        j                            |                              |          }d}|rd}| j        j        |         }	 |                    | j         j                  }	|	sdS t          | |          
                                }
n# t          j        $ r Y dS w xY w|s9| j                            ||| j         j        |z
  |p| j         j                  V  | j         j        h}|
j         j        |vr|
j         j        |z
  }|                    |          sdS | j                            ||||p| j         j                  }|V  |                    |
j         j                   	 t          |
|          
                                }
n# t          j        $ r Y dS w xY w|
j         j        |vdS dS )z/Returns an iterator of the entries in the list.BlinkFlinkN)r0   r1   )r3   r/   r8   symbol_spaceget_typerelative_child_offsetr   r   r0   getattrrS   r   r;   r9   r1   rO   )r   r  r  r  r  r  relative_offset	directiontrans_layerr   linkseen
obj_offsetobjs                 r    r]  zLIST_ENTRY.to_listY  s"      ,,-4==
 



'
' 	 	 	 Im*51	"++DHO<<H t4++7799DD1 	 	 	44	  	-&&x8"'"E48+E	 '       hoT))?:J''
33 t-&&!"'"E48+E	 '  C IIIHHTX_%%%tY//;;==5   tt% hoT))))))s*   !B" ?"B" "B54B5"F% %F87F8c                 j    |                      | j        j        j        j        | j        j                  S r   )r]  r3   parentr4   member_namere   s    r    __iter__zLIST_ENTRY.__iter__  s%    ||DHO/948;OPPPr"   )TTN)r#   r$   r%   r&   r   r   r   r   r   r   r   r]  r  r'   r"   r    r  r  V  s        55 #; ;; ; 	;
 ; }; 
*$4	5; ; ; ;zQ(:#5#EF Q Q Q Q Q Qr"   r  c                   0    e Zd ZdZdee         fdZd ZdS )TOKENz"A class for process etoken object.ro   c           	   #     K   | j         dk     r| j        j        }| j        j        |         j        d         }|                                 }| j                            |||          }|                    d| j	        
                                j                            d          |z
  |                    d          | j                   }|D ]+}	 |j        
                                                    d          }| d	S |j        d
z  dk    s|j        d
k    r d	S d}|j        j        D ]}	|	}|                    d|j        j        j        |z
  |                    d          t+          |j                            }
dd                    d |j        |ft/          |
          z   D                       z   V  # t0          j        $ r) t4                              t8          j        d           Y 'w xY wd	S d	S )z)Yield a sid for the current token object.i  rp  rP  arrayr0   _SID_AND_ATTRIBUTES)rr  r0   subtypecount_SIDNr   rH   r#  zunsigned longzS-r   c              3   4   K   | ]}t          |          V  d S r   )r   ).0is     r    	<genexpr>z!TOKEN.get_sids.<locals>.<genexpr>  s9       * *#$A* * * * * *r"   z3InvalidAddressException while parsing for token sid)UserAndGroupCountr3   r/   r8   r   ru  rR  rv  r9   UserAndGroupsrS   getr  SidrQ   RevisionSubAuthorityCountIdentifierAuthorityValueSubAuthorityr0   r   r   tupler   r;   rJ   rK   r
   LOGLEVEL_VVVV)r   r/   rw  symbol_tablerx  r  sid_and_attrsidid_authr  r  s              r    get_sidszTOKEN.get_sids  sY      !F**,J-&z29:QRC5577L}++C ,  H %OO#)5577;??IICO ))*?@@,	 ,  M !.  &*6688==fEEC{#tt|c)Q..#2G"2L2L#tt G 4: $ $"##+??$+"/3:S@ ( 1 1/ B B!#"788	 $3 $ $L  * *),w(?%BUBU(U* * * " "      "9   JJ!/M    E +* s   .F>F>BF>>4G65G6c           	   #     K   	 t          d          D ]a}|t          | j        j        d|z  z            t          | j        j        d|z  z            t          | j        j        d|z  z            fV  bdS # t          $ r | j        dk     r| j                                        	                    d| j        | j
        j        |                                                              d                    D ]0}|j        dz  dk    }|j        dz  dk    }|j        j        d	||fV  1Y dS t"                              t&          j        d
           Y dS w xY w)z9Return a list of privileges for the current token object.@   r  i   r  _LUID_AND_ATTRIBUTES)r  r  r   rH   TzBroken Token Privileges.N)ranger   
PrivilegesPresentEnabledEnabledByDefaultrd   PrivilegeCountrS   rQ   r8   r  rR  r  
AttributesLuidr   rJ   rK   r
   r  )r   
priv_indexluidenableddefaults        r    
privilegeszTOKEN.privileges  s     	P#Bii  
0AzMBCC0AzMBCC9Q
]KLL	       	P 	P 	P"T)) O7799>>- M62244h566 ?   
D 
DD #o1Q6G"o1Q6G)+T7GCCCCC
D 
D 
D 

924NOOOOOO	Ps   A1A7 7B/E)%EEN)r#   r$   r%   r&   r   r   r  r  r'   r"   r    r  r    sN        ,,)(3- ) ) ) )VP P P P Pr"   r  c                   *    e Zd ZdZdefdZdefdZdS )KTHREADz)A class for thread control block objects.ro   c           
      r    ddddddddd	d
	}|                     | j        t          j                              S )NInitializedReadyRunningStandby
TerminatedWaiting
TransitionDeferredReadyGateWait)	r   rH   r  r	  r,   r  r  r   r  )r  Stater   r   )r   	dictStates     r    	get_statezKTHREAD.get_state  sJ    

 

	 }}TZ)E)G)GHHHr"   c                 <   i ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdI}|                     | j        t          j                              S )JNr   	ExecutiverH   FreePager  PageInr	  PoolAllocationr,   DelayExecutionr  	Suspendedr  UserRequestr   WrExecutiver  
WrFreePage	   WrPageIn
   WrPoolAllocation   WrDelayExecutionr-   WrSuspended   WrUserRequest   WrEventPairr   WrQueue   WrLpcReceive   
WrLpcReply   WrVirtualMemory   	WrPageOut   WrRendezvous   Spare2   Spare3   Spare4   Spare5   Spare6   WrKernel   
WrResource   
WrPushLock   WrMutex   WrQuantumEnd   WrDispatchIntr   WrPreempted!   WrYieldExecutionWrFastMutexWrGuardedMutex	WrRundownMaximumWaitReason)"   #   $   %   )r  
WaitReasonr   r   )r   dictWaitReasons     r    get_wait_reasonzKTHREAD.get_wait_reason  s   '
{'
z'
 x'
 	'

 '
 {'
 }'
 }'
 |'
 z'
 "'
 "'
 '
 '
 '
  	!'
" #'
 '
$ %'
& !''
( )'
* +'
, -'
. /'
0 1'
2 3'
4 5'
6 
7'
8 9'
: ;'
< 	='
> ?'
@ A'
B C'
D "E'
 '
F  #M'
 '
 '
P !!$/93O3Q3QRRRr"   N)r#   r$   r%   r&   r   r  r0  r'   r"   r    r  r    s\        33I3 I I I I)S )S )S )S )S )S )Sr"   r  c                       e Zd ZdZdZedz
  ZdefdZdej	        j
        fdZdedej	        j
        fdZdeeeeef                  fd	Zd
S )CONTROL_AREAz$A class for _CONTROL_AREA structures   rH   ro   c                     	 | j         j        | j        j        k    rdS | j         j        | j         j        | j        z  k    rdS n# t          j        $ r Y dS w xY wdS )r   FT)	Segmentr   r3   r0   SizeOfSegmentTotalNumberOfPtes	PAGE_SIZEr   r;   re   s    r    r   zCONTROL_AREA.is_valid(  s}    	|'48?::u |).?  u 1 	 	 	55	 ts   A "A AAc                     | j                             |                                 t          j        z   dz   | j        j        | j        j        | j        j        z   | j        j	                  S )zNGet the Subsection object, which is found immediately after the _CONTROL_AREA._SUBSECTIONr   )
r8   r9   rR  r
   r6   r3   r/   r0   sizer1   re   s    r    get_subsectionzCONTROL_AREA.get_subsection?  s^     }##&&((9>9MIx*8?TX]2"h8	 $ 
 
 	
r"   r0   c                     | j                             |                                 t          j        z   dz   | j        j        || j        j                  S )z(Get a PTE object at the requested offset_MMPTEr   )r8   r9   rR  r
   r6   r3   r/   r1   )r   r0   s     r    get_ptezCONTROL_AREA.get_pteI  sQ     }##&&((9>9HDx*"h8	 $ 
 
 	
r"   c              #   4  K   |                                  }| j        j                            |t          j        z   dz             }|j        }|                                 }t          j	        | j        |          }| j        j
        | j        j                 j                            dd          }|dk    ra	 |j        | j        j        k    rdS n# t"          j        $ r Y dS w xY w|j        }|dz  }d}	|	|j        k     r|j        ||	z  z   }
||	dz  z   }	 |                     |
          }n# t"          j        $ r |	dz  }	Y Nw xY w|j        j        j        dk    r!|j        j        j        dz  }||| j        fV  n{|j        j        j        dk    r.|s+|s)|j        j        j        d	z  |j        j        j         d
z  z  }n8|j        j!        j"        dk    r#|j        j!        j        dz  dz  }||| j        fV  |	dz  }	|	|j        k     |j#        }|dk    _dS dS )zGet the available pages that correspond to a cached file.

        The tuples generated are (physical_offset, file_offset, page_size).
        r>  paeFr   i   r3  rH   r-   r   r	  l    N)$rR  r8   r  r  r
   r6   r;  r<  r   r7   r   r3   r/   metadatar  r   r0   r   r;   StartingSectorPtesInSubsectionSubsectionBaser?  r}   HardValidPageFrameNumberr8  Soft	PrototypeSubsectSubsectionAddressHighSubsectionAddressLowTransr  NextSubsection)r   r>   
mmpte_type
mmpte_size
subsectionis_64bitis_paestarting_sectorsubsection_offsetptecount
pte_offsetfile_offsetmmpte
physoffsets                 r    get_available_pagesz CONTROL_AREA.get_available_pagesS  s~     
 !6688]/88	.9
 

  _
((**
0@QRR%dh&9:CGGuUU Aoo)TX_<<E =5    )7O /% 7 HZ888'6*x:OP
/(V2CC LL44EE!9   MHH 7<%**!&!=!CJ$k4>AAAAAW\+q00# HF H!GOAQF"W_AQF-H)
 W]-22
 #('-"?="QVX!XJ$k4>AAAA AC Z888H $2Ji Aoooooos$   8C C#"C#D, ,EEN)r#   r$   r%   r&   r8  	PAGE_MASKr   r   r   r   r   r<  r   r?  r   r   r\  r'   r"   r    r2  r2  "  s        ..IAI$    .

 2 B 
 
 
 

c 
j&8&H 
 
 
 
C3XeCcM.B%C C3 C3 C3 C3 C3 C3r"   r2  c                   "    e Zd ZdZdZdefdZdS )VACBzA class for _VACB structuresl      ro   c                 4    | j         j        j        | j        z  S r   )Overlay
FileOffsetr   FILEOFFSET_MASKre   s    r    get_file_offsetzVACB.get_file_offset  s     |&/$2FFFr"   N)r#   r$   r%   r&   rc  r   rd  r'   r"   r    r_  r_    sA        &&(OG G G G G G Gr"   r_  c                       e Zd ZdZdZdZdZdeez   z  ZdZde	fdZ
	 dd
ej        j        dededee         def
dZdej        j        defdZdefdZd	S )SHARED_CACHE_MAPz(A class for _SHARED_CACHE_MAP structuresi   r  r   rH      ro   c                     | j         j        dk    s| j        j        dk    rdS | j        j        dk     s*| j         j        | j        j        k     r| j        j        dk    rdS dS )r   r   Fl    T)FileSizer   ValidDataLengthSectionSizere   s    r    r   zSHARED_CACHE_MAP.is_valid  sl     =!Q&&$*>*G1*L*L5$q((]#d&:&CCC%.2DDD5tr"   Narray_pointerlevellimit	vacb_listc                 v   |g }||k    rg S |                                  }| j        j                            |t          j        z   dz             }| j                            |t          j        z   dz   | j        j        || j	        |          }t          d| j	                  D ]}||         s||                                                             |t          j        z   dz             }	|	j        | j        j        k    r|                     |	|           t|                     ||         |dz   ||          }|S )aU  Recursively process the sparse multilevel VACB index array.

        :param array_pointer: The address of a possible index array
        :param level: The current level
        :param limit: The level where we abandon all hope. Ideally this is 7
        :param vacb_list: An array of collected VACBs
        :return: Collected VACBs
        Nr   r  rr  r/   r0   r  r  r   _VACBrH   )rR  r8   r  r  r
   r6   r9   r3   r/   
VACB_ARRAYr  rS   rQ   SharedCacheMapr0   	save_vacbprocess_index_array)
r   rl  rm  rn  ro  r>   pointer_type
vacb_arraycountervacb_objs
             r    rv  z$SHARED_CACHE_MAP.process_index_array  sU    I5==I 6688}1::	.:
 

 ])))IN:WDx* /  * 
 

 Q00 	 	Gg&  7#').87BCC 
 &$(/99x3333 !44w'E9 		 r"   rz  c                     t          |j                  t          |                                          | j        f}|                    |           d S r   )r   BaseAddressrd  
VACB_BLOCKr   )r   rz  ro  datas       r    ru  zSHARED_CACHE_MAP.save_vacb  sO    $%%((**++O

 	r"   c                 2   g }| j         j        }|| j        z  }|| j        z  }d}||k     r|dk    r| j        |         }t	          j        t          j                  5  |j        | j	        j
        k    r|                     ||           ddd           n# 1 swxY w Y   |dz  }||k     r|dk    |dk    r>|dk     r8| j        |         }|j        | j	        j
        k    r|                     ||           | j        }|s|S | j        d         j	        j
        |k    r|S |                                 }| j        j                            |t"          j        z   dz             }|j        }	|| j        k    se|}
t+          d|          D ]}| j                            |t"          j        z   dz   | j	        j        |
||	z  z             }|sB|                                                    |t"          j        z   dz             }|j        | j	        j
        k    r|                     ||           |dk    r| j                            |t"          j        z   dz   | j	        j        |
|dz   |	z  z             }|s|S |                                                    |t"          j        z   dz             }|j        | j	        j
        k    r|                     ||           |S t5          j        t5          j        |d                    }|| j        z
  | j        z  }t5          j        |          }|}|| j        k    r| j                            |t"          j        z   d	z   | j	        j        || j        |
          }t+          d| j                  D ]}||         s||                                                             |t"          j        z   dz             }|j        | j	        j
        k    r|                     ||           t|                      ||         d||          }|S )zGet the available pages that correspond to a cached file.

        The lists generated are (virtual_offset, file_offset, page_size).
        r   r,   NrH   r   rP  rr  r  r  rq  )!rk  r   r}  InitialVacbsr   r   r   r;   rt  r3   r0   ru  VacbsrR  r8   r  r  r
   r6   r;  VACB_SIZE_OF_FIRST_LEVELr  r9   r/   rS   rQ   mathceilrK   VACB_OFFSET_SHIFTVACB_LEVEL_SHIFTrs  rv  )r   ro  section_sizefull_blocks	left_overitervalrz  r>   rw  size_of_pointer
array_headry  
vacb_entryvacblevel_depthlimit_depthrx  s                    r    r\  z$SHARED_CACHE_MAP.get_available_pages  s   
 	'0 #do5 4?2	 $$;!+;+;(1H$Z%GHH 8 8*dho==NN8Y7778 8 8 8 8 8 8 8 8 8 8 8 8 8 8 qLG $$;!+;+; MMa(1H&$(/99x333
 :  	
 Q#*h66 !6688}1::	.:
 
 '+d;;;!J K00 4 4!]11%	6B#x2%?)BC 2  
 " !--//44%	6@  &$(/99NN43331}}!]11%	6B#x2%'A+)HI 2  
 " %$$!--//44%	6@  &$(/99NN4333  iq 9 9::"T%;;t?TTi,,!$777---	>H8.o$ .  J !DO44  !'*  w' []]T+in<wFGG 
 &$(/99NN43333
 !% 8 8"7+QY! !II s   ,BBBr   )r#   r$   r%   r&   r}  r  r  r  rs  r   r   r   r   r   r   r   r   rv  ru  r\  r'   r"   r    rf  rf    s       22J %69I%IJJ$    & %)5 5!)95 5 	5
 D>5 
5 5 5 5n*"4"D QU    GT G G G G G Gr"   rf  );collections.abccollectionsr   r  r   loggingr  typingr   r   r   r   r   r   r	   volatility3.frameworkr
   r   r   r   r   r   (volatility3.framework.interfaces.objectsr   volatility3.framework.layersr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   r   r   	getLoggerr#   rJ   
StructTyper   r)   r   r   ExecutiveObjectr   r   r   r   r   r   r-  GenericIntelProcessr7  abcr  r  r  r2  r_  rf  r'   r"   r    <module>r     s  
                N N N N N N N N N N N N N N N N N N                E D D D D D . . . . . . 6 6 6 6 6 6 1 1 1 1 1 1 K K K K K K K K K K		8	$	$7 7 7 7 77% 7 7 7f. f. f. f. f.'$ f. f. f.R	    K   8
 
 
 
 
'$ 
 
 
89 9 9 9 9G&(< 9 9 9     G&(<   (J J J J J7-t/C J J J"
 "
 "
 "
 "
'$d&: "
 "
 "
J
+ 
+ 
+ 
+ 
+g $"6 
+ 
+ 
+L
 L
 L
 L
 L
g $"6 L
 L
 L
^" " " " "W' " " ",    w*D,@   DAQ AQ AQ AQ AQ#[_%= AQ AQ AQHHP HP HP HP HPG HP HP HPV:S :S :S :S :Sg  :S :S :Szt3 t3 t3 t3 t37% t3 t3 t3n	G 	G 	G 	G 	G7 	G 	G 	G] ] ] ] ]w) ] ] ] ] ]r"   