
    [
#g                        d dl Zd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	m
Z
mZmZmZmZ d dlmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	l m!Z!  ejD                  e#      Z$ G d
 dejJ                        Z& G d dejJ                        Z' G d de'      Z( G d dejJ                        Z) G d dejJ                  e!jT                        Z+ G d dejJ                  e!jT                        Z, G d dejJ                  e!jT                        Z- G d dejJ                  e!jT                        Z. G d dejJ                  e!jT                        Z/ G d dejJ                  e!jT                        Z0 G d dejJ                        Z1 G d  d!ejJ                        Z2 G d" d#ejf                  e!jT                        Z4 G d$ d%ejJ                  ejj                  j                        Z6 G d& d'ejJ                        Z7 G d( d)ejJ                        Z8 G d* d+ejJ                        Z9 G d, d-ejJ                        Z: G d. d/ejJ                        Z; G d0 d1ejJ                        Z<y)2    N)	GeneratorIterableIteratorListOptionalTupleUnion)	constants
exceptions
interfacesobjects	rendererssymbols)ObjectInterface)intel)utility)
conversion)generic)poolc                       e Zd ZdZd Zy)KSYSTEM_TIMEz8A system time structure that stores a high and low part.c                 d    | j                   dz  | j                  z  }t        j                  |      S )N    )	High1TimeLowPartr   wintime_to_datetime)selfwintimes     k/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/__init__.pyget_timezKSYSTEM_TIME.get_time%   s*    >>R'4<<7--g66    N)__name__
__module____qualname____doc__r     r!   r   r   r   "   s
    B7r!   r   c                       e Zd ZdZ ej
                  d      d        ZddZd Zd Z	d Z
d	efd
Zd	efdZd	efdZd Zd Zed        Zd Zd Zy)MMVAD_SHORTzA class that represents process virtual memory ranges.

    Each instance is a node in a binary tree structure and is pointed to
    by VadRoot.
    N)maxsizec                    | j                   j                  }| j                   j                  j                  t        j
                        d   }t        j                  | j                  |      s|dz  }n|dz  }	 | j                  j                  |t        j
                  z   dz   | j                   j                  || j                   j                  d      }|j                         S # t        j                  $ r Y y t        $ r Y y w xY w)Nr         bytes)
layer_nameoffsetnative_layer_namelength)volr/   	type_namesplitr
   BANGr   symbol_table_is_64bit_contextobjectr.   r0   decoder   InvalidAddressExceptionUnicodeDecodeError)r   vad_addresssymbol_table_namebytesobjs       r   get_tagzMMVAD_SHORT.get_tag1   s    hhoo !HH..44Y^^DQG,,T]]<MN1K2K	}}++!INN2W<88..""&(("<"< , H ??$$11 	! 		s   9A+C% %D:DDc           	   #   ~  K   |dkD  r/t         j                  t        j                  d       t	        d      |
t               }| j                  j                  }||v r%t         j                  t        j                  d       y|j                  |       | j                         }|dv rd}n`||j                  d      rd	}nJ|d
k(  rd}nBt         j                  t        j                  d| j                  j                   d| d|        y|r| j                  |      }| 	 | j                         j                         j                  ||dz         D ]  }|  	 	 | j%                         j                         j                  ||dz         D ]  }|  y# t        j                   $ r<}t         j                  t        j                  d|j"                  d       Y d}~d}~ww xY w# t        j                   $ r<}t         j                  t        j                  d|j"                  d       Y d}~yd}~ww xY ww)zTraverse the VAD tree, determining each underlying VAD node type by
        looking up the pool tag for the structure and then casting into a new
        object.d   z+Vad tree is too deep, something went wrong!zVad tree is too deepNzVAD node already seen!)VadSVadF_MMVAD_SHORTVad_MMVADr   zSkipping VAD at z depth z
 with tag    zInvalid address on LeftChild: #xzInvalid address on RightChild: )volloglogr
   LOGLEVEL_VVVRuntimeErrorsetr2   r/   addr?   
startswithcastget_left_childdereferencetraverser   r:   invalid_addressget_right_child)	r   visiteddepthr<   tagtarget
vad_objectvad_nodeexcps	            r   rS   zMMVAD_SHORT.traverseL   s
     3;JJ&&(U 566?eGhhoo'!JJy--/GHK lln""#F_!6FaZ F JJ&&"488??"375'C5Q 6*J		##%113<<WeaiP   Q		$$&224==guqyQ   R 11 	JJ&&01E1Eb0IJ 	 11 	JJ&&1$2F2Fr1JK 	sZ   DH=":F H=:G+ H=G(,2G#H=#G((H=+H:>2H50H=5H::H=c                    | j                  d      r| j                  S | j                  d      r| j                  S | j                  d      rb| j                  j                  d      r| j                  j                  S | j                  j                  d      r| j                  j                  S | j                  d      r| j                  j                  d      r| j                  j                  j                  d      r | j                  j                  j                  S | j                  j                  j                  d      r | j                  j                  j                  S t        d      )zGet the right child member.
RightChildRightVadNodeCorez%Unable to find the right child member)
has_memberr^   r_   r`   ra   AttributeErrorr   s    r   rU   zMMVAD_SHORT.get_right_child   s
    ??<(??"__W%:: __Y'||&&|4||...||&&w/||))) __V$yy##I.99$$//=99,,77799$$//899,,222DEEr!   c                    | j                  d      r| j                  S | j                  d      r| j                  S | j                  d      rb| j                  j                  d      r| j                  j                  S | j                  j                  d      r| j                  j                  S | j                  d      r| j                  j                  d      r| j                  j                  j                  d      r | j                  j                  j                  S | j                  j                  j                  d      r | j                  j                  j                  S t        d      )zGet the left child member.	LeftChildLeftr`   ra   z$Unable to find the left child member)rb   rf   rg   r`   ra   rc   rd   s    r   rQ   zMMVAD_SHORT.get_left_child   s    ??;'>>!__V$99__Y'||&&{3||---||&&v.||((( __V$yy##I.99$$//<99,,66699$$//799,,111CDDr!   c                 8   | j                  d      r| j                  S | j                  d      r4| j                  j                  d      r| j                  j                  dz  S | j                  d      rr| j                  j                  d      r#| j                  j                  j                  dz  S | j                  j                  d      r| j                  j                  dz  S | j                  d      r| j
                  j                  j                  d      r-| j
                  j                  j                  j                  dz  S | j
                  j                  j                  d      r#| j
                  j                  j                  dz  S t        d      )zGet the VAD's parent member.Parentu1r`   ParentValuera   z Unable to find the parent member)rb   ri   rj   r`   rl   ra   rc   rd   s    r   
get_parentzMMVAD_SHORT.get_parent   s2    ??8$;; __T"tww'9'9('C77>>D(( __Y'||&&t,||--44((7||//$66 __V$yy  ++D1yy((++22T99""--m<yy((44t;;?@@r!   returnc                    | j                  d      r?| j                  d      r| j                  dz  | j                  dz  z  S | j                  dz  S | j                  d      rg| j                  j                  d      r3| j                  j                  dz  | j                  j                  dz  z  S | j                  j                  dz  S t	        d      )zWGet the VAD's starting virtual address. This is the first accessible byte in the range.StartingVpnStartingVpnHighr,   ,   ra   z&Unable to find the starting VPN member)rb   rp   rq   ra   rc   rd   s    r   	get_startzMMVAD_SHORT.get_start   s     ??=)01((B.43G3G23MNN''2--__V$yy##$56		--3		8Q8QUW8WXXyy,,22EFFr!   c                    | j                  d      rK| j                  d      r%| j                  dz   dz  | j                  dz  z  dz
  S | j                  dz   dz  dz
  S | j                  d      rs| j                  j                  d      r9| j                  j                  dz   dz  | j                  j                  dz  z  dz
  S | j                  j                  dz   dz  dz
  S t	        d      )zTGet the VAD's ending virtual address. This is the last accessible byte in the range.	EndingVpnEndingVpnHighrG   r,   rr   ra   z$Unable to find the ending VPN member)rb   ru   rv   ra   rc   rd   s    r   get_endzMMVAD_SHORT.get_end   s     ??;'/..1,38J8Jb8PQUVVV!+2a77__V$yy##O4ii))A-"49P9PTV9VW  ,,q0R71<<CDDr!   c                 J    | j                         | j                         z
  dz   S )z@Get the size of the VAD region. The OS ensures page granularity.rG   )rw   rs   rd   s    r   get_sizezMMVAD_SHORT.get_size  s    !11Q66r!   c                    | j                  d      r;| j                  j                  d      r | j                  j                  j                  S | j                  d      r;| j                  j                  d      r | j                  j
                  j                  S | j                  d      r*| j                  j                  j                  j                  S t        d      )z7Get the VAD's commit charge (number of committed pages)rj   	VadFlags1uVadFlagsra   z'Unable to find the commit charge member)rb   rj   r{   CommitCharger|   r}   ra   rc   rd   s    r   get_commit_chargezMMVAD_SHORT.get_commit_charge  s     ??4 TWW%7%7%D77$$111__S!dff&7&7
&C66??///__V$99<<))666FGGr!   c                 d   | j                  d      r`| j                  j                  d      rE| j                  j                  j                  d      r | j                  j                  j                  S | j                  d      r`| j                  j                  d      rE| j                  j
                  j                  d      r | j                  j
                  j                  S | j                  d      r2| j                  j                  d      r~| j                  j                  j                  d      rY| j                  j                  j                  j                  d      r*| j                  j                  j                  j                  S | j                  j                  d      r~| j                  j                  j                  d      rY| j                  j                  j
                  j                  d      r*| j                  j                  j
                  j                  S t        d      )z%Get the VAD's private memory setting.rj   r{   PrivateMemoryr|   r}   ra   z(Unable to find the private memory member)rb   rj   r{   r   r|   r}   ra   rc   rd   s    r   get_private_memoryzMMVAD_SHORT.get_private_memory  sp    OOD!"";/!!,,_=77$$222 OOC !!*-**?;66??000__V$		$$T*IILL++K8IILL**55oFyy||--;;; 		$$S)IIKK**:6IIKK((33ODyy{{++999GHHr!   c                     | j                  d      r | j                  j                  j                  S | j                  d      r*| j                  j                  j                  j                  S y )Nr|   ra   )rb   r|   r}   
Protectionra   rd   s    r   r   zMMVAD_SHORT.Protection6  sK    ??366??---__V$99;;''222r!   c                     | j                   }	 ||   }g }|j                         D ]  \  }}||z  dk7  s|j                  |       ! dj	                  |      S # t        $ r d}Y Rw xY w)z/Get the VAD's protection constants as a string.r   |)r   
IndexErroritemsappendjoin)r   protect_valueswinnt_protectionsprotectvaluenamesnamemasks           r   get_protectionzMMVAD_SHORT.get_protection?  sx     //	"7+E +113JD$t|q T" 4 xx  	E	s   A A&%A&c                 *    t        j                         S )z%Only long(er) vads have mapped files.)r   NotApplicableValuerd   s    r   get_file_namezMMVAD_SHORT.get_file_nameQ  s    ++--r!   )Nr   )r"   r#   r$   r%   	functools	lru_cacher?   rS   rU   rQ   rm   intrs   rw   ry   r   r   propertyr   r   r   r&   r!   r   r(   r(   *   s     Y& '4AFF2E2A:G3 G"E E&7# 7H ID  $.r!   r(   c                       e Zd ZdZd Zy)MMVADz}A version of the process virtual memory range structure that contains
    additional fields necessary to map files from disk.c                    t        j                         }t        j                  t        j
                        5  | j                  d      r!| j                  j                  j                  }nG| j                  j                  j                  j                         j                  d      j                  }|j                  dkD  r|j                         }ddd       |S # 1 sw Y   |S xY w)z>Get the name of the file mapped into the memory range (if any)ControlArea_FILE_OBJECTr   N)r   r   
contextlibsuppressr   r:   rb   r   FilePointerFileName
SubsectionrR   rP   Length
get_string)r   	file_namefilename_objs      r   r   zMMVAD.get_file_nameZ  s     002	  !C!CD 	6}-#//;;DD
 OO//;;GGIT.)X  ""Q&(335		6  !	6  s   BCC%N)r"   r#   r$   r%   r   r&   r!   r   r   r   V  s    ;r!   r   c                   D    e Zd ZdZdej
                  j                  fdZy)EX_FAST_REFzThis is a standard Windows structure that stores a pointer to an object
    but also leverages the least significant bits to encode additional details.

    When dereferencing the pointer, we need to strip off the extra bits.
    rn   c                    t         j                  | j                  j                  vrt	        dt         j                   d      | j                  j                  j                  t         j                        d   }t        j                  | j                  |      sd}nd}| j                  j                  |t         j                  z   dz   | j                  j                  | j                  | z  | j                  j                        S )N%Invalid symbol table name syntax (no  found)r         pointerr.   r/   r0   )r
   r5   r2   r3   
ValueErrorr4   r   r6   r7   r8   r.   Objectr0   )r   r=   max_fast_refs      r   rR   zEX_FAST_REF.dereferencey  s    >>!3!337	7GwO 
 !HH..44Y^^DQG,,T]]<MNLL}}##	.:xx**;;,."hh88	 $ 
 	
r!   N)r"   r#   r$   r%   r   r   r   rR   r&   r!   r   r   r   r  s    
Z//?? 
r!   r   c                   4    e Zd ZdZdefdZdeeddf   fdZy)DEVICE_OBJECTz"A class for kernel device objects.rn   c                 b    | j                         }|j                  j                  j                  S )z)Get device's name from the object header.get_object_headerNameInfoNameStringr   headers     r   get_device_namezDEVICE_OBJECT.get_device_name  &    '')##***r!   Nc              #      K   | j                   j                         }|r"| |j                   j                         }|r!yyw)z'Enumerate the attached device's objectsN)AttachedDevicerR   r   devices     r   get_attached_devicesz"DEVICE_OBJECT.get_attached_devices  s;     $$002L**668F    =A A)	r"   r#   r$   r%   strr   r   r   r   r&   r!   r   r   r     s)    ,+ +
9it0K&L 9r!   r   c                   @    e Zd ZdZdefdZdeeddf   fdZde	fdZ
y)DRIVER_OBJECTz"A class for kernel driver objects.rn   c                 b    | j                         }|j                  j                  j                  S )z)Get driver's name from the object header.r   r   s     r   get_driver_namezDRIVER_OBJECT.get_driver_name  r   r!   Nc              #      K   | j                   j                         }|r"| |j                  j                         }|r!yyw)z%Enumerate the driver's device objectsN)DeviceObjectrR   
NextDevicer   s     r   get_deviceszDRIVER_OBJECT.get_devices  s;     ""..0L&&224F r   c                      y!Determine if the object is valid.Tr&   rd   s    r   is_validzDRIVER_OBJECT.is_valid      r!   )r"   r#   r$   r%   r   r   r   r   r   boolr   r&   r!   r   r   r     s5    ,+ +
5Yd'BC 5$ r!   r   c                   .    e Zd ZdZdefdZdefdZd Zy)OBJECT_SYMBOLIC_LINKz A class for kernel link objects.rn   c                 b    | j                         }|j                  j                  j                  S Nr   r   s     r   get_link_namez"OBJECT_SYMBOLIC_LINK.get_link_name  s&    '')##***r!   c                      yr   r&   rd   s    r   r   zOBJECT_SYMBOLIC_LINK.is_valid  r   r!   c                 T    t        j                  | j                  j                        S r   )r   r   CreationTimeQuadPartrd   s    r   get_create_timez$OBJECT_SYMBOLIC_LINK.get_create_time  s    --d.?.?.H.HIIr!   N)	r"   r#   r$   r%   r   r   r   r   r   r&   r!   r   r   r     s#    *+s +$ Jr!   r   c                   `    e Zd ZdZdefdZdeeej                  j                  f   fdZd Zy)FILE_OBJECTz!A class for windows file objects.rn   c                     | j                   j                  dkD  xrd | j                  j                  | j                   j                  j
                  j                     j                  | j                   j                        S )r   r   )r   r   r7   layersBufferr2   r0   r   rd   s    r   r   zFILE_OBJECT.is_valid  s\    }}##a' )DMM,@,@MM  $$66-

(4==''
(	)r!   c                    t        j                         }| j                  j                  | j                  j
                     j                  | j                        r?t        j                  t              5  d| j                  j                          }d d d        t        j                  t        t        j                        5  || j                  j                   z  }d d d        |S # 1 sw Y   UxY w# 1 sw Y   |S xY w)Nz\Device\)r   UnreadableValuer7   r   r2   r0   r   r   r   r   r   r   	TypeErrorr   r:   r   r   )r   r   s     r   file_name_with_devicez!FILE_OBJECT.file_name_with_device  s    %%' 	 == : :;DDTEVEVW$$Z0 J#D$5$5$E$E$G#HIJ   J,N,NO 	)DMM(((D	) J J	) s   4C&C2&C/2C<c                     | j                   rdnd| j                  rdndz   | j                  rdndz   | j                  rdndz   | j                  rdndz   | j
                  rdz   S dz   S )NR-WDrwd)
ReadAccessWriteAccessDeleteAccess
SharedReadSharedWriteSharedDeleterd   s    r   access_stringzFILE_OBJECT.access_string  s     OOS&&sC1''sS2 oos30 &&sC	1
 ''s2	
 .12	
r!   N)r"   r#   r$   r%   r   r   r	   r   r   r   BaseAbsentValuer   r   r&   r!   r   r   r     s8    +)$ )uS*2F2F2V2V-V'W  	
r!   r   c                   (    e Zd ZdZdefdZdefdZy)KMUTANTz#A class for windows mutant objects.rn   c                      yr   r&   rd   s    r   r   zKMUTANT.is_valid  r   r!   c                 b    | j                         }|j                  j                  j                  S )z-Get the object's name from the object header.r   r   s     r   get_namezKMUTANT.get_name  r   r!   N)r"   r#   r$   r%   r   r   r   r   r&   r!   r   r   r     s    -$ +# +r!   r   c                   h    e Zd ZdZdefdZd Zd Zdej                  j                  fdZdefdZy)	ETHREADz%A class for executive thread objects.rn   c                 d   	 | j                   j                  dz  dk7  ry| j                   j                  dz  dk7  ry| j                   j                  dk7  rC| j                         }t	        |t
        j
                        syd|j                  cxk  rdk  sy yy# t        j                  $ r Y yw xY w)r   r+   r   F  i  T)	CidUniqueThreadUniqueProcessr   
isinstancedatetimeyearr   r:   )r   ctimes     r   r   zETHREAD.is_valid  s    	xx$$q(A- xx%%)Q. &&!+,,.!%):):; uzz0D0  1  	 11 		s(   B B AB  B B B/.B/c                     | j                  d      r,t        j                  | j                  j                  dz	        S t        j                  | j                  j                        S )NThreadsProcess   )rb   r   r   
CreateTimer   rd   s    r   r   zETHREAD.get_create_time  sJ    ??+,11$//2J2Ja2OPP--doo.F.FGGr!   c                 T    t        j                  | j                  j                        S r   r   r   ExitTimer   rd   s    r   get_exit_timezETHREAD.get_exit_time      --dmm.D.DEEr!   c                 J   | j                  d      r)| j                  j                         j                  d      S | j                  d      rN| j                  j                  d      r3| j                  j
                  j                         j                  d      S t        d      )z*Return the EPROCESS that owns this thread.r	  	_EPROCESSTcbProcessz,Unable to find the owning process of ethread)rb   r	  rR   rP   r  r  rc   rd   s    r   owning_processzETHREAD.owning_process  s~     ??+,&&22499+FF__U#(;(;I(F88##//166{CC !OPPr!   c           
      ~    ddddddddd	d
	}| j                   }d}|D ]  }|d||   z  z  s|| dz  } |r|d d S |S )Nr   rG      r
  r+         r      )	 PS_CROSS_THREAD_FLAGS_TERMINATED PS_CROSS_THREAD_FLAGS_DEADTHREAD!PS_CROSS_THREAD_FLAGS_HIDEFROMDBG#PS_CROSS_THREAD_FLAGS_IMPERSONATINGPS_CROSS_THREAD_FLAGS_SYSTEM*PS_CROSS_THREAD_FLAGS_HARD_ERRORS_DISABLED*PS_CROSS_THREAD_FLAGS_BREAK_ON_TERMINATION'PS_CROSS_THREAD_FLAGS_SKIP_CREATION_MSG*PS_CROSS_THREAD_FLAGS_SKIP_TERMINATION_MSG  )CrossThreadFlags)r   dictCrossThreadFlagsflagsstringCrossThreadFlagsflags        r   get_cross_thread_flagszETHREAD.get_cross_thread_flags(  s    01011234,-:;:;78:;
 
 %%!#(Dq0666&TF!*4& ) & #3B'	
 (	
r!   N)r"   r#   r$   r%   r   r   r   r  r   r   r   r  r   r,  r&   r!   r   r   r     sC    /$ :HF
Q
 2 2 B B 
Q
 
r!   r   c                   T    e Zd ZdZdej
                  j                  fdZ ee      Z	y)UNICODE_STRINGz.A class for Windows unicode string structures.rn   c                 8   | j                   j                  | j                  j                  j	                  t
        j                        d   t
        j                  z   dz   | j                  j                  j                  | j                  | j                  dd      S )Nr   stringreplaceutf16)r.   r/   
max_lengtherrorsencoding)
r7   r8   r2   r3   r4   r
   r5   r   r0   r   rd   s    r   r   zUNICODE_STRING.get_stringE  st     }}##HH$$Y^^4Q7)..H8S{{88;;{{ $ 
 	
r!   N)
r"   r#   r$   r%   r   r   r   r   r   r   r&   r!   r   r.  r.  B  s)    8
J..>> 
  j!Fr!   r.  c                       e Zd ZdefdZy)	ERESOURCErn   c                    t         j                  dt        | j                  j                                | j
                  j                  | j                  j                     j                  | j                  j                        sy| j                         }| j                  dk(  xs | j
                  j                  | j                  j                     j                  | j                  j                  j                  | j
                  j                  j                  |t        j                  z   dz         j                        }	 |xr | j                   j"                  d uxr | j                   j$                  d uxr | j                   j"                  | j                   j$                  k7  xr | j                   j"                  j$                  | j                  j                  k(  xrH | j                   j$                  j"                  | j                  j                  k(  xr | j&                  dk(  S # t(        j*                  $ r Y yw xY w)NzChecking ERESOURCE Validity: Fr   _KSEMAPHORE)rI   debughexr2   r/   r7   r   r.   r   get_symbol_table_nameSharedWaiterssymbol_spaceget_typer
   r5   sizeSystemResourcesListFlinkBlinkNumberOfSharedWaitersr   r:   )r   	sym_tablewaiters_valids      r   r   zERESOURCE.is_validY  s   4S5I4JKL}}##DHH$7$78AA$((//R..0	**a/ 
4==3G3GHH4

(""))MM&&//INN*]:d	
 		 4,,22$>4,,22$>4 ,,22d6N6N6T6TT4 ,,2288DHHOOK	4
 ,,2288DHHOOK4 ..!3 11 		s   C'H- -IIN)r"   r#   r$   r   r   r&   r!   r   r7  r7  X  s    $ r!   r7  c                   @   e Zd ZdZdefdZddedefdZdej                  j                  fdZdeej                  j                     fd	Zdeej                  j                     fd
Zdeej                  j                     fdZd Zd Zd Zd Zd Zd Zd Zd Zy)EPROCESSz/A class for executive kernel processes objects.rn   c                    	 t         j                  j                  | j                        }|rt	        |      dk(  s|d   dk(  ryt        |      dk(  r| j                  dk(  s| j                  j                  dk(  ry| j                         }t        |t        j                        syt        j                  j                         j                  }d|j                  cxk  r|dz   k  sy y| j                         }t        |t        j                        r!d|j                  cxk  r|dz   k  sy y||kD  ry| j                  dz  dk7  ryt        | j                  j                   t         j"                        r&| j                  j                   j%                  d      }n| j                  j                   }|dk(  ry|d	z  dk(  ryd
}| j&                  }|j(                  |k  s|j*                  |k  ry	 y# t,        j.                  $ r Y yw xY w)r   r    FSystemr+   r   
   r   i l        T)r   r   array_to_stringImageFileNamelenr   UniqueProcessIdr  r   r   r  r  nowr  r  PcbDirectoryTableBaseArrayrP   ThreadListHeadrB  rC  r   r:   )r   r   r  current_yearetimedtbkernel	list_heads           r   r   zEPROCESS.is_valid{  s   5	??2243E3EFD3t9>T!W-> I)d.B.Ba.G??++q0 ,,.!%):):; '00446;;uzz=L2,==  > **,eX%6%67 5::Ar0AA$ B$ u}$ ##a'1, $((55w}}Ehh1166yAhh11ax V|q   F++I'9??V+C ,D  11 		sW   AG/ 6G/ ;*G/ &A G/ 'G/ )AG/ ,G/ .G/ 4G/ A/G/ 7G/  ,G/ /HHNconfig_prefixpreferred_namec                 4   | j                   j                  | j                  j                     }t	        |t
        j                        st        d      d}t	        | j                  j                  t        j                        r&| j                  j                  j                  d      }n| j                  j                  }|d|j                  z  dz
  z  }|&| j                  j                  d| j                   z   }| j                  | j                   |||      S )zAConstructs a new layer based on the process's DirectoryTableBase.zJParent layer is not a translation layer, unable to construct process layerr   unsigned long longrG   _Process)r7   r   r2   r.   r  r   Intelr   rR  rS  r   rT  rP   bits_per_registerrP  _add_process_layer)r   r[  r\  parent_layerrX  s        r   add_process_layerzEPROCESS.add_process_layer  s     }}++DHH,?,?@,4\ 
 dhh117==A((--223GHC((--Ca<999Q>?!!XX00Xd>R>R=S3TTN &&MM3~
 	
r!   c                    t         j                  | j                  j                  vrt	        dt         j                   d      | j                         }| j                  j                  |   }|j                  | j                        s/t        j                  || j                  d| j                  d      | j                         }| j                  j                  | t         j                   d|| j                        }|S )zConstructs a PEB objectr   r   zInvalid Peb address at 0x_PEBr.   r/   )r
   r5   r2   r3   r   rd  r7   r   r   Pebr   r:   r<  r8   )r   proc_layer_name
proc_layerrE  pebs        r   get_pebzEPROCESS.get_peb  s    >>!3!337	7GwO  002]]))/:
""488,44-DTXXbM+R  ..0	mm""k)..).&88 # 

 
r!   c              #      K   	 | j                         }|j                  j                  j                  | j	                          t
        j                   dd      D ]  }|  y# t        j                  $ r Y yw xY ww)z6Generator for DLLs in the order that they were loaded._LDR_DATA_TABLE_ENTRYInLoadOrderLinksN)	rm  LdrInLoadOrderModuleListto_listr<  r
   r5   r   r:   r   rl  entrys      r   load_order_moduleszEPROCESS.load_order_modules  sv     	,,.C66>>--/00@@UV" 	
 11 		)   A>A A% $A>%A;8A>:A;;A>c              #      K   	 | j                         }|j                  j                  j                  | j	                          t
        j                   dd      D ]  }|  y# t        j                  $ r Y yw xY ww)z:Generator for DLLs in the order that they were initializedro  InInitializationOrderLinksN)	rm  rq  InInitializationOrderModuleListrs  r<  r
   r5   r   r:   rt  s      r   init_order_moduleszEPROCESS.init_order_modules  sv     	,,.C@@HH--/00@@UV, 	
 11 		rw  c              #      K   	 | j                         }|j                  j                  j                  | j	                          t
        j                   dd      D ]  }|  y# t        j                  $ r Y yw xY ww)z:Generator for DLLs in the order that they appear in memoryro  InMemoryOrderLinksN)	rm  rq  InMemoryOrderModuleListrs  r<  r
   r5   r   r:   rt  s      r   mem_order_moduleszEPROCESS.mem_order_modules  sv     	,,.C88@@--/00@@UV$ 	
 11 		rw  c                    	 | j                  d      r1| j                  j                  d      r| j                  j                  S t        j                         S # t        j                  $ rR t
        j                  t        j                  d| j                  j                  d       Y t        j                         S w xY w)NObjectTableHandleCountz3Cannot access _EPROCESS.ObjectTable.HandleCount at rH   )rb   r  r  r   r:   rI   rJ   r
   rK   r2   r/   r   r   rd   s    r   get_handle_countzEPROCESS.get_handle_count  s    		}-##..}=++777 ((** 11 	JJ&&EdhhooVXEYZ
 ((**	s   AA AB=<B=c                    	 | j                  d      r| j                  dk(  rt        j                         S | j	                         }| j
                  j                  | j                  j                     j                  d   }| j
                  j                  || j                  j                  || j                  j                        }|j                  d| j                  d      }|j                  d      r|j                  S t        j(                         S # t        j                  $ rR t        j!                  t"        j$                  d	| j                  j&                  d
       Y t        j(                         S w xY w)NSessionr   kernel_virtual_offsetr   _MM_SESSION_SPACET)object_typer/   absolute	SessionIdz-Cannot access _EPROCESS.Session.SessionId at rH   )rb   r  r   r   r<  r7   r   r2   r0   configmoduler8   r  r   r:   rI   rJ   r
   rK   r/   r   )r   r=   kvontkrnlmpsessions        r   get_session_idzEPROCESS.get_session_id   sE   	y)<<1$$7799$($>$>$@!mm**488+E+EFMM+  ==//%#xx99&*hh&@&@	 0  #// 3DLLSW *  %%k2",,, ((** 11 	JJ&&?PR?ST
 ((**	s   3D CD AE;:E;c                 T    t        j                  | j                  j                        S r   )r   r   r  r   rd   s    r   r   zEPROCESS.get_create_time?  s    --doo.F.FGGr!   c                 T    t        j                  | j                  j                        S r   r  rd   s    r   r  zEPROCESS.get_exit_timeB  r  r!   c                     | j                  d      r| j                  S | j                  d      r| j                  S t        d      )NWow64ProcessWoW64ProcesszUnable to find Wow64Process)rb   r  r  rc   rd   s    r   get_wow_64_processzEPROCESS.get_wow_64_processE  s>    ??>*$$$__^,$$$:;;r!   c                 J    	 | j                         }|ryy# t        $ r Y yw xY w)NFT)r  rc   )r   r   s     r   get_is_wow64zEPROCESS.get_is_wow64N  s4    	++-E   		s    	""c                 4   | j                   j                  d      r| j                   j                  S | j                   j                  d      r$| j                   j                  j	                         S | j                   j	                         j                  d      S )NBalancedRootRootrF   )VadRootrb   r  r  rR   rP   rd   s    r   get_vad_rootzEPROCESS.get_vad_rootY  sq    <<"">2<<,,, \\$$V,<<$$0022 <<++-228<<r!   c              #   V  K   | j                   }| j                         }	 | j                         j                  j                  }	 | j                         j                  j
                  }|j                  |   j                  ||      j                  dd      j                  d      dd }|D ],  }|j                  d      }|d| }||dz   d }	|s$|	s'||	f . y# t        $ r' | j                         j                  j                  }Y w xY w# t        j                  $ r Y yw xY ww)	zGenerator for environment variables.

        The PEB points to our env block - a series of null-terminated
        unicode strings. Each string cannot be more than 0x7FFF chars.
        End of the list is a quad-null.
        z	utf-16-ler1  )r4  rJ  Nr&  =rG   )r7   rd  rm  ProcessParametersEnvironmentEnvironmentSizerc   r   r   readr9   r4   r   r:   find)
r   contextprocess_spaceblock
block_sizeenvarsenvarsplit_indexenvvars
             r   environment_variableszEPROCESS.environment_variablesf  s$     --..0	LLN44@@EE!\\^==MM
 }-eZ(I6vs$  E**S/K%Ca)*C s3h  	' " E!\\^==DD
E 11 		sY   D)$D $C )AD +%D)D)	D)-D
D DD D&#D)%D&&D))NN)r"   r#   r$   r%   r   r   r   rd  r   r   r   rm  r   rv  r{  r  r  r  r   r  r  r  r  r  r&   r!   r   rH  rH  x  s    9:$ :x
s 
3 
6++;; 2HZ-?-?-O-O$P HZ-?-?-O-O$P 8J,>,>,N,N#O ++>HF<	=!r!   rH  c                       e Zd ZdZ	 	 	 ddededededee   deej                  j                     fd	Zdeej                  j                     fd
Zy)
LIST_ENTRYz+A class for double-linked lists on Windows.Nsymbol_typememberforwardsentinellayerrn   c              #   R  K   |xs | j                   j                  }| j                  j                  j	                  |      j                  |      }d}|rd}| j                  j                  |   }	 |j                  | j                   j                        }	|	syt        | |      j                         }
|sP| j                  j                  ||| j                   j                  |z
  |xs | j                   j                         | j                   j                  h}|
j                   j                  |vr|
j                   j                  |z
  }|j                  |      sy| j                  j                  ||||xs | j                   j                        }| |j                  |
j                   j                         	 t        |
|      j                         }
|
j                   j                  |vryy# t        j                  $ r Y yw xY w# t        j                  $ r Y yw xY ww)z/Returns an iterator of the entries in the list.rC  rB  N)r/   r0   )r2   r.   r7   r>  r?  relative_child_offsetr   r   r/   getattrrR   r   r:   r8   r0   rN   )r   r  r  r  r  r  relative_offset	directiontrans_layerr   linkseen
obj_offsetobjs                 r   rs  zLIST_ENTRY.to_list  s     ,,,--44==



' 	 	Imm**51	"++DHHOO<H4+779D --&&xx8"'"E488+E+E	 '    hhooT)?:J''
3--&&!"'"E488+E+E	 ' C IHHTXX__%tY/;;=# hhooT) 11 		< 55 sa   A.H'1'G5 H'G5 3DH' H H'3H'5HH'
HH'H$!H'#H$$H'c                     | j                  | j                  j                  j                  j                  | j                  j                        S r   )rs  r2   parentr3   member_namerd   s    r   __iter__zLIST_ENTRY.__iter__  s1    ||DHHOO//99488;O;OPPr!   )TTN)r"   r#   r$   r%   r   r   r   r   r   r   r   rs  r  r&   r!   r   r  r    s    5 #;; ; 	;
 ; }; 
*$$44	5;zQ(:#5#5#E#EF Qr!   r  c                   (    e Zd ZdZdee   fdZd Zy)TOKENz"A class for process etoken object.rn   c           	   #   N  K   | j                   dk  r| j                  j                  }| j                  j                  |   j
                  d   }| j                         }| j                  j                  |||      }|j                  d| j                  j                         j                  j                  d      |z
  |j                  d      | j                         }|D ]   }	 |j                  j                         j                  d      }| y	|j                  d
z  dk7  s|j                   d
kD  r y	d}|j"                  j$                  D ]  }	|	} |j                  d|j&                  j                  j(                  |z
  |j                  d      t+        |j                               }
ddj-                  d |j                  |ft/        |
      z   D              z     y	y	# t0        j2                  $ r( t4        j7                  t8        j:                  d       Y @w xY ww)z)Yield a sid for the current token object.i  r  rh  arrayr/   _SID_AND_ATTRIBUTES)r  r/   subtypecount_SIDNr   rG   r$  zunsigned longzS-r   c              3   2   K   | ]  }t        |        y wr   )r   ).0is     r   	<genexpr>z!TOKEN.get_sids.<locals>.<genexpr>  s      *#$A*s   z3InvalidAddressException while parsing for token sid)UserAndGroupCountr2   r.   r7   r   r  r<  r  r8   UserAndGroupsrR   getr?  SidrP   RevisionSubAuthorityCountIdentifierAuthorityValueSubAuthorityr/   r   r   tupler   r:   rI   rJ   r
   LOGLEVEL_VVVV)r   r.   r  symbol_tabler  r  sid_and_attrsidid_authr  r  s              r   get_sidszTOKEN.get_sids  s     !!F*,,J--&&z299:QRC557L}}++C , H %OO#))557;;??ICO ))*?@,,	 , M !.&**668==fEC{#||c)Q.#2G2G"2L# G 44::"# ;#+??$+"//33::S@ ( 1 1/ B!#"7"78	 $3 $L  *),w(?%BU(U* "  % !. +D "99 JJ!//MsC   C#H%&+G'H%!G'4H%6B,G'"H%'7H"H%!H""H%c           	   #     K   	 t        d      D ]s  }|t        | j                  j                  d|z  z        t        | j                  j                  d|z  z        t        | j                  j
                  d|z  z        f u y# t        $ r | j                  dk  r| j                  j                         j                  d| j                  | j                  j                  | j                            j                  d            D ]B  }|j                  dz  dk7  }|j                  dz  dk7  }|j                  j                   d	||f D Y yt"        j%                  t&        j(                  d
       Y yw xY ww)z9Return a list of privileges for the current token object.@   r  i   r  _LUID_AND_ATTRIBUTES)r  r  r   rG   TzBroken Token Privileges.N)ranger   
PrivilegesPresentEnabledEnabledByDefaultrc   PrivilegeCountrR   rP   r7   r>  r<  r?  
AttributesLuidr   rI   rJ   r
   r  )r   
priv_indexluidenableddefaults        r   
privilegeszTOKEN.privileges  sL    	P#Bi
00AzMBC00AzMBC99Q
]KL	  (  	P""T) OO779>>-- MM66224h56 ? D #oo1Q6G"oo1Q6G))++T7GCC 

9224NO	Ps6   E9BB E9CE6E9$E63E95E66E9N)r"   r#   r$   r%   r   r   r  r  r&   r!   r   r  r    s    ,)(3- )VPr!   r  c                   8    e Zd ZdZdddZd Zd Zd Zd Zd	 Z	y
)KTIMERzA class for Kernel TimersTimerNotificationObjectTimerSynchronizationObject)r  	   c                 2    | j                   j                  ryy)NYesr   )HeaderSignalStaterd   s    r   get_signaledzKTIMER.get_signaled!  s    ;;""r!   c                 4   | j                         }| j                  j                  j                  |t        j
                  z   dz         }| j                  j                  || j                  j                  | j                  j                  j                        S )zKReturns the encoded DPC since it may not look like a pointer after encodingr   r  r.   r/   )r<  r7   r>  r?  r
   r5   r8   r2   r.   Dpcr/   )r   r=   pointer_types      r   get_raw_dpczKTIMER.get_raw_dpc&  s{     668}}11::	.:
 }}##$xx**88<<&& $ 
 	
r!   c                 F    | j                   j                  | j                  v S r   )r  TypeVALID_TYPESrd   s    r   
valid_typezKTIMER.valid_type3  s    {{4#3#333r!   c                 v    dj                  | j                  j                  | j                  j                        S )Nz{0:#010x}:{1:#010x})formatDueTimeHighPartr   rd   s    r   get_due_timezKTIMER.get_due_time6  s)    $++DLL,A,A4<<CWCWXXr!   c                 \   | j                         }| j                  j                  | j                  j                     j
                  d   }| j                  j                  || j                  j                  || j                  j                        }|j                  d      r~|j                  d      rl|j                  d|j                  d      j                        }|j                  d|j                  d      j                        }|dz  }t        j                  | j                         |z  |      }| j                  j                  | j                  j                     j                  | j                  j                        }t        j                   ||z        }||z  }	| j                         }| j                  j"                  j%                  |t&        j(                  z   dz         }
| j                  j                  |
| j                  j*                  |		      S | j,                  S )
z0Return Dpc, and if Windows 7 or later, decode itr  r   KiWaitNeverKiWaitAlwaysr^  )r  r/      _KDPCr  )r<  r7   r   r2   r0   r  r  
has_symbolr8   
get_symboladdressr   rolr  canonicalizer/   bswap_64r>  r?  r
   r5   r.   r  )r   r=   r  r  
wait_neverwait_alwayslow_byteru  swap_xordpc	kdpc_types              r   get_dpczKTIMER.get_dpc9  s    668mm""488#=#=>EE#
 ==''xx11"hh88	 ( 
 }-(2E2En2U!0**=9AA ) J #//0**>:BB * K
 #d*HKK 0 0 2Z ?JE}}++DHH,F,FGTTH $$UX%56E+%C $ : : <22;;!INN2W<I ==''%88.. (   88Or!   N)
r"   r#   r$   r%   r  r  r  r  r  r  r&   r!   r   r  r    s.    # %'K


4Y*r!   r  c                   (    e Zd ZdZdefdZdefdZy)KTHREADz)A class for thread control block objects.rn   c           
      v    ddddddddd	d
	}|j                  | j                  t        j                               S )NInitializedReadyRunningStandby
TerminatedWaiting
TransitionDeferredReadyGateWait)	r   rG   r  r
  r+   r  r  r   r  )r  Stater   r   )r   	dictStates     r   	get_statezKTHREAD.get_statei  sD    

	 }}TZZ)E)E)GHHr!   c                 @   i ddddddddd	d
dddddddddddddddddddddd d!d"i d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdI}|j                  | j                  t        j                               S )JNr   	ExecutiverG   FreePager  PageInr
  PoolAllocationr+   DelayExecutionr  	Suspendedr  UserRequestr   WrExecutiver  
WrFreePager  WrPageInrL  WrPoolAllocation   WrDelayExecutionr,   WrSuspended   WrUserRequest   WrEventPairr   WrQueue   WrLpcReceive   
WrLpcReply   WrVirtualMemory   	WrPageOut   WrRendezvous   Spare2   Spare3   Spare4   Spare5   Spare6   WrKernel   
WrResource   
WrPushLock   WrMutex   WrQuantumEnd   WrDispatchIntr   WrPreempted!   WrYieldExecutionWrFastMutexWrGuardedMutex	WrRundownMaximumWaitReason)"   #   $   %   )r  
WaitReasonr   r   )r   dictWaitReasons     r   get_wait_reasonzKTHREAD.get_wait_reasonw  s   '
{'
z'
 x'
 	'

 '
 {'
 }'
 }'
 |'
 z'
 "'
 "'
 '
 '
 '
  	!'
" #'
$ %'
& !''
( )'
* +'
, -'
. /'
0 1'
2 3'
4 5'
6 
7'
8 9'
: ;'
< 	='
> ?'
@ A'
B C'
D "E'
F  #M'
P !!$//93O3O3QRRr!   N)r"   r#   r$   r%   r   r(  rj  r&   r!   r   r  r  f  s!    3I3 I)S )Sr!   r  c                       e Zd ZdZdZedz
  ZdefdZdej                  j                  fdZdedej                  j                  fdZdeeeeef      fd	Zy
)CONTROL_AREAz$A class for _CONTROL_AREA structures   rG   rn   c                    	 | j                   j                  | j                  j                  k7  ry| j                   j                  | j                   j
                  | j                  z  k7  ry	 y# t        j                  $ r Y yw xY w)r   FT)	Segmentr   r2   r/   SizeOfSegmentTotalNumberOfPtes	PAGE_SIZEr   r:   rd   s    r   r   zCONTROL_AREA.is_valid  sw    	||''488??: ||))..?  	 11 		s   -A- :A- -BBc                 *   | j                   j                  | j                         t        j                  z   dz   | j
                  j                  | j
                  j                  | j
                  j                  z   | j
                  j                        S )zNGet the Subsection object, which is found immediately after the _CONTROL_AREA._SUBSECTIONr   )
r7   r8   r<  r
   r5   r2   r.   r/   r@  r0   rd   s    r   get_subsectionzCONTROL_AREA.get_subsection  sl     }}##&&(9>>9MIxx**88??TXX]]2"hh88	 $ 
 	
r!   r/   c                     | j                   j                  | j                         t        j                  z   dz   | j
                  j                  || j
                  j                        S )z(Get a PTE object at the requested offset_MMPTEr   )r7   r8   r<  r
   r5   r2   r.   r0   )r   r/   s     r   get_ptezCONTROL_AREA.get_pte  sW     }}##&&(9>>9HDxx**"hh88	 $ 
 	
r!   c              #     K   | j                         }| j                  j                  j                  |t        j
                  z   dz         }|j                  }| j                         }t        j                  | j                  |      }| j                  j                  | j                  j                     j                  j                  dd      }|dk7  r	 |j                  | j                  j                   k7  ry	 |j&                  }|dz  }d}	|	|j(                  k  rc|j*                  ||	z  z   }
||	dz  z   }	 | j-                  |
      }|j.                  j0                  j2                  dk(  r5|j.                  j0                  j4                  dz  }||| j6                  f n|j.                  j8                  j:                  dk(  rL|s|s|j.                  j<                  j>                  d	z  |j.                  j<                  j@                  d
z  z  }nZ|j.                  jB                  jD                  dk(  r7|j.                  jB                  j4                  dz  dz  }||| j6                  f |	dz  }	|	|j(                  k  rc|jF                  }|dk7  ryy# t"        j$                  $ r Y yw xY w# t"        j$                  $ r	 |	dz  }	Y w xY ww)zGet the available pages that correspond to a cached file.

        The tuples generated are (physical_offset, file_offset, page_size).
        rw  paeFr   i   rm  rG   r,   r   r
  l    N)$r<  r7   r>  r?  r
   r5   r@  ru  r   r6   r   r2   r.   metadatar  r   r/   r   r:   StartingSectorPtesInSubsectionSubsectionBaserx  r|   HardValidPageFrameNumberrr  Soft	PrototypeSubsectSubsectionAddressHighSubsectionAddressLowTransr#  NextSubsection)r   r=   
mmpte_type
mmpte_size
subsectionis_64bitis_paestarting_sectorsubsection_offsetptecount
pte_offsetfile_offsetmmpte
physoffsets                 r   get_available_pagesz CONTROL_AREA.get_available_pages  s|    
 !668]]//88	.9

  __
((*
00@QR%%dhh&9&9:CCGGuU Ao))TXX__< = )77O /% 7 HZ888'66*x:OP
/(V2CC LL4E 77<<%%*!&!=!=!CJ$k4>>AAWW\\++q0#F!GGOOAAQF"WW__AAQF-H)
 WW]]--2
 #(''--"?"?="QVX!XJ$k4>>AA AC Z888H $22Ji Ao 55 $ "99 MHs[   CK#J 9?K9J/ 
D5KKKJ,)K+J,,K/KK
KKN)r"   r#   r$   r%   rr  	PAGE_MASKr   r   r   r   r   ru  r   rx  r   r   r  r&   r!   r   rl  rl    st    .IAI$ .

 2 2 B B 

c 
j&8&8&H&H 
C3XeCcM.B%C C3r!   rl  c                        e Zd ZdZdZdefdZy)VACBzA class for _VACB structuresl      rn   c                 \    | j                   j                  j                  | j                  z  S r   )Overlay
FileOffsetr   FILEOFFSET_MASKrd   s    r   get_file_offsetzVACB.get_file_offset  s%     ||&&//$2F2FFFr!   N)r"   r#   r$   r%   r  r   r  r&   r!   r   r  r    s    &(OG Gr!   r  c                       e Zd ZdZdZdZdZdeez   z  ZdZde	fdZ
	 dd
ej                  j                  dededee   def
dZdej                  j                  defdZdefdZy	)SHARED_CACHE_MAPz(A class for _SHARED_CACHE_MAP structuresi   rA  r   rG      rn   c                 *   | j                   j                  dk  s| j                  j                  dk  ry| j                  j                  dk  sF| j                   j                  | j                  j                  k  r| j                  j                  dk7  ryy)r   r   Fl    T)FileSizer   ValidDataLengthSectionSizerd   s    r   r   zSHARED_CACHE_MAP.is_valid/  sy     ==!!Q&$*>*>*G*G1*L$$q(]]##d&:&:&C&CC%%..2DDr!   Narray_pointerlevellimit	vacb_listc                    |g }||kD  rg S | j                         }| j                  j                  j                  |t        j
                  z   dz         }| j                  j                  |t        j
                  z   dz   | j                  j                  || j                  |      }t        d| j                        D ]  }||   s	||   j                         j                  |t        j
                  z   dz         }	|	j                  | j                  j                  k(  r| j                  |	|       u| j!                  ||   |dz   ||      } |S )aU  Recursively process the sparse multilevel VACB index array.

        :param array_pointer: The address of a possible index array
        :param level: The current level
        :param limit: The level where we abandon all hope. Ideally this is 7
        :param vacb_list: An array of collected VACBs
        :return: Collected VACBs
        r   r  r  r.   r/   r  r  r   _VACBrG   )r<  r7   r>  r?  r
   r5   r8   r2   r.   
VACB_ARRAYr  rR   rP   SharedCacheMapr/   	save_vacbprocess_index_array)
r   r  r  r  r  r=   r  
vacb_arraycountervacb_objs
             r   r  z$SHARED_CACHE_MAP.process_index_array=  s>    I5=I 668}}11::	.:

 ]])))INN:WDxx** //  * 

 Q0Gg& 7#')..87BC 
 &&$((//9x3 !44w'E9	 1" r!   r  c                     t        |j                        t        |j                               | j                  f}|j	                  |       y r   )r   BaseAddressr  
VACB_BLOCKr   )r   r  r  datas       r   r  zSHARED_CACHE_MAP.save_vacbt  s?    $$%((*+OO

 	r!   c                 V	   g }| j                   j                  }|| j                  z  }|| j                  z  }d}||k  r|dk  r| j                  |   }t	        j
                  t        j                        5  |j                  | j                  j                  k(  r| j                  ||       ddd       |dz  }||k  r|dk  r|dkD  rI|dk  rD| j                  |   }|j                  | j                  j                  k(  r| j                  ||       | j                  }|s|S | j                  d   j                  j                  |k(  r|S | j                         }| j                  j                  j!                  |t"        j$                  z   dz         }|j&                  }	|| j(                  kD  s|}
t+        d|      D ]  }| j                  j-                  |t"        j$                  z   dz   | j                  j.                  |
||	z  z         }|sR|j1                         j3                  |t"        j$                  z   dz         }|j                  | j                  j                  k(  s| j                  ||        |dkD  r| j                  j-                  |t"        j$                  z   dz   | j                  j.                  |
dz   |	z  z         }|s|S |j1                         j3                  |t"        j$                  z   dz         }|j                  | j                  j                  k(  r| j                  ||       |S t5        j6                  t5        j8                  |d            }|| j:                  z
  | j<                  z  }t5        j6                  |      }|}|| j(                  kD  r| j                  j-                  |t"        j$                  z   d	z   | j                  j.                  || j>                  |
      }t+        d| j>                        D ]  }||   s	||   j1                         j3                  |t"        j$                  z   dz         }|j                  | j                  j                  k(  r| j                  ||       u| jA                  ||   d||      } |S # 1 sw Y   xY w)zGet the available pages that correspond to a cached file.

        The lists generated are (virtual_offset, file_offset, page_size).
        r   r+   NrG   r   rh  r  r  r  r  )!r  r   r  InitialVacbsr   r   r   r:   r  r2   r/   r  Vacbsr<  r7   r>  r?  r
   r5   r@  VACB_SIZE_OF_FIRST_LEVELr  r8   r.   rR   rP   mathceilrJ   VACB_OFFSET_SHIFTVACB_LEVEL_SHIFTr  r  )r   r  section_sizefull_blocks	left_overitervalr  r=   r  size_of_pointer
array_headr  
vacb_entryvacblevel_depthlimit_depthr  s                    r   r  z$SHARED_CACHE_MAP.get_available_pages|  s?   
 	''00 #doo5 4??2	 $;!+;((1H$$Z%G%GH 8**dhhoo=NN8Y78 qLG $;!+; Ma((1H&&$((//9x3
 :: 
 Q##**h6 !668}}11::	.:
 '++d;;;!J K0!]]11%	6B#xx22%?)BC 2 
 "!--/44%	6@ &&$((//9NN43# 1& 1}!]]11%	6B#xx22%'A+)HI 2 
 "$$!--/44%	6@ &&$((//9NN43  iiq 9:"T%;%;;t?T?TTii,!$777---	>H88..oo$ . J !DOO4!'* w' []T+inn<wFG 
 &&$((//9NN43
 !% 8 8"7+QY!I 5& g8 8s   56RR(r   )r"   r#   r$   r%   r  r  r  r  r  r   r   r   r   r   r   r   r   r  r  r  r&   r!   r   r  r  &  s    2J %69I%IJJ$ & %)5!))995 5 	5
 D>5 
5n*"4"4"D"D QU GT Gr!   r  )=collections.abccollectionsr   r  r   loggingr  typingr   r   r   r   r   r   r	   volatility3.frameworkr
   r   r   r   r   r   (volatility3.framework.interfaces.objectsr   volatility3.framework.layersr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr"   rI   
StructTyper   r(   r   r   ExecutiveObjectr   r   r   r   r   r   r.  r7  GenericIntelProcessrH  abcr  r  r  r  rl  r  r  r&   r!   r   <module>r     s  
       N N N  E . 1 6 1 A			8	$77%% 7i.'$$ i.X	K 8
'$$ 
89G&&(<(< 9 G&&(<(< (J7--t/C/C J"
'$$d&:&: "
J
+g  $"6"6 
+L
g  $"6"6 L
^"W'' ","" @Ow**D,@,@ OdAQ##[__%=%= AQHHPG HPVJW JZ:Sg   :Szt37%% t3n	G7 	G]w)) ]r!   