
    Xf$                        d dl Z d dlZd dlmZmZmZmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ  e j                  e      Zdedeee   ef   d	efd
ZdZdZ eej*                  d gdz        Z eej,                  d gdz        Z G d de	j2                        Z G d de      Z G d de      Z G d de	j2                        Z G d de	j2                        ZeeeeedZeeeedZ y)    N)DictTupleListUnion)
exceptions)objects
interfaces)Array)
conversionaddress_family	packed_ipreturnc                     | t         j                  t         j                  fv r 	 t        j                  | t	        |            S t        j                  d      # t
        $ r t        d      w xY w)NzEThis version of python does not have socket.inet_ntop, please upgradez3[Errno 97] Address family not supported by protocol)socketAF_INET6AF_INET	inet_ntopbytesAttributeErrorRuntimeErrorerror)r   r   s     j/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/network.pyr   r      sg    &//6>>::	##NE)4DEE
 ,,L
MM	  	W 	s   A A-            c                        e Zd ZdZdZdZdej                  j                  de	dej                  j                  dedee	eeej                  j                  f   f   d	d
f fdZd Zd Zd Zd Zd Zd Zd Zd Z xZS )_TCP_LISTENERa  Class for objects found in TcpL pools.

    This class serves as a base class for all pooled network objects.

    It exposes some functions which return sanity-checked members. Substructures referred to by a
    pointer may appear valid at first glance but will throw an InvalidAddressException on access.

    This is not a problem when objects are validated via their `is_valid()` method, but when
    scanning for semi-corrupted data this check will not be performed.

    Be mindful that most of those methods return `None` when they would access invalid data.
    If you want to process the raw data access the attributes directly, e.g.
    via `network_object.InetAF` instead of `network_object.get_address_family()`.

    i  i  context	type_nameobject_infosizemembersr   Nc                 .    t         |   |||||       y )N)r   r    r!   r"   r#   )super__init__)selfr   r    r!   r"   r#   	__class__s         r   r&   z_TCP_LISTENER.__init__;   s&     	# 	 	
    c                 ~    	 | j                   j                         j                  S # t        j                  $ r Y y w xY wN)InetAFdereferenceAddressFamilyr   InvalidAddressExceptionr'   s    r   get_address_familyz _TCP_LISTENER.get_address_familyK   s8    	;;**,:::11 		s   #& <<c                 t    	 | j                  d      j                         S # t        j                  $ r Y y w xY w)NOwner)memberr-   r   r/   r0   s    r   	get_ownerz_TCP_LISTENER.get_ownerR   s7    	;;w'335511 		s   ! 77c                     | j                         j                         r9| j                         j                  d      r| j                         j                  S y )NUniqueProcessId)r5   is_validhas_valid_memberr7   r0   s    r   get_owner_pidz_TCP_LISTENER.get_owner_pidY   sA    >>$$&~~001BC~~'777r)   c                 .   | j                         j                         rw| j                         j                  d      rX| j                         j                  j	                  d| j                         j                  j
                  j                  d      S y )NImageFileNamestringreplace)
max_lengtherrors)r5   r8   r9   r<   castvolcountr0   s    r   get_owner_procnamez _TCP_LISTENER.get_owner_procname`   sv    >>$$&~~00A~~'55::#~~/==AAGG$ ;   r)   c                     t        j                  | j                  j                        }t	        |t
        j                  j                        r|S | j                  |j                  cxk  r| j                  k  sy  y |S r+   )r   wintime_to_datetime
CreateTimeQuadPart
isinstancer	   	renderersBaseAbsentValueMIN_CREATETIME_YEARyearMAX_CREATETIME_YEAR)r'   dt_objs     r   get_create_timez_TCP_LISTENER.get_create_timek   sg    //0H0HIfj22BBCM ((6;;Q9Q9QQ RMr)   c                 
   	 | j                   j                         }|j                  j                         j                  d   }|j                  j                         r|j                  }|S y # t
        j                  $ r Y y w xY w)Nr   )	LocalAddrr-   pDataaddr4inaddrr   r/   )r'   
local_addr_rU   s       r   get_in_addrz_TCP_LISTENER.get_in_addrw   sw    	335J   ,,.44Q7A++-#**11 		s   A(A, ,BBc              #     K   | j                         }|r| j                         t        k(  r.dt        t        j                  |j
                        t        f y| j                         t        k(  r.dt        t        j                  |j                        t        f yydt        t        f | j                         t        k(  rdt        t        f yyw)z!Handle Windows dual-stack socketsv4v6N)
rX   r1   r   r   r   rT   
inaddr_anyr   addr6inaddr6_anyr'   rU   s     r   dual_stack_socketsz _TCP_LISTENER.dual_stack_sockets   s      !!#&&(G3IfnnfllCZOO((*h6Ifoov||DkQQ 7 
J..&&(H4K44 5s   CCc                 ^   	 | j                         t        t        fvrHt        j	                  dj                  | j                  j                  | j                                      y	 y# t        j                  $ r1 t        j	                  d| j                  j                  dd       Y yw xY w)Nz8netw obj 0x{:x} invalid due to invalid address_family {}Fznetw obj 0xx& invalid due to invalid address accessT)
r1   r   r   vollogdebugformatrB   offsetr   r/   r0   s    r   r8   z_TCP_LISTENER.is_valid   s    	**,(0CCNUU)@)@)B
  D  11 	LLdhhooa00VW 		s   A#A( (AB,+B,)__name__
__module____qualname____doc__rL   rN   r	   r   ContextInterfacestrr   ObjectInformationintr   r   Templater&   r1   r5   r:   rD   rP   rX   r`   r8   __classcell__)r(   s   @r   r   r   '   s      
##44
 
  ''99	

 
 c5j&8&8&A&A!ABBC
 

 	
250r)   r   c                   (    e Zd ZdZd Zd Zd Zd Zy)_TCP_ENDPOINTz%Class for objects found in TcpE poolsc                     | j                         t        k(  r$t        t        j                  |j                        S t        t        j
                  |j                        S r+   )r1   r   r   r   rT   r   r]   r_   s     r   _ipv4_or_ipv6z_TCP_ENDPOINT._ipv4_or_ipv6   s=    ""$/V^^V\\::V__fll;;r)   c                     	 | j                   j                         j                  j                  j                         j                         }| j	                  |      S # t
        j                  $ r Y y w xY wr+   )AddrInfor-   LocalrS   ru   r   r/   r_   s     r   get_local_addressz_TCP_ENDPOINT.get_local_address   s`    	]]..066<<HHJVVXF%%f--11 		s   AA A32A3c                     	 | j                   j                         j                  j                         }| j                  |      S # t        j
                  $ r Y y w xY wr+   )rw   r-   Remoteru   r   r/   r_   s     r   get_remote_addressz _TCP_ENDPOINT.get_remote_address   sQ    	]]..077CCEF%%f--11 		s   AA AAc                    | j                   | j                   j                  j                         vrFt        j	                  t        |        d| j                  j                  dd| j                           y	 | j                         t        t        fvrJt        j	                  t        |        d| j                  j                  dd| j                                 y| j                         s| j                         r:| j                         j                  dk(  s| j                         j                  dkD  r:t        j	                  t        |        d| j                  j                  dd       yy
# t        j                  $ r< t        j	                  t        |        d| j                  j                  dd	       Y yw xY w)Nz 0xrb   z" invalid due to invalid tcp state Fz' invalid due to invalid address_family r   i  z" invalid due to invalid owner datarc   T)Statechoicesvaluesrd   re   typerB   rg   r1   r   r   ry   r5   r7   r   r/   r0   s    r   r8   z_TCP_ENDPOINT.is_valid   sw   ::TZZ//6688LL:,c$((//!!44VW[WaWaVbc 	&&((0CCDzl#dhhooa%88_`d`w`w`y_z{ ))+NN$>>#33q8>>#33e;Dzl#dhhooa%88Z[   11 	LL:,c$((//!!44Z[ 		s   8A%E3 BE3 3AGGN)rh   ri   rj   rk   ru   ry   r|   r8    r)   r   rs   rs      s    /<r)   rs   c                       e Zd ZdZy)_UDP_ENDPOINTz%Class for objects found in UdpA poolsN)rh   ri   rj   rk   r   r)   r   r   r      s    /r)   r   c                       e Zd Zed        Zy)_LOCAL_ADDRESSc                 R    | j                   j                         j                         S r+   rS   r-   r0   s    r   rU   z_LOCAL_ADDRESS.inaddr   s    zz%%'3355r)   Nrh   ri   rj   propertyrU   r   r)   r   r   r      s    6 6r)   r   c                       e Zd Zed        Zy)_LOCAL_ADDRESS_WIN10_UDPc                 6    | j                   j                         S r+   r   r0   s    r   rU   z_LOCAL_ADDRESS_WIN10_UDP.inaddr  s    zz%%''r)   Nr   r   r)   r   r   r      s    ( (r)   r   )rs   r   r   r   r   )rs   r   r   r   )!loggingr   typingr   r   r   r   volatility3.frameworkr   r   r	   volatility3.framework.objectsr
   volatility3.framework.renderersr   	getLoggerrh   rd   ro   rm   r   r   r   r\   r^   
StructTyper   rs   r   r   r   win10_x64_class_typesclass_typesr   r)   r   <module>r      s  
   + + , 5 / 6			8	$Nc NeDIu4D.E N# N  v~~sQw/
!r2PG&& Pf9M 9x0M 06W'' 6(w11 ( #""$ 8  #""$	r)   