
    Xf{                          d dl Z d dlmZmZ d dlmZmZmZ d dlm	Z	  e j
        e          Z G d dej                  Z G d dej                  Zeeed	ZdS )
    N)	GeneratorTuple)	constants
interfacesobjects)
conversionc            
           e Zd Zdej        j        fdZdej        j        dedej        j        dedef
dZ	ded	ej        j        defd
Z
deeeef         ddf         fdZdS )IMAGE_DOS_HEADERreturnc                    | j         dk    rt          d| j         dd          | j        j        }|                                 }| j                            |t          j        z   dz   || j        j	        | j
        z             }|j        dk    rt          d|j        dd	          |j        j        d
k    r|                    d          }|S )zCarve out the NT header from this DOS header. This reflects on the
        PE file's Machine type to create a 32- or 64-bit NT header structure.

        Returns:
            <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance
        iMZ  ze_magic 04Xz is not a valid DOS signature._IMAGE_NT_HEADERS)
layer_nameoffsetiPE  zNT header signature z is not a validid  _IMAGE_NT_HEADERS64)e_magic
ValueErrorvolr   get_symbol_table_name_contextobjectr   BANGr   e_lfanew	Signature
FileHeaderMachinecast)selfr   symbol_table_name	nt_headers       e/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/pe.pyget_nt_headerzIMAGE_DOS_HEADER.get_nt_header   s     <6!!K4<KKKK   X(
 6688M((	.1DD!8?T]2 ) 
 
	 &((Oy':OOOO  
 '500!'<==I    sectheaderitemvaluec                    | j         j                            |j        j                  j        }|j        j        |j        j        z
  }t          j        |t          |j        j
                  }|d|         |z   |||z   d         z   }|S )aQ  Replaces a member in an _IMAGE_SECTION_HEADER structure.

        Args:
            sect: the section instance
            header: raw data for the section
            item: the member of the section to replace
            value: new value for the member

        Returns:
            The raw data with the replaced header field
        N)r   symbol_spaceget_typer   	type_namesizer   r   convert_value_to_dataintdata_format)	r   r$   r%   r&   r'   member_sizestartnewvalresults	            r!   replace_header_fieldz%IMAGE_DOS_HEADER.replace_header_field0   s{    & m099$(:LMMR$(/1.uc48;OPP&(6%+2E2G2G+HHr#   raw_datar    c                    |j         j        j        j        | j        j        z
  }|j         j        j        j        }| j        j                            |          j        }	 t          j
        | j        j        t          |j         j        j        j                  }|d|         |z   |||z   d         z   }nI# t          $ r< t                              d                    | j        j                             |}Y nw xY w|S )a  Fix the _OPTIONAL_HEADER.ImageBase value (which is either an
        unsigned long for 32-bit PE's or unsigned long long for 64-bit PE's) to
        match the address where the PE file was carved out of memory.

        Args:
            raw_data: a bytes object of the PE's data
            nt_header: <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance

        Returns:
             <bytes> patched with the correct address
        NzVolatility was unable to fix the image base for the PE file at base address {:#x}. This will cause issues with many static analysis tools if you do not inform the tool of the in-memory load address.)OptionalHeader	ImageBaser   r   r+   r   r)   r*   r,   r   r-   r.   r/   OverflowErrorvollogwarningformat)r   r5   r    image_base_offsetimage_base_typer0   r2   new_pes           r!   fix_image_basezIMAGE_DOS_HEADER.fix_image_baseI   s     $.29DHOK 	 $2<@Jm099/JJO	2i&>&H&L&X F +++,,{:<<=> F
  	 	 	NN66<fTX_6M6M  
 FFF	 s   AB4 4AC:9C:Nc              #     K   |                                  }| j        j        }|                                 }|j        j        }| j        j                            |t          j
        z   dz             j        }|j        j        }|t          j        j        k    rt          d|           | j        j        |         }|                    | j        j        |j        j        d          }|                     ||          }	d|	fV  |j        j        |j        j        j        | j        j        z
  z   }
d}|                                D ]*}|j        |k    rt          d|j                   |j        j        |k    rt          d|j        j                   |j        |k    rt          d|j                   |t7          j        |j        j        |d
          }|                    |j        j        |          }|                     |||j        |j                  }|                     |||j        |          }|                     |||j        j        |          }|
||z  z   }||fV  |dz  },d	S )a$  This method generates the content necessary to reconstruct a PE file
        from memory. It preserves slack space (similar to the old --memory) and
        automatically fixes the ImageBase in the output PE file.

        Returns:
            <tuple> of (<int> offset, <bytes> data)
        _IMAGE_SECTION_HEADERz&The claimed SizeOfImage is too large: T)padr   z%Section VirtualAddress is too large: z"Section VirtualSize is too large: z$Section SizeOfRawData is too large: N)up   )r"   r   r   r   r7   SectionAlignmentr   r)   r*   r   r   r,   SizeOfImagewindowsPE_MAX_EXTRACTION_SIZEr   layersreadr   r@   r   SizeOfOptionalHeaderget_sectionsVirtualAddressMiscVirtualSizeSizeOfRawDatar   roundr4   PointerToRawData)r   r    r   r   section_alignmentsect_header_sizesize_of_image
read_layerr5   
fixed_data
start_addrcounterr$   	sect_size
sectheaderr   s                   r!   reconstructzIMAGE_DOS_HEADER.reconstructp   s      &&((	X(
 6688%4E=5>>	.1HH
 

 	 "0< 9,CCCUmUUVVV])*5
??HOY5At # 
 

 ((9==
m)>$(/$(/A

 **,, "	 "	D"]22 QD<OQQ   y$}44 P9NPP   !M11 O4;MOO   &,I)+<  	 (__TX_>NOO
!66*d&;T=P 
 "66*d&8) 
 "66*di&;Y 
 $w1A'ABj((((1E"	 "	r#   )__name__
__module____qualname__r   r   ObjectInterfacer"   bytesr.   r4   r@   r   r   r]    r#   r!   r
   r
      s        z1A    B 0   0	
  
   2%%*4*<*L%	% % % %NKYuS%Z'8$'DE K K K K K Kr#   r
   c                   @    e Zd Zdeej        j        ddf         fdZdS )IMAGE_NT_HEADERSr   Nc              #     K   | j         j        }|                                 }| j        j                            |t          j        z   dz             j        }| j	        j
        | j        j         j        z   }t          | j	        j                  D ]9}|||z  z   }| j                            |t          j        z   dz   ||          V  :dS )z{Iterate through the section headers for this PE file.

        Yields:
            <_IMAGE_SECTION_HEADER> objects
        rB   )r   r   N)r   r   r   r   r)   r*   r   r   r,   r   rL   r7   r   rangeNumberOfSectionsr   )r   r   r   rU   rY   i	sect_addrs          r!   rM   zIMAGE_NT_HEADERS.get_sections   s       X(
 6688=5>>	.1HH
 

 	 O043F3J3QQ 	 t788 	 	A"a*:&:;I-&&!IN25LL % '      	 	r#   )r^   r_   r`   r   r   r   ra   rM   rc   r#   r!   re   re      sB        i
(:(JDRV(VW      r#   re   )_IMAGE_DOS_HEADERr   r   )loggingtypingr   r   volatility3.frameworkr   r   r   volatility3.framework.renderersr   	getLoggerr^   r:   
StructTyper
   re   class_typesrc   r#   r!   <module>rs      s   
  # # # # # # # # @ @ @ @ @ @ @ @ @ @ 6 6 6 6 6 6		8	$	$m m m m mw) m m m`    w)   6 *)+	 r#   