X f GXddlZddlZddlZddlZddlmZmZmZmZm Z ddl m Z ddl m Z mZmZmZmZmZddlmZejeZGddejZGdd eZGd d ejZGd d ejjZGddejZdS)N)DictListOptionalTupleUnion)PoolConstraint) constants exceptions interfacesobjects rendererssymbols) conversionc eZdZdZ ddededeedeedeej j f dZ e e jd ejjd edeeeeeffd Zd Zd ZdZdS) POOL_HEADERz|A kernel pool allocation header. Exists at the base of the allocation and provides a tag that we can scan for. N constraint use_top_downkernel_symbol_tablenative_layer_namereturnc#& K|j}|jdu}|jjtjd}tj|vr*|tjdd\}}|r0|jj|tjzdz}n/|jj|tjzdz}|jj } |sK|j |tjz|z|jj |jj | z|} | VdStj|j|rd} nd} |r|d} |d } |d }|jd d j }||j|\}}d |vrdn|d }t'|}|jj | z}t)||j| z}|jj|jj ||| zd }t1d|| D]s}||| z}t2|||z||z|zdd }d|cxkrdksnLd}d}t1t7|D]}|d |zzr|||z }||krd }d}|r?||z dkrt9jd|||z ||z dz\}|||pdz}||z |cxkr|krnnt=jt@tBj"5|j |tjz|z|jj || z|z|} | #r| Vdddn #1swxYwYudS|jj|tjz|zj }|j$rA|j$D]9}||jj|tjz|zj z }:tKj&|| d } |j |tjz|z|jj |jj |j| zz| z |} t=jt@tBj"5| #r| VddddS#1swxYwYdS)a Carve an object or data structure from a kernel pool allocation Args: constraint: a PoolConstraint object used to get the pool allocation header object use_top_down: for delineating how a windows version finds the size of the object body kernel_symbol_table: in case objects of a different symbol table are scanned for native_layer_name: the name of the layer where the data originally lived Returns: An object as found from a POOL_HEADER Nr_OBJECT_HEADER layer_nameoffsetrBodyInfoMask PointerCount PADDING_INFOT)padlittle) byteordersignedFzY & &+4??9>+J+J1Q3+O ( y  !%!;!D!D#in47GG""   "&!;!D!D!IN25EE""  8=S )--!IN2Y>8.x)99"3 .J      ,T]~$Nq$Q$V!;;M#4$/ &-===D)//??" /22M.N.N+ $x1AA  /)1K !% 4TX5H I N N *">D!O!! "!Z;;F-F-D%24/3I%JN),% 1248152/500 #+#*8 * *&%'9>>>>Q>>>> &+O./+"3'B#C#CDD77)Q!V4737RST7UU3 $55526&'N& "99A==$,2M ) $"9!:<@"9=:"#=$!$--)'*E-2+55NNNN$NNNNN #,!:#E - -&*]%9%9- >J'+x':#'+#5 #D.? &:&& &..00-",,,, - - - - - - - - - - - - - - -wF-F-T!M6??% 6B30:0P,!T]%?%H%H- >AUU&&  */ 9NNN !]11% 6B#x28?T^i-GG,V&7 2  (J4VWW))!**,,)(((())))))))))))))))))s%'AO  O O TT  T contextrNcLg}g}dD]}tjttj5|t jd|}|j|}| || |j dddn #1swxYwY||fS)N) CREATOR_INFO NAME_INFO HANDLE_INFO QUOTA_INFO PROCESS_INFO AUDIT_INFO EXTENDED_INFOHANDLE_REVOCATION_INFOr#_OBJECT_HEADER_) rErFAttributeErrorr SymbolErrorr r/r1r2appendr3)clsrjrNheaderssizesheaderr+ header_types rhr8z.POOL_HEADER._calculate_optional_header_lengthss    / /F$^Z5KLL / /(Q).QQQQ&2;;IFF v&&& [-...  / / / / / / / / / / / / / / /~sABB B c|jdkSNrPoolTyperLs rh is_free_poolzPOOL_HEADER.is_free_pools}!!c4|jdzdko |jdkSNrrrrs rh is_paged_poolzPOOL_HEADER.is_paged_pool }q A%;$-!*;;rc|jdzdkSNrr"rrs rhis_nonpaged_poolzPOOL_HEADER.is_nonpaged_pool}q A%%r)NN)__name__ __module__ __qualname____doc__rboolrstrr r ObjectInterfaceri classmethod functools lru_cacherjContextInterfacerrr@r8rrrrrhrrs .2+/ |)|)"|)|)&c] |) $C= |) *$4 5 |)|)|)|)|Y (9NQ tCy$s)# $[:"""<<<&&&&&rrceZdZdZdZdZdS)POOL_HEADER_VISTAzA kernel pool allocation header, updated for Vista and later. Exists at the base of the allocation and provides a tag that we can scan for. c|jdzdkSrrrs rhrzPOOL_HEADER_VISTA.is_paged_pool rrc4|jdzdko |jdkSrrrs rhrz"POOL_HEADER_VISTA.is_nonpaged_poolrrN)rrrrrrrrrhrrs< &&&<<<<z2POOL_TRACKER_BIG_PAGES.get_key...s:JJJ1"q,,,,3,,,,,ABJJJr)r convert_value_to_datarr@DataFormatInfojoin)rL tag_bytess rhget_keyzPOOL_TRACKER_BIG_PAGES.get_key)sO1 Hc71!XuEE  wwJJ JJJKKKrct|drC|js||j|jd|jSt jS)zBReturns the enum name for the PoolType value on applicable systemsrzUnknown choice )hasattrrrgetrr NotApplicableValuers rh get_pool_typez$POOL_TRACKER_BIG_PAGES.get_pool_type0sq 4 $ $ 2( 2//111(,, @@@ /11 1rcX |jS#t$rtjcYSwxYw)z5Returns the NumberOfBytes value on applicable systems) NumberOfBytesrur rrs rhget_number_of_bytesz*POOL_TRACKER_BIG_PAGES.get_number_of_bytes<s@ 2% % 2 2 2/11 1 1 1 2s  ))N)rrrrrrr__annotations__rrrIrrrr r BaseAbsentValuerr@rrrrhrrs))')d38n))) - - -$     LLLLL 2uS**>*N%NO 2 2 2 22U3 0D0T+T%U222222rrceZdZdZddZdS)ExecutiveObjectzyThis is used as a "mixin" that provides all kernel executive objects with a means of finding their own object header.r OBJECT_HEADERctj|jjvrt dtjd|jjtjd}|jj|tjzdz d}|j |tjzdz|jj |jj |z |jj S)N%Invalid symbol table name syntax (no  found)rrrr)r r/r-r+ ValueErrorr.r0r1r2r6r4rrr)rLrNrSs rhget_object_headerz!ExecutiveObject.get_object_headerIs >!3 3 3O OOO !H.44Y^DDQGm099   .1A A    ' ' }##   .1A Ax*8?[0"h8 $   rN)rr)rrrrrrrrhrrEs288      rrceZdZdZdefdZ d deeefdede efdZ e de j jfdZdS) rzA class for the headers for executive kernel objects, which contains quota information, ownership details, naming data, and ACLs.rcf |jdks |jdkrdSn#tj$rYdSwxYwdS)z!Determine if the object is valid.r(rFT)r!r rHrs rhrIzOBJECT_HEADER.is_valid^sY   9,,0AA0E0Eu1F1   55 ts ..Ntype_mapcookiecr|jdd |jjS |jjj|jd<nj#t$r] |jjdz |z |j z dz}n#ttf$r |j }YnwxYw|||jd<YnwxYw|jjS)zAcross all Windows versions, the _OBJECT_HEADER embeds details on the type of object (i.e. process, file) but the way its embedded differs between versions. This API abstracts away those details. object_header_object_typeNr) r-rrTypeNameString_volrur TypeIndexrG)rLrr type_indexs rhget_object_typezOBJECT_HEADER.get_object_typels 8<<3T : : F85 5 N59Y^5JDI1 2 2 N N N ,#x!3v=NRVV "I. , , ,!^  ,6>\\*5M5MDI1 2 2 2 Nx11s5A B*A,+B*,BB*B B*)B*ctj|jjvrt dtjd|jjtjd}||jjvr|jj|}n||jj|jj }|j dd}|td|jj |j||jj |} |j}na#t$rTd}|dj}|j||d z zz}|d |jj ||z}YnwxYw|dkr7t d |jj|jj |d |jj |jj|z |jj d } | S)Nrrrkernel_virtual_offsetz0Could not find kernel_virtual_offset for layer: )rrrObpInfoMaskToOffsetr"z unsigned charzDCould not find _OBJECT_HEADER_NAME_INFO for object at {} of layer {}_OBJECT_HEADER_NAME_INFOT)rrrabsolute)r r/r-r+rr.r0modulesr=rconfigrrurmoduleNameInfoOffset get_symboladdressr r4formatr) rLrNntkrnlmplayerkvo header_offset name_info_bitrcalculated_indexr{s rhNameInfozOBJECT_HEADER.NameInfos >!3 3 3O OOO !H.44Y^DDQG  5 5 5},->?HHM()CDE,""#:DAAC{$\txGZ\\ }++!dh.A#,H  /MM   M))*?@@HG#} QRAR0ST $OO85!11,MMM  A  V]]HOTX%8   &x*8?]2"h8 !   sD AE)(E))N)rrrrrrIrr@rrrpropertyr r rrrrrhrrZsDD $    7;22S#X2032 #222265*,<555X555rr)rErloggingrCtypingrrrrr'volatility3.plugins.windows.poolscannerrvolatility3.frameworkr r r r r rvolatility3.framework.renderersr getLoggerrvollog StructTyperrrrrrrrrhrs 55555555555555BBBBBB766666  8 $ $k&k&k&k&k&'$k&k&k&\ < < < < < < < <0202020202W/020202f     j(8   *cccccG&cccccr