X f GnddlZddlZddlZddlZddlmZmZmZmZm Z ddl m Z ddl m Z mZmZmZmZmZddlmZej*eZGddej0ZGdd eZGd d ej0ZGd d ej j8ZGddej0Zy)N)DictListOptionalTupleUnion)PoolConstraint) constants exceptions interfacesobjects rendererssymbols) conversionc eZdZdZ ddededeedeedeejjf dZ e e jd ejj d edeeeeeffd Zd Zd ZdZy) POOL_HEADERz|A kernel pool allocation header. Exists at the base of the allocation and provides a tag that we can scan for. N constraint use_top_downkernel_symbol_tablenative_layer_namereturnc#2 K|j}|jdu}|jjjtj d}tj |vr%|jtj dd\}}|r:|j jj|tj zdz}n9|j jj|tj zdz}|jj} |sc|j j|tj z|z|jj|jj| z|} | ytj|j |rd} nd} |rj|jd} |jd } |jd }|j d d j}|j#|j |\}}d |vrdn|j%d }t'|}|jj| z}t)||j*| z}|j j,|jjj/||| zd }t1d|| D]T}||| z}t2j5|||z||z|zdd }d|cxkDrdk\sn>d}d}t1t7|D]}|d |zzs |||z }||k(sd }d}|r9||z dkrt9j:d|||z ||z dz\}|||xsdz}||z |cxk\r|kDrnnt=j>t@tBjD5|j j|tj z|z|jj|| z|z|} | jGr| dddWy|j jj|tj z|zj}|jHrW|jHD]H}||j jj|tj z|zjz }JtKjL|| d } |j j|tj z|z|jj|jj|j*| zz| z |} t=j>t@tBjD5| jGr| dddy#1swYxYw#1swYyxYww)a Carve an object or data structure from a kernel pool allocation Args: constraint: a PoolConstraint object used to get the pool allocation header object use_top_down: for delineating how a windows version finds the size of the object body kernel_symbol_table: in case objects of a different symbol table are scanned for native_layer_name: the name of the layer where the data originally lived Returns: An object as found from a POOL_HEADER Nr_OBJECT_HEADER layer_nameoffsetrBodyInfoMask PointerCount PADDING_INFOT)padlittle) byteordersignedFz>Y &+4??9>>+J1Q+O ( y !%!;!;!D!D#inn47GG"  "&!;!;!D!D!INN25EE"  88==--!INN2Y>88..xx)99"3 .J  ,,T]]$>~$Nq$Q$V$V!;;MM#4$/ &-==)//?" /22M.N+ $xx1AA  /)1K !% 4 4TXX5H5H I N N *">D!O! "!Z;F-D%24/3I%JN),% 1248152/50 #+#*8 *&%'9>Q> &+O./+"3'B#CD7)Q!V437RST7UU3 $5526 7&'N& "99A=$,2MM ) $"9!:<@"9=:"#=$-)'*E-2+55N$N #,,!:#E#E -&*]]%9%9- >J'+xx':':#'+#5 #D.? &:& &..0",, - -wF-T!MM66??% 6B$330:0P0P,!T]]%?%?%H%H- >AUU&$  *// 9N !]]11% 6B#xx2288??T^^i-GG,V&7 2  ((J4V4VW)!**,(())C - -B))sELV V#A;VA"U>E V V 5 V>V V VVcontextrNcVg}g}dD]}tjttj5|t j d|}|jj|}|j||j|jddd||fS#1swYxYw)N) CREATOR_INFO NAME_INFO HANDLE_INFO QUOTA_INFO PROCESS_INFO AUDIT_INFO EXTENDED_INFOHANDLE_REVOCATION_INFOr#_OBJECT_HEADER_) rErFAttributeErrorr SymbolErrorr r/r1r2appendr3)clsrjrNheaderssizesheaderr+ header_types rhr8z.POOL_HEADER._calculate_optional_header_lengthss    /F$$^Z5K5KL /())..)9Q&22;;IF v& [--.  / / /,~ / /s ABB( c |jdk(SNrPoolTyperLs rh is_free_poolzPOOL_HEADER.is_free_pools}}!!cH|jdzdk(xr|jdkDSNrrrrs rh is_paged_poolzPOOL_HEADER.is_paged_pool$}}q A%;$--!*;;rc&|jdzdk(SNrr"rrs rhis_nonpaged_poolzPOOL_HEADER.is_nonpaged_pool}}q A%%r)NN)__name__ __module__ __qualname____doc__rboolrstrr r ObjectInterfaceri classmethod functools lru_cacherjContextInterfacerrr@r8rrrrrhrrs.2+/ |)"|)|)&c] |) $C= |) *$$44 5 |)|Y ((99NQ tCy$s)# $:"<&rrceZdZdZdZdZy)POOL_HEADER_VISTAzA kernel pool allocation header, updated for Vista and later. Exists at the base of the allocation and provides a tag that we can scan for. c&|jdzdk(Srrrs rhrzPOOL_HEADER_VISTA.is_paged_pool rrcH|jdzdk(xr|jdkDSrrrs rhrz"POOL_HEADER_VISTA.is_nonpaged_poolrrN)rrrrrrrrrhrrs &*>*N*N%NO 22U3 0D0D0T0T+T%U2rrceZdZdZddZy)ExecutiveObjectzyThis is used as a "mixin" that provides all kernel executive objects with a means of finding their own object header.chtj|jjvrt dtjd|jjj tjd}|j jj|tjzdzjd}|j j|tjzdz|jj|jj|z |jjS)N%Invalid symbol table name syntax (no  found)rrrr)r r/r-r+ ValueErrorr.r0r1r2r6r4rrr)rLrNrSs rhget_object_headerz!ExecutiveObject.get_object_headerIs >>!3!3 37 7GwO !HH..44Y^^DQGmm0099   .1A A   ' }}##   .1A Axx**88??[0"hh88 $  rN)r OBJECT_HEADER)rrrrrrrrhrrEs 8 rrceZdZdZdefdZ d deeefdede efdZ e de jjfdZy) rzA class for the headers for executive kernel objects, which contains quota information, ownership details, naming data, and ACLs.rcx |jdkDs|jdkry y#tj$rYywxYw)z!Determine if the object is valid.r(rFT)r!r rHrs rhrIzOBJECT_HEADER.is_valid^sJ    9,0A0AA0E1F 11  s #99Ntype_mapcookiec|jjdd|jjS |jjj |j d<|jjS#t$r |jjdz |z |jz dz}n!#ttf$r|j}YnwxYw|j||j d<Y|jjSwxYw)zAcross all Windows versions, the _OBJECT_HEADER embeds details on the type of object (i.e. process, file) but the way its embedded differs between versions. This API abstracts away those details. object_header_object_typeNr) r-rrTypeNameString_volrur TypeIndexrG)rLrr type_indexs rhget_object_typezOBJECT_HEADER.get_object_typels 88<<3T : F8855 5 N59YY^^5J5JDII1 2xx111 N ,#xx!3v=NRVV "I. ,!^^  ,6>\\*5MDII1 2xx111 Ns5-A77 D,B.-D.C  D C  !DDctj|jjvrt dtjd|jjj tjd}||j jvr|j j|}n|j j|jj}|jjdd}|"td|jj|j j||jj|} |j}|dk(rCt d j)|jj*|jj|j'd |jj|jj*|z |jjd } | S#t$rad}|j!dj"}|j$||d z zz}|j'd |jj||z}YwxYw)Nrrrkernel_virtual_offsetz0Could not find kernel_virtual_offset for layer: )rrrObpInfoMaskToOffsetr"z unsigned charzDCould not find _OBJECT_HEADER_NAME_INFO for object at {} of layer {}_OBJECT_HEADER_NAME_INFOT)rrrabsolute)r r/r-r+rr.r0modulesr=rconfigrrurmoduleNameInfoOffset get_symboladdressr r4formatr) rLrNntkrnlmplayerkvo header_offset name_info_bitrcalculated_indexr{s rhNameInfozOBJECT_HEADER.NameInfos >>!3!3 37 7GwO !HH..44Y^^DQG  5 5 5}},,->?HMM(()C)CDE,,""#:DAC{$FtxxGZGZF[\ }}++!dhh.A.A#,H  //M A V]]HHOOTXX%8%8   &xx**88??]2"hh88 !  7 M))*?@HHG#}} QRAR0ST $OO8855!11,M s G77A&I! I!)N)rrrrrrIrr@rrrpropertyr r rrrrrhrrZsiD $ 7;2S#X2032 #265*,,<<55rr)rErloggingrCtypingrrrrr'volatility3.plugins.windows.poolscannerrvolatility3.frameworkr r r r r rvolatility3.framework.renderersr getLoggerrvollog StructTyperrrrrrrrrhrs 55B7   8 $k&'$$k&\ < <02W//02f j((88 *cG&&cr