
    Xf2                        d dl Z d dlZd dlZd dlZd dlmZmZmZ d dlm	Z	m
Z
mZmZ d dlmZmZmZ  ej"                  e      ZdZ G d dej*                        Z G d d	ej.                        Z G d
 dej2                        Z G d dej2                        Z G d dej2                        Z G d dej2                        Z G d dej2                        Zy)    N)IterableOptionalUnion)	constants
exceptions
interfacesobjects)RegistryFormatExceptionRegistryHiveRegistryInvalidIndexi?  c                   P    e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZed        Zy)RegValueTypesr                           	   
      i c                 .     | t         j                        S )N)r   REG_UNKNOWN)clsvalues     k/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/registry.py	_missing_zRegValueTypes._missing_%   s    =,,--    N)__name__
__module____qualname__REG_NONEREG_SZREG_EXPAND_SZ
REG_BINARY	REG_DWORDREG_DWORD_BIG_ENDIANREG_LINKREG_MULTI_SZREG_RESOURCE_LISTREG_FULL_RESOURCE_DESCRIPTORREG_RESOURCE_REQUIREMENTS_LIST	REG_QWORDr   classmethodr    r    r   r   r      sY    HFMJIHL#$ %'"IK. .r    r   c                   4    e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
Zy)RegKeyFlagsr   r   r   r          @         i   N)r!   r"   r#   KEY_IS_VOLATILEKEY_HIVE_EXITKEY_HIVE_ENTRYKEY_NO_DELETEKEY_SYM_LINKKEY_COMP_NAMEKEY_PREFEF_HANDLEKEY_VIRT_MIRROREDKEY_VIRT_TARGETKEY_VIRTUAL_STOREr1   r    r   r3   r3   *   s7    OMNMLMOr    r3   c                       e Zd ZdefdZy)
HMAP_ENTRYreturnc                     	 | j                   | j                   dz  z  | j                  z   S # t        $ r | j                  cY S w xY w)N   )PermanentBinAddressBlockOffsetAttributeErrorBlockAddressselfs    r   get_block_offsetzHMAP_ENTRY.get_block_offset8   sP    	%((D,D,Ds,JK  ! !  	%$$$	%s   (+ AAN)r!   r"   r#   intrN   r1   r    r   rD   rD   7   s    %# %r    rD   c                   b    e Zd ZdefdZdeej                  j                     fdZ	 e
e	      Zy)CMHIVErE   c                 h    	 | j                   j                  dk(  S # t        j                  $ r Y yw xY w)z!Determine if the object is valid.l   >} F)Hive	Signaturer   InvalidAddressExceptionrL   s    r   is_validzCMHIVE.is_validB   s4    	99&&*4411 		s    11c                     dD ]j  }t        j                  t        t        j                        5  t        | |      }|j                  dkD  r|j                         cddd       c S 	 ddd       l y# 1 sw Y   wxY w)zDetermine a name for the hive.

        Note that some attributes are unpredictably blank across
        different OS versions while others are populated, so we check
        all possibilities and take the first one that's not empty
        )FileFullPathFileUserNameHiveRootPathr   N)
contextlibsuppressrJ   r   rU   getattrLength
get_string)rM   attrnames      r   get_namezCMHIVE.get_nameI   s~     E 	-D$$
 B B - tT*;;???,- - #	- -	- - -s   +A11A:	N)r!   r"   r#   boolrV   r   r   r	   ObjectInterfacerb   propertyra   r1   r    r   rQ   rQ   A   s7    $ (:#5#5#E#EF $ HDr    rQ   c                   "    e Zd ZdZd ZdefdZy)CM_KEY_BODYznThis represents an open handle to a registry key and is not tied to the
    registry hive file format on disk.c                 f    t        | d      r%t        j                  |z  t        j                  k(  ryy)zzWin10 14393 introduced an extra path element that it skips over by
        checking for Flags that contain KEY_HIVE_ENTRY.TransTF)hasattrr3   r;   )rM   	kcb_flagss     r   _skip_key_hive_entry_pathz%CM_KEY_BODY._skip_key_hive_entry_pathb   s-     D'"**Y6+:T:TTr    rE   c                    g }| j                   }|j                  r|j                  j                  n| j	                  |j
                        r|j                  }|sne|j                  |j                  j                  j                  dd|j                  j                  d             |j                  }|j                  rdj                  t        |            S )Nstringutf8replace)encoding
max_lengtherrors\)KeyControlBlock	ParentKcb	NameBlockNamerl   Flagsappendcast
NameLengthjoinreversed)rM   outputkcbs      r   get_full_key_namezCM_KEY_BODY.get_full_key_nameo   s    ""mm}}!!)--cii8mmMM""''#"}}77$	 (  --C# mm$ yy&)**r    N)r!   r"   r#   __doc__rl   strr   r1   r    r   rg   rg   ^   s    *+3 +r    rg   c                   :   e Zd ZdZdefdZdeej                  j                     fdZ
dedej                  j                  deej                  j                     fdZdeej                  j                     fdZdej                  j                  fd	Zdefd
Zy)CM_KEY_NODEz.Extension to allow traversal of registry keys.rE   c                     t        | j                  j                  | j                  j                     t
              st        d      t        | j                  j                  dz        S )NzUCannot determine volatility of registry key without an offset in a RegistryHive layer        )	
isinstance_contextlayersvol
layer_namer   
ValueErrorrc   offsetrL   s    r   get_volatilezCM_KEY_NODE.get_volatile   sO    $--..txx/B/BC\Rg  DHHOOj011r    c              #   X  K   | j                   j                  | j                  j                     }t	        |t
              st        d      t        d      D ]N  }|j                  | j                  |         j                  j                  }| j                  ||      E d{    P y7 w)z Returns a list of the key nodes.8CM_KEY_NODE was not instantiated on a RegistryHive layerr   N)r   r   r   r   r   r   	TypeErrorrangeget_cellSubKeyListsuKeyIndex_get_subkeys_recursive)rM   hiveindexsubkey_nodes       r   get_subkeyszCM_KEY_NODE.get_subkeys   s     }}##DHH$7$78$-VWW1X 	FE--(8(8(?@BBKKK224EEE	F Fs   BB* B(!B*r   nodec           	   #   |  K   	 |j                  ddd      }d}|dk(  rd}n|dk(  s|d	k(  rd}nt|j                  j
                  j                  t        j                  d
z         r| n9t        j                  dj                  |j                  j
                  |             |r|j                  |z  |j                  _        |j                  dd|   D ]q  }|dz  |j                  kD  r1t        j!                  t        j"                  dt%        |              F	 |j'                  |      }| j)                  ||      E d{    s yy# t        j                  t        f$ r Y yw xY w# t        j                  t        f$ r4 t        j!                  t        j"                  dt%        |       d       Y w xY w7 ww)z-Recursively descend a node returning subkeys.rn   r   latin-1rr   rq   Nrir   lhlf_CM_KEY_NODEzKUnexpected node type encountered when traversing subkeys: {}, signature: {}z5Node found with address outside the valid Hive size: zFailed to get node at z
, skipping)r{   r   rU   r
   r   	type_nameendswithr   BANGvollogdebugformatCountListcountmaximum_addresslogLOGLEVEL_VVVhexget_noder   )rM   r   r   	signaturelistjumpsubnode_offsetsubnodes          r   r   z"CM_KEY_NODE._get_subkeys_recursive   s    			(q9	MI H$)t"3HXX((.)HIJLL]ddHH&&	 "jj83DIIO"&))JhJ"7 J"Z/43G3GGJJ!..OPSTbPcOde

!"&--"?  $::4III%J # 224KL 		: #::/ ! 

%224S5H4IT !! JsY   F<E DF<E*-F<F:F<E'$F<&E''F<*A
F74F<6F77F<c              #     K   | j                   j                  | j                  j                     }t	        |t
              st        d      |j                  | j                  j                        j                  j                  }| j                  j                  |_        	 |D ]U  }|dk7  s		 |j                  |      }|j                  j&                  j)                  t*        j,                  dz         sR| W y# t        t         f$ r"}t"        j%                  d|        Y d}~d}~ww xY w# t.        j0                  t         f$ r"}t"        j%                  d|        Y d}~yd}~ww xY ww)z,Returns a list of the Value nodes for a key.r   r   zInvalid address N_CM_KEY_VALUEz)Invalid address in get_values iteration: )r   r   r   r   r   r   r   r   	ValueListr   r   KeyListr   r   r   r   r
   r   r   r   r   r   r   r   rU   )rM   r   
child_listvr   excps         r   
get_valueszCM_KEY_NODE.get_values   s(    }}##DHH$7$78$-VWW]]4>>#6#6799AA
>>//
	 #6!#}}Q/ xx))229>>O3ST"
# 12IJ !'7v%>? !
 224KL 	LLDTFKL	s`   BE- 
D/ ,C;=6D/ 4D/ :E-;D,
D'"D/ 'D,,D/ /E*E% E-%E**E-c                 x    | j                   }|| j                  _        | j                  j                  d|d      S )z&Gets the name for the current key nodern   r   r   r|   rx   r   r{   rM   
namelengths     r   rb   zCM_KEY_NODE.get_name   /    __
$		yy~~h:	~RRr    c                    | j                   j                  | j                  j                     }t	        |t
              st        d      | j                  j                  |j                  dz   k(  r"|j                         j                  d      d   S |j                  | j                        j                         dz   | j                         z   S )Nz0Key was not instantiated on a RegistryHive layerr   rt   )r   r   r   r   r   r   r   r   root_cell_offsetrb   splitr   Parentget_key_path)rM   regs     r   r   zCM_KEY_NODE.get_key_path   s    mm""488#6#67#|,NOO 88??c22Q66<<>''-b11||DKK(557$>PPr    N)r!   r"   r#   r   rc   r   r   r   r	   rd   r   r   r   r   rb   r   r   r1   r    r   r   r      s    82d 2FXj&8&8&H&HI F.J .J(2(:(:(J(J.J	*$$44	5.J`HZ%7%7%G%GH ,S*,,<< S	Qc 	Qr    r   c                   Z    e Zd ZdZdej
                  j                  fdZdee	e
f   fdZy)CM_KEY_VALUEz3Extensions to extract data from CM_KEY_VALUE nodes.rE   c                 x    | j                   }|| j                  _        | j                  j                  d|d      S )z'Gets the name for the current key valuern   r   r   r   r   s     r   rb   zCM_KEY_VALUE.get_name   r   r    c           	         | j                   }d}| j                  j                  | j                  j                     }t        |t              st        d      |dz  rO|dz  }d|kD  s|dkD  rt        d|       |j                  | j                  j                  j                  |      }n|j                  j                  dk(  r|d	kD  r|j                  | j                        }t        |j                         D ]  }|j#                  |j$                  |dz  z         j'                  d
      }t        |t(              sD||j*                  k  sTt-        t.        |      }||j                  |j#                  |      j                  j                  |      z  }||z  } n|j                  | j                  dz   |      }t1        | j2                        }|t0        j4                  k(  rWt7        |      t9        j:                  d      k7  rt        d| j=                                t9        j>                  d|      \  }	|	S |t0        j@                  k(  rWt7        |      t9        j:                  d      k7  rt        d| j=                                t9        j>                  d|      \  }	|	S |t0        jB                  k(  rWt7        |      t9        j:                  d      k7  rt        d| j=                                t9        j>                  d|      \  }	|	S |t0        jD                  t0        jF                  t0        jH                  t0        jJ                  t0        jL                  t0        jN                  t0        jP                  t0        jR                  fv r|S |t0        jT                  k(  rytV        jY                  d| j2                          |S )z8Properly decodes the data associated with the value noder    z6Key value was not instantiated on a RegistryHive layerr   r   r   r   z<Unable to read inline registry value with excessive length: r   i @  zunsigned int)r   lengthz<Lz7Size of data does not match the type of registry value z>Lz<Qz)Unknown registry value type encountered: )-
DataLengthr   r   r   r   r   r   r   r   readDatar   r   Versionr   r   r   r   r   r{   rO   r   minBIG_DATA_MAXLENr   Typer(   lenstructcalcsizerb   unpackr)   r/   r%   r&   r*   r+   r'   r-   r,   r.   r$   r   r   )
rM   datalendatalayerbig_dataiblock_offsetamount	self_typeress
             r   decode_datazCM_KEY_VALUE.decode_data   s6    //$$TXX%8%89%.TUU Z
*G7{gk RSZR[\  zz$))--"6"6@ZZ1$6)9~~dii0H8>>* &  %~~hmmq1u.EFKK"  |S1$u'<'<< ':FEJJ$~~l;??FFv '  D v%G&$ ::dii!mW5D!$)),	///4yFOOD11 MdmmoM^_  ]]4.FSJ:::4yFOOD11 MdmmoM^_  ]]4.FSJ///4yFOOD11 MdmmoM^_  ]]4.FSJ  ''""&&$$66++88	
 	
 K... 	@LMr    N)r!   r"   r#   r   r   r	   rd   rb   r   rO   bytesr   r1   r    r   r   r      s6    =S*,,<< SRU3:. Rr    r   )r[   enumloggingr   typingr   r   r   volatility3.frameworkr   r   r   r	   %volatility3.framework.layers.registryr
   r   r   	getLoggerr!   r   r   Enumr   IntEnumr3   
StructTyperD   rQ   rg   r   r   r1   r    r   <module>r      s        , , L L  
		8	$.DII .(
$,, 
%## %W :&+'$$ &+RiQ'$$ iQX[7%% [r    