
    [
#g,&                        d dl Z d dlZd dlmZ d dlmZmZmZmZ d dlm	Z	m
Z
mZmZmZ d dlmZ  e j                   e      Z G d dej&                        Z G d d	ej&                        Z G d
 dej&                        ZeeedZy)    N)datetime)DictOptionalTupleUnion)	constants
exceptions
interfacesobjects	renderers)
conversionc                   <    e Zd ZdZdej
                  j                  dedej                  j                  de
deeee
ej                  j                  f   f   ddf fd	Zedeeej$                  j&                  f   fd
       Zedee
ej$                  j&                  f   fd       Zedeeej$                  j&                  f   fd       Zedeeej$                  j&                  f   fd       Zedeeej$                  j&                  f   fd       ZdefdZ xZS )SHIM_CACHE_ENTRYzJClass for abstracting variations in the shimcache LRU list entry structurecontext	type_nameobject_infosizemembersreturnNc                 r    t         |   |||||       d | _        d | _        d | _        d | _        d | _        y N)super__init__
_exec_flag
_file_path
_file_size_last_modified_last_updatedselfr   r   r   r   r   	__class__s         l/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/shimcache.pyr   zSHIM_CACHE_ENTRY.__init__   s?     	)[$H"!    c                 V   | j                   | j                   S t        | d      rCt        | j                  d      r-| j                  j                  dz  dk(  | _         | j                   S t        | d      r#| j                  dz  dk(  | _         | j                   S t        | d      r%t        | j                  d      r| j                  j                  }| j                  j
                  }| j                  j                  | j                  j                     j                  ||      st        j                         | _         | j                  j                  | j                  j                     j                  ||      }|st        j                         | _         	 t        t        j                   d|      d         | _         | j                   S t        j$                         | _         | j                   S # t        j"                  $ r' t        j                         | _         Y | j                   S w xY w)zChecks if InsertFlags fields has been bitwise OR'd with a value of 2.
        This behavior was observed when processes are created by CSRSS.ListEntryDetailInsertFlags   
BlobBufferz<Ir   )r   hasattrr%   r&   r(   BlobSize_contextlayersvolnative_layer_nameis_validr   UnparsableValuereadboolstructunpackerrorNotApplicableValue)r    blob_offset	blob_sizeraw_flags       r"   	exec_flagzSHIM_CACHE_ENTRY.exec_flag"   s    ??&??"4*+  -1
 #22>>DIDO< 9 T=)"..49DO6 3 T,-'  ,3
 ..99K,,55I==''(B(BCLLY #,";";"=}}++DHH,F,FGLLYH "+";";"=>"&v}}T8'DQ'G"H  (::<DO << >"+";";"=
 >s   'G. .,H('H(c                 p   | j                   | j                   S 	 | j                  | _         | j                   dk  rd| _         | j                   S # t        $ r' t        j                         | _         Y | j                   S t
        j                  $ r' t        j                         | _         Y | j                   S w xY w)Nr   )r   FileSizeAttributeErrorr   r6   r	   InvalidAddressExceptionUnreadableValuer    s    r"   	file_sizezSHIM_CACHE_ENTRY.file_sizeL   s    ??&??"	:"mmDO""#   	='::<DO  11 	:'779DO	:s   'A "B5<+B54B5c                    | j                   | j                   S 	 t        j                  | j                  j                  j
                        | _         | j                   S # t        $ r< t        j                  | j                  j
                        | _         Y | j                   S t        j                  $ r' t        j                         | _         Y | j                   S w xY wr   )r   r   wintime_to_datetimer%   LastModifiedQuadPartr=   r	   r>   r   r?   r@   s    r"   last_modifiedzSHIM_CACHE_ENTRY.last_modified\   s    *&&&		>","@"@$$11::#D """  	","@"@!!**#D """ 11 	>"+";";"=D"""	>s   8A 7C"+CCc                    | j                   | j                   S 	 t        j                  | j                  j                        | _         | j                   S # t
        $ r' t        j                         | _         Y | j                   S w xY wr   )r   r   rC   
LastUpdaterE   r=   r   r6   r@   s    r"   last_updatezSHIM_CACHE_ENTRY.last_updatem   s~    )%%%	@!+!?!?(("D !!!  	@!*!=!=!?D!!!	@s   .A "BBc                 l   | j                   | j                   S t        | j                  d      s<| j                  j                  d| j                  j                  j
                  d      S 	 | j                  j                  | j                  j                     j                  | j                  j                  | j                  j                        xs d}|j                  dd      | _         | j                   S # t        j                  $ r' t        j                          | _         Y | j                   S w xY w)	NBufferstringzutf-16le)
max_lengthencodingr#   zutf-16replace)errors)r   r)   Pathcastr-   countr+   r,   r.   r1   rK   Lengthdecoder	   r>   r   r?   )r    file_path_raws     r"   	file_pathzSHIM_CACHE_ENTRY.file_path{   s    ??&??"tyy(+99>>TYY]]%8%8: "  		:$$TXX%?%?@EEII$$dii&6&6  	  ,228I2NDO  11 	:'779DO	:s   ,BC9 9,D32D3c                 >   	 t        | d      s1t        | j                  xr | j                  xr | j                        S | j
                  j                  dk7  r| j
                  j                  j                         | j
                  j                  j                         k7  rd| j
                  j                  j                  | j
                  j                  j                  j                         j                  j                  k(  ryy# t        j                  $ r Y yw xY w)zShim cache validation is limited to ensuring that a subset of the
        pointers in the LIST_ENTRY field are valid (similar to validation of
        ERESOURCE)	ListEntryr   TF)r)   r2   rF   rI   rA   rY   FlinkBlinkdereferencer-   offsetr	   r>   r@   s    r"   r/   zSHIM_CACHE_ENTRY.is_valid   s    	4-D..V43C3CVWW $$)NN((446~~++779: NN((..~~++11==?CCJJK
 11 		s   <D CD DD)__name__
__module____qualname____doc__r
   r   ContextInterfacestrr   ObjectInformationintr   r   Templater   propertyr   r2   r   BaseAbsentValuer:   rA   r   rF   rI   rW   r/   __classcell__r!   s   @r"   r   r      s   T"##44" "  ''99	"
 " c5j&8&8&A&A!ABBC" 
" '5z';';'K'K!KL ' 'R 5j&:&:&J&J!JK   #uXz/C/C/S/S%ST # #  "U8Z-A-A-Q-Q#QR " " 5j&:&:&J&J!JK  ,$ r#   r   c                        e Zd Zdej                  j
                  dedej                  j                  de	de
eee	ej                  j                  f   f   ddf fdZedee   fd	       Zd
e	de	defdZ xZS )SHIM_CACHE_HANDLEr   r   r   r   r   r   Nc                 ,    t         |   |||||       y r   )r   r   r   s         r"   r   zSHIM_CACHE_HANDLE.__init__   s     	)[$Hr#   c                 .   	 | j                   j                         sy 	 | j                  j                  | j                         t        j                  z   dz   | j                  j                  | j                  | j                  j                        }| j                  j                  | j                  j                     j                  | j                  j                  j                        sy |j                  j                  |j                  j                  z   }| j                  j                  | j                         t        j                  z   dz   | j                  j                  |      }|j                         sy |S # t        j                  $ r Y y w xY w)N_RTL_AVL_TABLEr   )	eresourcer/   r	   r>   r+   objectget_symbol_table_namer   BANGr-   
layer_namertl_avl_tabler.   r,   r]   r   )r    ru   offset_headheads       r"   rw   zSHIM_CACHE_HANDLE.head   sD   	>>**, -
 ,,&&(9>>9<LLHHHH&&	
 }}##DHH$7$78AA""))
 #''..1B1B1G1GG}}##&&(9>>9<NNHH
 }}5 11 		s   E> >FFavl_section_startavl_section_endc                    | j                   j                  dk(  ryt        j                  dt	        | j                   j                                | j
                  j                  | j                   j                     j                  | j                   j                        rB| j                  j                         r(| j                  j                  ||      r| j                  sy| j                  j                         S )Nr   Fz&Checking SHIM_CACHE_HANDLE validity @ )r-   r]   vollogdebughexr+   r,   rt   r/   rp   ru   rw   )r    rx   ry   s      r"   r/   zSHIM_CACHE_HANDLE.is_valid   s    88??a=c$((//>R=STU MM  !4!45>>txxO'')""++,=O		yy!!##r#   )r^   r_   r`   r
   r   rb   rc   r   rd   re   r   r   rf   r   rg   r   r   rw   r2   r/   ri   rj   s   @r"   rl   rl      s    I##44I I  ''99	I
 I c5j&8&8&A&A!ABBCI 
I h/0  @$# $ $ $r#   rl   c                        e Zd ZdededefdZy)RTL_AVL_TABLE
page_startpage_endr   c                    	 | j                   j                  | j                   j                  j                  k7  r.t        j                  d| j                  j                   d       y| j                  |k  s| j                  |kD  r.t        j                  d| j                  j                   d       y| j                  |k  s| j                  |kD  r.t        j                  d| j                  j                   d       y| j                  j                  j                  | j                  j                  j                  k(  s| j                  j                  j                  | j                  j                  j                  k(  sA| j                  j                  j                  | j                  j                  j                  k(  r.t        j                  d| j                  j                   d       yy# t        j                  $ r Y yw xY w)NzRTL_AVL_TABLE @ z3 Invalid: Failed BalancedRoot parent equality checkFz, Invalid: Failed AllocateRoutine range checkz+ Invalid: Failed CompareRoutine range checkz@ Invalid: Failed (Compare|Allocate|Free)Routine uniqueness checkT)BalancedRootParentr-   r]   r{   r|   AllocateRoutineCompareRoutineFreeRoutiner	   r>   )r    r   r   s      r"   r/   zRTL_AVL_TABLE.is_valid   s   	  ''4+<+<+@+@+G+GG&txx&77jk %%
2d6J6JX6U&txx&77cd $$z1T5H5H85S&txx&77bc  %%))00D4G4G4K4K4R4RR((,,33t7G7G7K7K7R7RR''++22d6F6F6J6J6Q6QQ&txx&77wx 11 		s'   A$G1 'AG1 3AG1 ?C0G1 1HHN)r^   r_   r`   re   r2   r/    r#   r"   r   r      s     3  #  $  r#   r   )rl   r   ro   )loggingr3   r   typingr   r   r   r   volatility3.frameworkr   r	   r
   r   r   0volatility3.framework.symbols.windows.extensionsr   	getLoggerr^   r{   
StructTyper   rl   r   class_typesr   r#   r"   <module>r      s~   
    / / W W G			8	$^w)) ^B:$** :$z!G&& !J +(#r#   