
    Xf                         d dl Z d dlZd dlZd dlmZmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZ d dlmZmZ  ej        e          Z G d dej        j                  ZdS )	    N)ListIteratorOptionalTupleType)
exceptions
interfaces	renderers)requirements)RegValueTypes)hivelistprintkeyc                   4   e Zd ZdZdZedeej        j	                 fd            Z
dedeeef         fdZededed	ed
edeej        j                 deej        j                 fd            Zdeeeeeeeef         f                  fdZdej        fdZdS )Certificatesz;Lists the certificates in the registry's Certificate Store.)   r   r   returnc           	          t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          t          j        d
ddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionr   dumpzExtract listed certificatesFT)r   r   defaultoptional)r   ModuleRequirementPluginRequirementr   HiveListr   PrintKeyBooleanRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/plugins/windows/registry/certificates.pyget_requirementszCertificates.get_requirements   s     *,()4  
 *(99   *(99   +9	  
 	
    datac                 z   t          j                    }t          j                    }t          |          dk    rt          j        d|dd                   \  }}|dd|z            |d|z   d          }}|dk    r$t          |d                              d          }n|dk    r|}t          |          dk    ||fS )N   z<QIr   l       zutf-16 l        )r
   NotAvailableValuelenstructunpackstrstrip)selfr)   r   certificate_datactypeclengthcvalues          r&   
parse_datazCertificates.parse_data)   s    *,,$688$ii"nn#]5$qt*==NE7R'\ 12Dg4HDF##68,,226::+%%#)  $ii"nn &''r(   r4   hive_offsetreg_sectionkey_hashopen_methodc                     	 d                     |||          } ||          }|                    |           |S # t          j        $ r! t                              d|d           Y nw xY wd S )Nz{}-{}-{}.crtz#Unable to dump certificate file at z#x)formatwriter   InvalidAddressExceptionvollogdebug)r%   r4   r9   r:   r;   r<   	dump_namefile_handles           r&   dump_certificatezCertificates.dump_certificate5   s    	Q&--k;QQI%+i00K.///1 	Q 	Q 	QLLO{OOOPPPPP	Qts   8; -A+*A+c              #   V  K   | j         j        | j        d                  }t          j                            | j         | j        |j        |j                  D ]}dD ]}t          j
        t          t          j                  5  |                    |d          }t          j                            ||d          D ]N\  }}}}}	}
|sAt%          |
j                  j        dk    r#|                     |
                                          \  }}|                                                    |                                          t3          |          z   dz   }|||                    d	|                   }||                    d	          dz   d          }| j        d
         rXt7          |t8          j        j                  s9|                     ||j         ||| j!                  }|r|"                                 d||||ffV  P	 d d d            n# 1 swxY w Y   ːd S )Nr   )base_config_path
layer_namesymbol_table)zMicrosoft\SystemCertificatesz%Software\Microsoft\SystemCertificatesT)return_list)recurse
REG_BINARYr   \r   r   )#contextmodulesconfigr   r"   
list_hivesconfig_pathrH   symbol_table_name
contextlibsuppressKeyErrorr   r@   get_keyr   r#   key_iteratorr   r   r   r8   decode_datacasefoldindexr.   rindex
isinstancer	   r
   BaseAbsentValuerE   r9   openclose)r3   r   hivetop_key	node_path_depthis_key_last_write_timekey_path_volatilitynoder   r4   unique_key_offsetr:   r;   rD   s                    r&   
_generatorzCertificates._generatorG   s     %dk(&;<%00L!-(1	 1 
 
 2	N 2	ND ,N ,N  (:3UVV (N (N $W$ G GI "*77iQU7VV%N %N ( #% N-	*B*B*G<*W*W59__TEUEUEWEW5X5X2D"2 ( 1 1 3 3 9 9':J:J:L:L M M"%g,,!/"#!$ .
 +3 1HNN$(*;5" 5" !"+K
 (00E0E0I0K0K'LH#{62 <'1$4$.$8$H(" (" !< 372G2G(8(,(8(3(0(,	3& 3&K (3 %<(3(9(9(;(;(;#$wXt&L"MMMMK%N(N (N (N (N (N (N (N (N (N (N (N (N (N (N (N	,N2	N 2	Ns   F
HH!Hc                     t          j        dt          fdt          fdt          fdt          fg|                                           S )NzCertificate pathzCertificate sectionzCertificate IDzCertificate name)r
   TreeGridr1   rk   )r3   s    r&   runzCertificates.run~   sK    !#S)&,!3'#S)	 OO
 
 	
r(   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r	   configurationRequirementInterfacer'   bytesr   r1   r8   intr   pluginsFileHandlerInterfacer   rE   r   rk   r
   rm   rn    r(   r&   r   r      sG       EE"+
j&>&S!T 
 
 
 [
*
(u 
(sEz): 
( 
( 
( 
(   	
  *,AB 
*$9	:   ["5NHU3c3S6H0I+I%JK 5N 5N 5N 5Nn	
Y' 	
 	
 	
 	
 	
 	
r(   r   )rT   loggingr/   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   #volatility3.framework.configurationr   9volatility3.framework.symbols.windows.extensions.registryr   $volatility3.plugins.windows.registryr   r   	getLoggerro   rA   ry   PluginInterfacer   r{   r(   r&   <module>r      s          8 8 8 8 8 8 8 8 8 8 8 8 8 8 C C C C C C C C C C < < < < < < S S S S S S C C C C C C C C		8	$	$y
 y
 y
 y
 y
:%5 y
 y
 y
 y
 y
r(   