
    Xf                         d dl Z d dlZd dlZd dlmZmZmZmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZ d dlmZmZ  ej(                  e      Z G d dej.                  j0                        Zy)	    N)ListIteratorOptionalTupleType)
exceptions
interfaces	renderers)requirements)RegValueTypes)hivelistprintkeyc                   B   e Zd ZdZdZedeej                  j                     fd       Z
dedeeef   fdZededed	ed
edeej"                  j$                     deej"                  j$                     fd       Zdeeeeeeeef   f      fdZdej0                  fdZy)Certificatesz;Lists the certificates in the registry's Certificate Store.)   r   r   returnc           	          t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
ddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionr   dumpzExtract listed certificatesFT)r   r   defaultoptional)r   ModuleRequirementPluginRequirementr   HiveListr   PrintKeyBooleanRequirement)clss    c/home/panchajanya/Development/work/volatility3/volatility3/plugins/windows/registry/certificates.pyget_requirementszCertificates.get_requirements   s     **,()4
 **(9(99 **(9(99 ++9	
 	
    datac                 <   t        j                         }t        j                         }t        |      dkD  rct        j                  d|dd       \  }}|dd|z    |d|z   d  }}|dk(  rt        |d      j                  d      }n|dk(  r|}t        |      dkD  rc||fS )N   z<QIr   l       zutf-16 l        )r
   NotAvailableValuelenstructunpackstrstrip)selfr)   r   certificate_datactypeclengthcvalues          r&   
parse_datazCertificates.parse_data)   s    **,$668$i"n#]]5$q*=NE7R'\2Dg4HDF#68,226:+%#)  $i"n &''r(   r4   hive_offsetreg_sectionkey_hashopen_methodc                     	 dj                  |||      } ||      }|j                  |       |S # t        j                  $ r t        j                  d|d       Y y w xY w)Nz{}-{}-{}.crtz#Unable to dump certificate file at z#x)formatwriter   InvalidAddressExceptionvollogdebug)r%   r4   r9   r:   r;   r<   	dump_namefile_handles           r&   dump_certificatezCertificates.dump_certificate5   sl    	Q&--k;QI%i0K./11 	QLL>{2>NOP	Qs   -0 ,AAc              #   b  K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  |j                  |j                        D ]  }dD ]  }t        j                  t        t        j                        5  |j                  |d      }t        j                   j#                  ||d      D ]2  \  }}}}}	}
|rt%        |
j&                        j(                  dk(  s1| j+                  |
j-                               \  }}|j/                         j1                  |j/                               t3        |      z   dz   }|||j1                  d	|       }||j5                  d	      dz   d  }| j                  d
   r_t7        |t8        j:                  j<                        s;| j?                  ||j@                  ||| jB                        }|r|jE                          d||||ff 5 	 d d d          y # 1 sw Y   xY ww)Nr   )base_config_path
layer_namesymbol_table)zMicrosoft\SystemCertificatesz%Software\Microsoft\SystemCertificatesT)return_list)recurse
REG_BINARYr   \r   r   )#contextmodulesconfigr   r"   
list_hivesconfig_pathrH   symbol_table_name
contextlibsuppressKeyErrorr   r@   get_keyr   r#   key_iteratorr   r   r   r8   decode_datacasefoldindexr.   rindex
isinstancer	   r
   BaseAbsentValuerE   r9   openclose)r3   r   hivetop_key	node_path_depthis_key_last_write_timekey_path_volatilitynoder   r4   unique_key_offsetr:   r;   rD   s                    r&   
_generatorzCertificates._generatorG   s+    %%dkk(&;<%%00LL!--((11	 1 
 2	ND ,N  ((:3U3UV (N $W$ GI "**77iQU7V%N ( #%-		*B*G*G<*W59__TEUEUEW5X2D"2 ( 1 1 3 9 9':J:J:L M"%g,!/"#!$ .
 +3 1HNN$(*;5"+K
 (00E0I0K'LH#{{62'1$4$.$8$8$H$H(" 372G2G(8(,(8(8(3(0(,		3&K (3(3(9(9(;#$wXt&L"MMK%N(N (N	,N2	N(N (Ns,   B$H/&AH"*"H"DH"H/"H,'H/c                     t        j                  dt        fdt        fdt        fdt        fg| j                               S )NzCertificate pathzCertificate sectionzCertificate IDzCertificate name)r
   TreeGridr1   rk   )r3   s    r&   runzCertificates.run~   sF    !!#S)&,!3'#S)	 OO
 	
r(   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r	   configurationRequirementInterfacer'   bytesr   r1   r8   intr   pluginsFileHandlerInterfacer   rE   r   rk   r
   rm   rn    r(   r&   r   r      s    E"+
j&>&>&S&S!T 
 
*
(u 
(sEz): 
(   	
  *,,AAB 
*$$99	: "5NHU3c3S6H0I+I%JK 5Nn	
Y'' 	
r(   r   )rT   loggingr/   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   #volatility3.framework.configurationr   9volatility3.framework.symbols.windows.extensions.registryr   $volatility3.plugins.windows.registryr   r   	getLoggerro   rA   ry   PluginInterfacer   r{   r(   r&   <module>r      sO       8 8 C C < S C			8	$y
:%%55 y
r(   