# Path: haystack/mappings/vol.py
# class VolatilityProcessMapper(interfaces.IMemoryLoader):
# 
#     def __init__(self, imgname, profile, pid):
#         self.pid = pid
#         self.imgname = imgname
#         # FIXME for some reason volatility is able to autodetect.
#         # but not with this piece of code.
#         self.profile = profile
#         #self.profile = None
#         self._memory_handler = None
#         self._unload_volatility()
#         self._init_volatility()
# 
#     def _unload_volatility(self):
#         '''we cannot have volatility already loaded.
#         we need to remove it'''
#         for mod in sys.modules.keys():
#             if 'volatility' in mod:
#                 del sys.modules[mod]
# 
#     def _init_volatility(self):
#         #import sys
#         # for mod in sys.modules.keys():
#         #    if 'parse' in mod:
#         #        del sys.modules[mod]
#         #        print "deleted",mod
#         #import sys
#         # if len(sys.argv) > 3:
#         #    #sys.args=[sys.args[3]]
#         #    sys.argv=[sys.argv[0],'-f',sys.argv[3]]
#         # print 'after modif',sys.argv
#         import volatility.conf as conf
#         import volatility.registry as registry
#         registry.PluginImporter()
#         config = conf.ConfObject()
#         import volatility.commands as commands
#         import volatility.addrspace as addrspace
#         import volatility.utils as volutils
#         registry.register_global_options(config, commands.Command)
#         registry.register_global_options(config, addrspace.BaseAddressSpace)
#         # Dying because it cannot parse argv options
#         # apparently, it was not required to parse options. hey.
#         # config.parse_options()
#         #addr_space = volutils.load_as(config,astype = 'any')
#         #print config.PROFILE
#         #import code
#         #code.interact(local=locals())
#         config.PROFILE = self.profile
#         #_target_platform.LOCATION = "file:///media/memory/private/image.dmp"
#         config.LOCATION = "file://%s" % self.imgname
#         config.PID = str(self.pid)
# 
#         self.config = config
# 
#         import volatility.plugins.vadinfo as vadinfo
# 
#         command = vadinfo.VADWalk(config)
#         command.render_text = partial(my_render_text, self, command)
#         command.execute()
#         # works now.
#         #for x in self._memory_handler.get_mappings():
#         #    print x
#         #import code
#         #code.interact(local=locals())
# 
#     def make_memory_handler(self):
#         return self._memory_handler


import logging
import unittest
            import volatility
from haystack.mappings.vol import VolatilityProcessMapper
from test.testfiles import zeus_1668_vmtoolsd_exe
from test.testfiles import zeus_856_svchost_exe
        from haystack.allocators.win32 import winxp_32
        # PID 676 has 118 _memory_handler
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        self.assertEqual(len(memory_handler.get_mappings()), 118)

        pid = 1668
        # PID 1668 has 159 _memory_handler
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        self.assertEqual(len(memory_handler.get_mappings()), 159)

    def test_is_heaps_1168(self):
        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 1668
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        finder = memory_handler.get_heap_finder()
        walkers = finder.list_heap_walkers()
        self.assertEqual(len(walkers), len(zeus_1668_vmtoolsd_exe.known_heaps))
        for addr, size in zeus_1668_vmtoolsd_exe.known_heaps:
            heap_mapping = memory_handler.get_mapping_for_address(addr)
            heap_walker = finder.get_heap_walker(heap_mapping)
            self.assertIsNotNone(heap_walker)
            heap_addr = heap_walker.get_heap_address()
            self.assertEqual(heap_addr, addr)

    @unittest.skip('number of heaps is still a open question')
    def test_is_heaps_856(self):
        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 856

# Path: haystack/mappings/vol.py
# class VolatilityProcessMapper(interfaces.IMemoryLoader):
# 
#     def __init__(self, imgname, profile, pid):
#         self.pid = pid
#         self.imgname = imgname
#         # FIXME for some reason volatility is able to autodetect.
#         # but not with this piece of code.
#         self.profile = profile
#         #self.profile = None
#         self._memory_handler = None
#         self._unload_volatility()
#         self._init_volatility()
# 
#     def _unload_volatility(self):
#         '''we cannot have volatility already loaded.
#         we need to remove it'''
#         for mod in sys.modules.keys():
#             if 'volatility' in mod:
#                 del sys.modules[mod]
# 
#     def _init_volatility(self):
#         #import sys
#         # for mod in sys.modules.keys():
#         #    if 'parse' in mod:
#         #        del sys.modules[mod]
#         #        print "deleted",mod
#         #import sys
#         # if len(sys.argv) > 3:
#         #    #sys.args=[sys.args[3]]
#         #    sys.argv=[sys.argv[0],'-f',sys.argv[3]]
#         # print 'after modif',sys.argv
#         import volatility.conf as conf
#         import volatility.registry as registry
#         registry.PluginImporter()
#         config = conf.ConfObject()
#         import volatility.commands as commands
#         import volatility.addrspace as addrspace
#         import volatility.utils as volutils
#         registry.register_global_options(config, commands.Command)
#         registry.register_global_options(config, addrspace.BaseAddressSpace)
#         # Dying because it cannot parse argv options
#         # apparently, it was not required to parse options. hey.
#         # config.parse_options()
#         #addr_space = volutils.load_as(config,astype = 'any')
#         #print config.PROFILE
#         #import code
#         #code.interact(local=locals())
#         config.PROFILE = self.profile
#         #_target_platform.LOCATION = "file:///media/memory/private/image.dmp"
#         config.LOCATION = "file://%s" % self.imgname
#         config.PID = str(self.pid)
# 
#         self.config = config
# 
#         import volatility.plugins.vadinfo as vadinfo
# 
#         command = vadinfo.VADWalk(config)
#         command.render_text = partial(my_render_text, self, command)
#         command.execute()
#         # works now.
#         #for x in self._memory_handler.get_mappings():
#         #    print x
#         #import code
#         #code.interact(local=locals())
# 
#     def make_memory_handler(self):
#         return self._memory_handler


# Path: test/haystack/mappings/test_vol.py
import logging
import unittest
            import volatility
from haystack.mappings.vol import VolatilityProcessMapper
from test.testfiles import zeus_1668_vmtoolsd_exe
from test.testfiles import zeus_856_svchost_exe
        from haystack.allocators.win32 import winxp_32

        # PID 676 has 118 _memory_handler
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        self.assertEqual(len(memory_handler.get_mappings()), 118)

        pid = 1668
        # PID 1668 has 159 _memory_handler
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        self.assertEqual(len(memory_handler.get_mappings()), 159)

    def test_is_heaps_1168(self):
        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 1668
        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)
        memory_handler = mapper.make_memory_handler()
        finder = memory_handler.get_heap_finder()
        walkers = finder.list_heap_walkers()
        self.assertEqual(len(walkers), len(zeus_1668_vmtoolsd_exe.known_heaps))
        for addr, size in zeus_1668_vmtoolsd_exe.known_heaps:
            heap_mapping = memory_handler.get_mapping_for_address(addr)
            heap_walker = finder.get_heap_walker(heap_mapping)
            self.assertIsNotNone(heap_walker)
            heap_addr = heap_walker.get_heap_address()
            self.assertEqual(heap_addr, addr)

    @unittest.skip('number of heaps is still a open question')
    def test_is_heaps_856(self):
        f = '/home/jal/outputs/vol/zeus.vmem'
        pid = 856

        mapper = VolatilityProcessMapper(f, "WinXPSP2x86", pid)