
    Xf1                     0   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	m
Z
mZmZmZ d dlmZ d dlmZmZmZmZmZ d dlmZ  ej        e          Z G d dej                  Z G d d	e j        
          Z G d dej        j                  Z dS )    N)	GeneratorIterableListOptionalTupleType)	framework)	automagic
exceptions
interfacesplugins	renderers)requirementsc                       e Zd ZdZdZdZdZdS )TimeLinerType            N)__name__
__module____qualname__CREATEDMODIFIEDACCESSEDCHANGED     Y/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/timeliner.pyr   r      s"        GHHGGGr   r   c                   f    e Zd ZdZej        deeee	e
j
        f         ddf         fd            ZdS )TimeLinerInterfacezOInterface defining methods that timeliner will use to generate a body
    file.returnNc                     dS )zMethod generates Tuples of (description, timestamp_type, timestamp)

        These need not be generated in any particular order, sorting
        will be done later
        Nr   selfs    r   generate_timelinez$TimeLinerInterface.generate_timeline    s      r   )r   r   r   __doc__abcabstractmethodr   r   strr   datetimer&   r   r   r   r!   r!      se          		5mX->>?tK	L     r   r!   )	metaclassc                       e Zd ZdZdZ fdZeddee         dee	         fd            Z
edeej        j                 fd            Zd	 Zd
ee         deeeeef                           fdZd Zd Zd Zd Zd Z xZS )	TimelinerzcRuns all relevant plugins that provide time related information and
    orders the results by time.)r   r   r   c                 d     t                      j        |i | i | _        d | _        d | _        d S N)super__init__timelineusable_plugins
automagics)r%   argskwargs	__class__s      r   r2   zTimeliner.__init__1   s9    $)&)))"SWr   Nselected_listr"   c                    t          t          j        t                              }dt          dt
          t                   dt          fd}|r'dt          dt
          t                   dt          fd}|ng fd|D             S )Nnameselectedr"   c                     dS )NTr   r;   r<   s     r   passthroughz1Timeliner.get_usable_plugins.<locals>.passthrough=   s    4r   c                 :     t           fd|D                       S )Nc                     g | ]}|v S r   r   ).0sr;   s     r   
<listcomp>zHTimeliner.get_usable_plugins.<locals>.filter_plugins.<locals>.<listcomp>D   s    888!AI888r   )anyr>   s   ` r   filter_pluginsz4Timeliner.get_usable_plugins.<locals>.filter_pluginsC   s&    8888x888999r   c                 6    g | ]} |j                   |S r   )r   )rB   plugin_classfilter_funcr9   s     r   rD   z0Timeliner.get_usable_plugins.<locals>.<listcomp>J   s>     
 
 
{<0-@@

 
 
r   )listr	   class_subclassesr!   r*   r   bool)clsr9   plugin_listr?   rF   rI   s    `   @r   get_usable_pluginszTimeliner.get_usable_plugins7   s     956HIIJJ	c 	T#Y 	4 	 	 	 	 " 	:S :DI :$ : : : : )KKM
 
 
 
 
 +
 
 
 	
r   c                     t          j        dddd          t          j        ddt          dg           t          j        d	d
dd          gS )Nrecord-configz<Whether to record the state of all the plugins once completeTF)r;   descriptionoptionaldefaultplugin-filterz)Only run plugins featuring this substring)r;   rR   element_typerS   rT   create-bodyfilez6Whether to create a body file whilst producing results)r   BooleanRequirementListRequirementr*   )rM   s    r   get_requirementszTimeliner.get_requirementsP   sx     +$Z	   ($G    +&T	  
 	
r   c                 F    |d         }d fd|dd          D             S )Nr   c                     t          j         ddt           j                  }t          | t          j        j                  r|S | S )Nr      )daymonthyear)r+   MAXYEAR
isinstancer   r   BaseAbsentValue)	timestampmax_dates     r   sortablez*Timeliner._sort_function.<locals>.sortablek   s?    (Qbx?OPPPH)Z%9%IJJ  r   c                 &    g | ]} |          S r   r   )rB   rd   rf   s     r   rD   z,Timeliner._sort_function.<locals>.<listcomp>q   s#    >>>	##>>>r   r   r   )r%   itemdatarf   s      @r   _sort_functionzTimeliner._sort_functionh   s?    Aw	 	 	 ?>>>T!""X>>>>r   runnable_pluginsc              #   n  K   g }| j                             dd          r,|                     d          }t          j        |d          }nd}d}|D ]{}|j        j        }|                     |                    |          dz  t          |          z  d| d           	 t                              t          j        d	|            |                                D ]~\  }}}	| j                            ||fi           }
|
                    |d          .t                              d
                    ||                     |	|
|<   |
| j        ||f<   |                    d|||
                    t&          j        t+          j                              |
                    t&          j        t+          j                              |
                    t&          j        t+          j                              |
                    t&          j        t+          j                              gf           |r)| j        ||f         }
|                     |
          r|                    d                    ||                     |          |                     |
                    t&          j        d                    |                     |
                    t&          j        d                    |                     |
                    t&          j        d                    |                     |
                    t&          j        d                                         # t<          $ rb t                              t          j        d|            t                              t          j        tA          j!                               Y yw xY wtE          || j#                  D ]}|V  | j                             dd          r,|r,|$                                 |$                                 dS dS dS )z_Takes a timeline, sorts it and output the data from each relevant
        row from each plugin.rW   Tzvolatility.bodywrite_throughNd   zRunning plugin z...zRunning zEMultiple timestamps for the same plugin/file combination found: {} {}r   z|{} - {}|0|0|0|0|0|{}|{}|{}|{}
 z#Exception occurred running plugin: )key)%configgetopenioTextIOWrapperr8   r   _progress_callbackindexlenvolloglogloggingINFOr&   r3   debugformatappendr   r   r   NotApplicableValuer   r   r   _any_time_presentwrite_sanitize_body_format_text_format	ExceptionDEBUG	traceback
format_excsortedrj   close)r%   rk   ri   	file_datafppluginplugin_namerh   timestamp_typerd   times	data_items               r   
_generatorzTimeliner._generators   sO       ;??,d33 			"344I!)4@@@BBIB& H	B H	BF *3K##!''//#5#>N:O:OO2+222  BB

7<)AK)A)ABBB7=7O7O7Q7Q ; ;3D.) M--{D.A2FFEyy66Bcjj +T   
 -6E.)9>DM;"56KK + $ %		$1$9$-$@$B$B!" !" !&		$1$:$-$@$B$B!" !" !&		$1$:$-$@$B$B!" !" !&		$1$9$-$@$B$B!" !"  6   ${D.A B  11%88 HH B I I$/$($>$>t$D$D$($5$5(-		-2H"(M(M%& %& %)$5$5(-		-2H"(M(M%& %& %)$5$5(-		-2G(L(L%& %& %)$5$5(-		-2G(L(L%& %&!" !"  U;x  B B B

L"U"U"U   

7=)*>*@*@AAAAA	B  $*=>>> 	 	IOOOO ;??,d33 	" "


!!!!!	" 	"" "s   "J<M  A(OOc                 .    |                     dd          S )N|_)replacer%   values     r   r   zTimeliner._sanitize_body_format   s    }}S#&&&r   c                     t           D ]B}t          |                    |t          j                  t
          j        j                  s dS CdS )NTF)r   rb   rs   r   r   r   rc   )r%   r   times      r   r   zTimeliner._any_time_present   sU    ! 	 	D		$	 <==$4   tt	
 ur   c                     t          |t          j        j                  rdS t          |t          j                  r!t          |                                          S |S )z5Formats a value as text, in case it is an AbsentValue0)rb   r   r   rc   r+   intrd   r   s     r   r   zTimeliner._text_format   sQ    eZ1ABB 	3eX.// 	*u(()))r   c           	         | j         p|                                 | _         | j        pt          j        | j                  | _        g }i }| j        d         }| j         D ]}	 t          j        | j        |          }|                                D ]X}|j	        |v rM||j	                 \  }}||k    r7|| j
        j        t          j                            | j        |j                  <   Yt!          j        | j
        ||| j        | j        | j                                                  D ]9}|j	        |vr.j                            |j	        d          }|r||f||j	        <   :t+          t,                    r?t/          |          rt1          fd|D                       r|                               \# t4          j        $ r5}	t8                              d|j         d|	j                    Y d}	~	d}	~	ww xY w| j                            dd          ri }
|D ][t?                                                     }|D ]5}||         |
t          j                            j!        j        |          <   6\|                     d          5 }tE          j#        |d	
          5 }tI          j%        |
|d	d           ddd           n# 1 swxY w Y   ddd           n# 1 swxY w Y   tM          j'        dtP          fdtP          fdtR          j)        fdtR          j)        fdtR          j)        fdtR          j)        fg| *                    |                    S )zIsolate each plugin and run it.rU   Nc                 B    g | ]}|j         d z   j        j        z   v S ).)r   r8   r   )rB   filterr   s     r   rD   z!Timeliner.run.<locals>.<listcomp>  sG        !' #%0369I9RRS  r   zUnable to satisfy z: rQ   Fzconfig.jsonTrm   r   )	sort_keysindentPluginDescriptionzCreated DatezModified DatezAccessed DatezChanged Date)columns	generator)+r4   rO   r5   r
   	available_contextrr   choose_automagicrZ   r;   contextr   configuration	path_joinconfig_pathr   r   construct_pluginrw   rt   rs   rb   r!   ry   rE   r   r   UnsatisfiedExceptionrz   r~   unsatisfieddictbuild_configurationr8   ru   rv   jsondumpr   TreeGridr*   r+   r   )r%   plugins_to_runrequirement_configsfilter_listrH   r5   requirement
config_reqconfig_valueexcptotal_configold_dictentryr   r   r   s                  @r   runzTimeliner.run   sm    #1NT5L5L5N5N/OY-@-O-O k/2 / .	 .	L-&7VV
#/#@#@#B#B - -K"'+>>>3F{GW3X0
L&*44
 !-	 !L/ * 8 B B$($4l6K!" !" !1L $+I  $*#:#:#<#<  K"'/BBB'-}'8'89I4'P'P'  + ,E/0@A
 f&899 6{++ 6s    +6  0 0 6 '--f5552   T)>TT$BRTT    ;???E22 	JL( ( ( : : < <==% ( (E
 !	 !"0::",5u  ( =)) JY%itDDD JIlB$qIIIIJ J J J J J J J J J J J J J JJ J J J J J J J J J J J J J J !3$!23 ("34 ("34!23 oon55

 

 

 
	
sO   #EF;;G?
*G::G?K%)KK%K	K%K	K%%K),K)c                 :    t                               d           g S )zZBuilds the configuration to save for the plugin such that it can be
        reconstructed.z<Unable to record configuration data for the timeliner plugin)rz   warningr$   s    r   r   zTimeliner.build_configuration@  s     	UVVV	r   r0   )r   r   r   r'   _required_framework_versionr2   classmethodr   r*   r   rO   r   r   RequirementInterfacerZ   rj   r!   r   r   r   r   r   r   r   r   r   r   __classcell__)r8   s   @r   r.   r.   +   s^       # # #,X X X X X 
 
tCy 
DJ 
 
 
 [
0 
j&>&S!T 
 
 
 [
.	? 	? 	?a" $%7 8a"	(5e,-	.a" a" a" a"F' ' '    T
 T
 T
l      r   r.   )!r(   r+   enumru   r   r|   r   typingr   r   r   r   r   r   volatility3r	   volatility3.frameworkr
   r   r   r   r   #volatility3.framework.configurationr   	getLoggerr   rz   IntEnumr   ABCMetar!   PluginInterfacer.   r   r   r   <module>r      sz  
 


   				       C C C C C C C C C C C C C C C C ! ! ! ! ! ! W W W W W W W W W W W W W W < < < < < <		8	$	$    DL       3;    Y Y Y Y Y
"2 Y Y Y Y Yr   