
    [
#g2                     H   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	m
Z
mZmZmZ d dlmZ d dlmZmZmZmZmZ d dlmZ  ej0                  e      Z G d dej6                        Z G d d	e j:                  
      Z G d dej(                  j>                        Z y)    N)	GeneratorIterableListOptionalTupleType)	framework)	automagic
exceptions
interfacesplugins	renderers)requirementsc                       e Zd ZdZdZdZdZy)TimeLinerType            N)__name__
__module____qualname__CREATEDMODIFIEDACCESSEDCHANGED     Y/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/timeliner.pyr   r      s    GHHGr   r   c                   f    e Zd ZdZej
                  deeee	e
j                  f   ddf   fd       Zy)TimeLinerInterfacezOInterface defining methods that timeliner will use to generate a body
    file.returnNc                      y)zMethod generates Tuples of (description, timestamp_type, timestamp)

        These need not be generated in any particular order, sorting
        will be done later
        Nr   selfs    r   generate_timelinez$TimeLinerInterface.generate_timeline    s    r   )r   r   r   __doc__abcabstractmethodr   r   strr   datetimer&   r   r   r   r!   r!      sG     		5mX->->>?tK	L r   r!   )	metaclassc                        e Zd ZdZdZ fdZeddee   dee	   fd       Z
edeej                  j                     fd       Zd Zd	ee   deeeeef         fd
Zd Zd Zd Zd Zd Z xZS )	TimelinerzcRuns all relevant plugins that provide time related information and
    orders the results by time.)r   r   r   c                 N    t        |   |i | i | _        d | _        d | _        y N)super__init__timelineusable_plugins
automagics)r%   argskwargs	__class__s      r   r2   zTimeliner.__init__1   s+    $)&)"SWr   selected_listr"   c                    t        t        j                  t                    }dt        dt
        t           dt        fd}|}|r dt        dt
        t           dt        fd}|}ng }|D cg c]  } ||j                  |      r| c}S c c}w )Nnameselectedr"   c                      y)NTr   )r;   r<   s     r   passthroughz1Timeliner.get_usable_plugins.<locals>.passthrough=   s    r   c                 B    t        |D cg c]  }|| v  c}      S c c}w r0   )any)r;   r<   ss      r   filter_pluginsz4Timeliner.get_usable_plugins.<locals>.filter_pluginsC   s    x8!AI8998s   )listr	   class_subclassesr!   r*   r   boolr   )clsr9   plugin_listr>   filter_funcrB   plugin_classs          r   get_usable_pluginszTimeliner.get_usable_plugins7   s     9556HIJ	c 	T#Y 	4 	 ":S :DI :$ : )KM !,
<00-@ 
 	
 
s   *B	c                     t        j                  dddd      t        j                  ddt        dg       t        j                  d	d
dd      gS )Nrecord-configz<Whether to record the state of all the plugins once completeTF)r;   descriptionoptionaldefaultplugin-filterz)Only run plugins featuring this substring)r;   rM   element_typerN   rO   create-bodyfilez6Whether to create a body file whilst producing results)r   BooleanRequirementListRequirementr*   )rF   s    r   get_requirementszTimeliner.get_requirementsP   sc     ++$Z	 (($G  ++&T	
 	
r   c                 N    |d   }d }|dd  D cg c]
  } ||       c}S c c}w )Nr   c                     t        j                   ddt         j                  t         j                  j                        }t	        | t
        j                  j                        r|S | S )Nr      )daymonthyeartzinfo)r+   MAXYEARtimezoneutc
isinstancer   r   BaseAbsentValue)	timestampmax_dates     r   sortablez*Timeliner._sort_function.<locals>.sortablek   sP    ((Rh&6&6x?P?P?T?TH )Z%9%9%I%IJr   r   r   )r%   itemdatard   rb   s        r   _sort_functionzTimeliner._sort_functionh   s1    Aw	 6:!"X>	#>>>s   "runnable_pluginsc              #     K   g }| j                   j                  dd      r)| j                  d      }t        j                  |d      }nd}d}|D ]  }|j
                  j                  }| j                  |j                  |      dz  t        |      z  d| d       	 t        j                  t        j                  d	|        |j                         D ][  \  }}}	| j                  j                  ||fi       }
|
j                  |d      %t        j!                  d
j#                  ||             |	|
|<   |
| j                  ||f<   |j%                  d|||
j                  t&        j(                  t+        j,                               |
j                  t&        j.                  t+        j,                               |
j                  t&        j0                  t+        j,                               |
j                  t&        j2                  t+        j,                               gf       |sP| j                  ||f   }
| j5                  |
      st|j7                  dj#                  || j9                  |      | j;                  |
j                  t&        j0                  d            | j;                  |
j                  t&        j.                  d            | j;                  |
j                  t&        j2                  d            | j;                  |
j                  t&        j(                  d                         ^  tE        || jF                        D ]  }|  | j                   j                  dd      r$|r!|jI                          |jI                          yyy# t<        $ ra t        j                  t        j                  d|        t        j                  t        j>                  tA        jB                                Y w xY ww)z_Takes a timeline, sorts it and output the data from each relevant
        row from each plugin.rR   Tzvolatility.bodywrite_throughNd   zRunning plugin z...zRunning zEMultiple timestamps for the same plugin/file combination found: {} {}r   z|{} - {}|0|0|0|0|0|{}|{}|{}|{}
0z#Exception occurred running plugin: )key)%configgetopenioTextIOWrapperr8   r   _progress_callbackindexlenvolloglogloggingINFOr&   r3   debugformatappendr   r   r   NotApplicableValuer   r   r   _any_time_presentwrite_sanitize_body_format_text_format	ExceptionDEBUG	traceback
format_excsortedrg   close)r%   rh   rf   	file_datafppluginplugin_namere   timestamp_typerb   times	data_items               r   
_generatorzTimeliner._generatoru   sp      ;;??,d3		"34I!!)4@BIB&F **33K##!''/#5#>N:OO!+c2BB

7<<8K=)AB7=7O7O7Q3D.) MM--{D.A2FEyy6Bcjj +T
 -6E.)9>DMM;"56KK + $ %		$1$9$9$-$@$@$B!" !&		$1$:$:$-$@$@$B!" !&		$1$:$:$-$@$@$B!" !&		$1$9$9$-$@$@$B!"6  ${D.A B  11%8HH B I I$/$($>$>t$D$($5$5(-		-2H2H#(N%& %)$5$5(-		-2H2H#(N%& %)$5$5(-		-2G2G(M%& %)$5$5(-		-2G2G(M%&!"U 8R 'T  $*=*=>IO ? ;;??,d3
!  4  B

LL$G}"U 

7==)*>*>*@A	Bs:   BPFN&"N
C+N5A$PA&P?PPPc                 &    |j                  dd      S )N|_)replacer%   values     r   r   zTimeliner._sanitize_body_format   s    }}S#&&r   c                     t         D ]F  }t        |j                  |t        j                        t
        j                  j                        rF y y)NTF)r   r`   rp   r   r~   r   ra   )r%   r   times      r   r   zTimeliner._any_time_present   sA    !D		$	 < <=$$44  " r   c                     t        |t        j                  j                        ryt        |t        j                        rt        |j                               S |S )z5Formats a value as text, in case it is an AbsentValuerm   )r`   r   r   ra   r+   intrb   r   s     r   r   zTimeliner._text_format   sB    eZ11AABeX../u())r   c           	         | j                   xs | j                         | _         | j                  xs t        j                  | j
                        | _        g }i }| j                  d   }| j                   D ]  }	 t        j                  | j                  |      }|j                         D ]t  }|j                  |v s||j                     \  }}||k(  s*|| j                  j                  t        j                  j                  | j                  |j                        <   v t!        j"                  | j                  ||| j                  | j$                  | j&                        }	|	j                         D ]K  }|j                  |vs|	j                  j)                  |j                  d      }|s;||f||j                  <   M t+        |	t,              r[t/        |      r?t1        |D 
cg c]*  }
|
|	j2                  dz   |	j4                  j                  z   v , c}
      r|j7                  |	        | j                  j)                  dd      ri }|D ]\  }	tC        |	jE                               }|D ]<  }||   |t        j                  j                  |	j4                  j                  |      <   > ^ | j'                  d      5 }tG        jH                  |d	
      5 }tK        jL                  ||d	d       ddd       ddd       tO        jP                  dtR        fdtR        fdtT        jT                  fdtT        jT                  fdtT        jT                  fdtT        jT                  fg| jW                  |            S c c}
w # t8        j:                  $ r:}t<        j?                  d|j                   d|j@                          Y d}~Qd}~ww xY w# 1 sw Y   xY w# 1 sw Y   xY w)zIsolate each plugin and run it.rP   N.zUnable to satisfy z: rL   Fzconfig.jsonTrj   r   )	sort_keysindentPluginDescriptionzCreated DatezModified DatezAccessed DatezChanged Date)columns	generator),r4   rJ   r5   r
   	available_contextro   choose_automagicrU   r;   contextr   configuration	path_joinconfig_pathr   r   construct_pluginrt   rq   rp   r`   r!   rv   r@   r   r8   r}   r   UnsatisfiedExceptionrw   r{   unsatisfieddictbuild_configurationrr   rs   jsondumpr   TreeGridr*   r+   r   )r%   plugins_to_runrequirement_configsfilter_listrI   r5   requirement
config_reqconfig_valuer   filterexcptotal_configold_dictentryr   r   s                    r   runzTimeliner.run   s    #11NT5L5L5N//OY-@-@-O kk/2 //L-&77V
#/#@#@#BK"''+>>3F{GWGW3X0
L&*4
 !-	 !LL// * 8 8 B B$($4$4l6K6K!"	 $C !11LL $$++II $*#:#:#<K"''/BB'-}}'8'89I9I4'P' + ,E/0@0@A	 $= f&89{+s +6 !' #%00369I9I9R9RRS0 '--f5Q 0` ;;???E2L( : : <=%E
 !	 !"00::",,55u & ) =) JY%%itD JIIlB$qIJJ !!3$!2!23 ("3"34 ("3"34!2!23 oon5

 
	
; 22 ()>)>(?r$BRBRAST &J JJ Jsh   :AM><M>B0M>(M>.7M>%/M9
M>?OO1O9M>>O/OOO	OO#c                 0    t         j                  d       g S )zZBuilds the configuration to save for the plugin such that it can be
        reconstructed.z<Unable to record configuration data for the timeliner plugin)rw   warningr$   s    r   r   zTimeliner.build_configurationB  s     	UV	r   r0   )r   r   r   r'   _required_framework_versionr2   classmethodr   r*   r   rJ   r   r   RequirementInterfacerU   rg   r!   r   r   r   r   r   r   r   r   r   r   __classcell__)r8   s   @r   r.   r.   +   s    # #,X 
tCy 
DJ 
 
0 
j&>&>&S&S!T 
 
.?a" $%7 8a"	(5e,-	.a"F'T
lr   r.   )!r(   r+   enumrr   r   ry   r   typingr   r   r   r   r   r   volatility3r	   volatility3.frameworkr
   r   r   r   r   #volatility3.framework.configurationr   	getLoggerr   rw   IntEnumr   ABCMetar!   PluginInterfacer.   r   r   r   <module>r      sz   
    	    C C ! W W <			8	$DLL 3;; [
""22 [r   