
    "f                         d Z ddlZddlZddlmZ ddlmZmZmZm	Z	 ddl
mZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ  G d dej        ej                  ZdS )zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)List)	constants	rendererssymbols
interfaces)requirements)plugins)scanners)utility)BashIntermedSymbols)	timeliner)pslistc                   d    e Zd ZdZdZedeej        j	                 fd            Z
d Zd Zd ZdS )	Bashz*Recovers bash command history from memory.   r   r   returnc                     t          j        ddg d          t          j        dt          j        d          t          j        dt          d	d
          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/bash.pyget_requirementszBash.get_requirements   su     **???  
 *fmY   ( W	  
 	
    c              #     K   | j         j        | j        d                  }t          j        | j         |j                   }|rd}d}nd}d}t          j        | j         | j        d|          }| j         j	        
                    |t          j        z   dz                                 d          }|D ]}t          j        |j                  }	|	d	vr!|                                }
|
s8| j         j        |
         }g }d
 |                    d          D             }|                    | j         t+          j        d          |          D ]*}|                    t1          j        ||                     +g }|r|                    | j         t+          j        |          |          D ]^\  }}| j                             |t          j        z   dz   ||z
  |
          }|                                r|                    |           _t;          |d           D ]5}d|j        |	|                                |                                 ffV  6d S )Nr   Ibash32Qbash64linux
hist_entry	timestamp)bashshdashc                     g | ]}|S  r6   ).0sections     r'   
<listcomp>z#Bash._generator.<locals>.<listcomp>O   s%     $ $ $#$ $ $r)   T)	heap_only   #)sections)offset
layer_namec                 *    |                                  S )N)get_time_as_integer)xs    r'   <lambda>z!Bash._generator.<locals>.<lambda>l   s    a>S>S>U>U r)   )keyr   )!contextmodulesconfigr   symbol_table_is_64bitsymbol_table_namer   createconfig_pathsymbol_spaceget_typer   BANGrelative_child_offsetr   array_to_stringcommadd_process_layerlayersget_process_memory_sectionsscanr
   BytesScannerappendstructpackMultiStringScannerobjectis_validsortedr   get_time_objectget_command)selftasksvmlinuxis_32bitpack_formatbash_json_filebash_table_name	ts_offsettask	task_nameproc_layer_name
proc_layer
bang_addrstask_memory_sectionsaddresshistory_entries_hists                     r'   
_generatorzBash._generator-   s     ,&t{8'<=4L'3
 
 
  	&K%NNK%N-4L$*G^
 
 L-66in,|;
 



,
, 	  /	 /	D/	::I 666"4466O" ,_=JJ$ $'+'G'GRV'G'W'W$ $ $ 
 &??%d++- +   E E
 !!&+k7"C"CDDDD O 5",//L/
;;1 #2 # # 5 5JGQ
  <..').8<G&2#2 /  D }} 5'..t4444U4UVVV  Xy$*>*>*@*@$BRBRBTBTU    W/	 /	r)   c           
      l   t           j                            | j                            dd                     }t          j        dt          fdt          fdt          j	        fdt          fg| 
                    t           j                            | j        | j        d         |                              S )Nr   PIDProcessCommandTimeCommandr   filter_func)r   r#   create_pid_filterrF   getr   TreeGridr%   strdatetimerq   
list_tasksrD   )r_   rx   s     r'   runzBash.runr   s    m55dkooeT6R6RSS!C  12C 	 OO((L$+h"7[ )   
 
 	
r)   c              #     K   t           j                            | j                            dd                     }|                     t           j                            | j        | j        d         |                    D ]@}|\  }}|d          d|d          d|d          d	}|t          j	        j
        |d
         fV  Ad S )Nr   r   rw   r   z (   z): "   "r   )r   r#   ry   rF   rz   rq   r~   rD   r   TimeLinerTypeCREATED)r_   rx   row_depthrow_datar   s         r'   generate_timelinezBash.generate_timeline   s      m55dkooeT6R6RSS??M$$dk(3 %  
 
 	N 	NC
  #FH%a[KKHQKKKXa[KKKK	 7 ?!MMMMM	N 	Nr)   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer(   rq   r   r   r6   r)   r'   r   r      s        44"+
j&>&S!T 
 
 
 [
$C C CJ
 
 
"
N 
N 
N 
N 
Nr)   r   )r   r}   rW   typingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.layersr
   volatility3.framework.objectsr   (volatility3.framework.symbols.linux.bashr   volatility3.pluginsr   volatility3.plugins.linuxr   PluginInterfaceTimeLinerInterfacer   r6   r)   r'   <module>r      s'  ' '         K K K K K K K K K K K K < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 1 1 1 1 1 1 H H H H H H ) ) ) ) ) ) , , , , , ,xN xN xN xN xN7"I$@ xN xN xN xN xNr)   