
    "f                         d Z ddlZddlZddlmZ ddlmZmZmZm	Z	 ddl
mZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ  G d dej0                  ej2                        Zy)zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)List)	constants	rendererssymbols
interfaces)requirements)plugins)scanners)utility)BashIntermedSymbols)	timeliner)pslistc                   j    e Zd ZdZdZedeej                  j                     fd       Z
d Zd Zd Zy)	Bashz*Recovers bash command history from memory.   r   r   returnc                     t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dt        d	d
      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/bash.pyget_requirementszBash.get_requirements   s\     ***?
 **fmmY (( W	
 	
    c              #     K   | j                   j                  | j                  d      }t        j                  | j                   |j
                         }|rd}d}nd}d}t        j                  | j                   | j                  d|      }| j                   j                  j                  |t        j                  z   dz         j                  d      }|D ]  }t        j                  |j                         }	|	d	vr(|j#                         }
|
s;| j                   j$                  |
   }g }|j'                  d
      D cg c]  }| }}|j)                  | j                   t+        j,                  d      |      D ]'  }|j/                  t1        j2                  ||             ) g }|r|j)                  | j                   t+        j4                  |      |      D ]\  \  }}| j                   j7                  |t        j                  z   dz   ||z
  |
      }|j9                         sL|j/                  |       ^ t;        |d       D ]2  }d|j<                  |	|j?                         |jA                         ff 4  y c c}w w)Nr   Ibash32Qbash64linux
hist_entry	timestamp)bashshdashT)	heap_only   #)sections)offset
layer_namec                 "    | j                         S )N)get_time_as_integer)xs    r'   <lambda>z!Bash._generator.<locals>.<lambda>l   s    a>S>S>U r)   )keyr   )!contextmodulesconfigr   symbol_table_is_64bitsymbol_table_namer   createconfig_pathsymbol_spaceget_typer   BANGrelative_child_offsetr   array_to_stringcommadd_process_layerlayersget_process_memory_sectionsscanr
   BytesScannerappendstructpackMultiStringScannerobjectis_validsortedr   get_time_objectget_command)selftasksvmlinuxis_32bitpack_formatbash_json_filebash_table_name	ts_offsettask	task_nameproc_layer_name
proc_layer
bang_addrssectiontask_memory_sectionsaddresshistory_entries_hists                      r'   
_generatorzBash._generator-   s}    ,,&&t{{8'<=44LL'33
 
 K%NK%N-44LL$**G^
 LL--66inn,|;



, 	  /	D//		:I 66"446O",,_=JJ (,'G'GRV'G'W$#$  $
 &??%%d+- +  E
 !!&++k7"CDE !O",//LL//
;1 #2 # 5JGQ
  <<..')..8<G&2#2 / D }}'..t45 4UV XXy$*>*>*@$BRBRBTU W/	$s   D=J?	J CJ&AJc           
      x   t         j                  j                  | j                  j	                  dd             }t        j                  dt        fdt        fdt        j                  fdt        fg| j                  t         j                  j                  | j                  | j                  d   |                  S )Nr   PIDProcessCommandTimeCommandr   filter_func)r   r#   create_pid_filterrA   getr   TreeGridr%   strdatetimerm   
list_tasksr?   )rZ   rt   s     r'   runzBash.runr   s    mm55dkkooeT6RS!!C  1 12C 	 OO((LL$++h"7[ ) 
 	
r)   c              #     K   t         j                  j                  | j                  j	                  dd             }| j                  t         j                  j                  | j                  | j                  d   |            D ]=  }|\  }}|d    d|d    d|d    d	}|t        j                  j                  |d
   f ? y w)Nr   r   rs   r   z (   z): "   "r   )r   r#   ru   rA   rv   rm   rz   r?   r   TimeLinerTypeCREATED)rZ   rt   row_depthrow_datar   s         r'   generate_timelinezBash.generate_timeline   s     mm55dkkooeT6RS??MM$$dkk(3 % 
 	NC
  #FH%a[MHQK=Xa[MKK	 7 7 ? ?!MM	Ns   CCN)__name__
__module____qualname____doc___required_framework_versionclassmethodr   r   configurationRequirementInterfacer(   rm   r{   r    r)   r'   r   r      sG    4"+
j&>&>&S&S!T 
 
$CJ
"
Nr)   r   )r   ry   rR   typingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr	   volatility3.framework.layersr
   volatility3.framework.objectsr   (volatility3.framework.symbols.linux.bashr   volatility3.pluginsr   volatility3.plugins.linuxr   PluginInterfaceTimeLinerInterfacer   r   r)   r'   <module>r      sN   '    K K < 4 1 1 H ) ,xN7""I$@$@ xNr)   