
    *1f:                         d dl Z d dlmZmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ  e j                  e      Z G d dej                        Zy)	    N)
exceptions	renderers)requirements)plugins)utility)pslistc                   0    e Zd ZdZdZed        Zd Zd Zy)Envarsz0Lists processes with their environment variables   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      gS )NkernelzLinux kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/envars.pyget_requirementszEnvars.get_requirements   sa     ***()4
 **fmmY ((< 	
 	
    c              #   *  K   |D ]t  }|j                   }t        j                  |j                        }	 |j                  j                   }	 |j                  }|sV|j                         }|t        j                  d| d| d	       | j                  j                  |   }|j                  j                  |j                  j                  z
  }	d|	cxk  rd
k  s"n t        j                  d| d| d|	 d       	 |j                  |j                  j                  |	      }
|
j#                  d      }
|
j%                  d      D ]1  }	 |j'                         j%                  dd      \  }}d|||||ff 3 w y# t
        j                  $ r" t        j                  d| d| d       d}Y gw xY w# t
        j                  $ r" t        j                  d| d| d       d}Y w xY w# t
        j                  $ rC t        j                  d| d| dt!        |j                  j                         d|	 d	       Y >w xY w# t(        $ r@ t        j                  d| d| dt!        |j                  j                         d       Y Iw xY ww)zAGenerates a listing of processes along with environment variablesz#Unable to read parent pid for task  z, setting ppid to 0.r   zUnable to access mm for task z; it is likely a kernel thread, will not extract any envars.Nz+Unable to construct process layer for task z, will not extract any envars.i    zTask z  appears to have envars of size zD bytes which fails the sanity checking, will not extract any envars.zUnable to read full envars for z starting at virtual offset z for z$ bytes, will not extract any envars.    =   zUnable to extract envars for z', they don't appear to be '=' separated)r   r   array_to_stringcommparentr   InvalidAddressExceptionvollogdebugmmadd_process_layercontextlayersenv_end	env_startreadhexrstripsplitdecode
ValueError)selftaskstaskr   r   ppidr-   proc_layer_name
proc_layerenvars_size
envar_data
envar_pairkeyvalues                 r   
_generatorzEnvars._generator)   s      @	=D((C **4995D{{WW "&"8"8":"*LLEcU!D6Qop !\\00A
 #ggoo0A0AAK/4/LLuAdV+KK=  Y]  ^ !+1B1BK!PJ (..w7
","2"27"; =J!%/%6%6%8%>%>sA%F
U sD$U;<<=q@	= 55 9#avEYZ 	 55 3C5$?z{ < "99 LL9#avEabefjfmfmfwfwbxayy~  @K  L  Lp  q 	 & !;C5$Gcdghlhohohyhydzc{  |c  d !	!s   2JE>F6JB"J>&G.$%J
#I-J>1F3/J2F33J61G+'J*G++J.AI JIJAJJJJc           
      r   t         j                  j                  | j                  j	                  dd             }t        j                  dt        fdt        fdt        fdt        fdt        fg| j                  t         j                  j                  | j                  | j                  d   |                  S )	Nr   PIDPPIDCOMMKEYVALUEr   )filter_func)r   r   create_pid_filterconfiggetr   TreeGridr   strrD   
list_tasksr/   )r9   rK   s     r   runz
Envars.runo   s    mm55dkkooeT6RS!!S\FC=63-%QT~VOO((LL$++h"7[ ) 
 	
r!   N)	__name__
__module____qualname____doc___required_framework_versionclassmethodr    rD   rR    r!   r   r
   r
      s)    :"+
 
&D=L

r!   r
   )loggingvolatility3.frameworkr   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.plugins.linuxr   	getLoggerrS   r+   PluginInterfacer
   rY   r!   r   <module>rb      s?   
  7 < 4 1 ,			8	$i
W$$ i
r!   