
    [
#g                         d Z ddlZddlZddlmZmZ ddlmZmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ  ej.                  e      Z G d dej4                  ej6                        Zy)zkA module containing a collection of plugins that produce data typically
found in Linux's /proc file system.    N)ListCallable)	renderers
interfaces	constants
exceptions)requirements)plugins)utility)linux)pslist)	timelinerc            
       \   e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  fd       Zed fd	ej                  j                   d
edeegef   fd       Zed fd	ej                  j                   d
edeegef   fd       Zd Zd Zd Zy)Lsofz$Lists open files for each processes.   r   r   )   r   r   returnc           	         t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dt        j                  d	      t        j                  d
dt        d      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr   r   )r   pluginversion
linuxutils)r   	componentr   pidzFilter on specific process IDsT)r   r   element_typeoptional)
r	   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   LinuxUtilitiesListRequirementint)clss    Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/lsof.pyget_requirementszLsof.get_requirements   sy     ***?
 **fmmY ++!U-A-A9 ((< 	
 	
    filpc                    	 |j                         }|r|j                  }|r|j                         r{|j                         xs t	        j
                         }|j                  ||j                  |j                         |j                         |j                         |j                         fS y # t        j                  t        f$ r"}t        j!                  d|        Y d }~y d }~ww xY w)NzCan't get inode metadata: )
get_dentryd_inodeis_validget_inode_typer   NotAvailableValuei_inoi_sizeget_file_modeget_change_timeget_modification_timeget_access_timer   InvalidAddressExceptionAttributeErrorvollogwarning)r+   r/   dentryinode_objectitypees         r,   get_inode_metadatazLsof.get_inode_metadata0   s    	=__&F%~~L$9$9$;$335V9T9T9V  %**$++$224$446$::<$446   22NC 	=NN7s;<<	=s   B*B. .C)C$$C)c                      yNF _s    r,   <lambda>zLsof.<lambda>L       ur.   contextsymbol_tablefilter_funcc              #     K   d }t         j                  j                  |||      D ]  }|gt        j                  |j
                  j                  vrt        d      |j
                  j                  j                  t        j                        d   }t        j                  |j                        }t        |j                        }t        j                  j!                  |||      }|D ]
  }	||||	f   y w)Nz"Task is not part of a symbol tabler   )r   r&   
list_tasksr   BANGvol	type_name
ValueErrorsplitr   array_to_stringcommr*   r!   r   r(   files_descriptors_for_process)
r+   rL   rM   rN   linuxutils_symbol_tabletask	task_commr!   fd_generator	fd_fieldss
             r,   list_fdszLsof.list_fdsG   s      #'MM,,WlKPD&.>>););;$%IJJ*.((*<*<*B*B9>>*RST*U'//		:Idhh-C //MM0$L *	9dI55 * Qs   C7C9c                      yrF   rG   rH   s    r,   rJ   zLsof.<lambda>d   rK   r.   c              #      K   | j                  |||      D ]D  \  }}}\  }}}	| j                  |      }
|
t        d t        d      D              }
||||||	|
f F y w)Nc              3   X   K   | ]"  }t         j                  j                          $ y w)N)r   r   BaseAbsentValue).0rI   s     r,   	<genexpr>z+Lsof.list_fds_and_inodes.<locals>.<genexpr>k   s$      '?@J((88:'s   (*   )r^   rD   tuplerange)r+   rL   rM   rN   r!   r[   rZ   fd_numr/   	full_pathinode_metadatas              r,   list_fds_and_inodeszLsof.list_fds_and_inodes_   s      @C||\;@
;CD";64 !33D9N%!& 'DI!H' " y$iOO@
s   AAc              #      K   t         j                  j                  |      }| j                  | j                  ||      }|D ]'  \  }}}}}	}
}|\  }}}}}}}||||
|||||||f}d|f ) y w)N)rN   r   )r   r&   create_pid_filterrk   rL   )selfpidsrM   rN   fds_generatorr!   r[   rZ   rh   r/   ri   rj   	inode_numrB   	file_sizeimodectimemtimeatimefieldss                       r,   
_generatorzLsof._generatorp   s     mm55d;00LL,K 1 
 
FTCIuiueF f+ s   A+A-c                 ~   | j                   j                  dd       }| j                   d   }dt        fdt        fdt        fdt        fdt        fdt        fd	t        fd
t        j                  fdt        j                  fdt        j                  fdt        fg}t        j                  || j                  ||            S )Nr!   r   PIDProcessFDPathInodeTypeModeChangedModifiedAccessedSize)configgetr*   strdatetimer   TreeGridrx   )rn   ro   rM   tree_grid_argss       r,   runzLsof.run   s    {{ud+{{8, CL3KSMcNSMSM))***+**+SM
 !!.$//$2UVVr.   c              #     K   | j                   j                  dd       }| j                   d   }| j                  ||      D ]  }|\  }}d|d    d|d    d|d    d	}|t        j                  j
                  |d
   f |t        j                  j                  |d   f |t        j                  j                  |d   f  y w)Nr!   r   zProcess r   z (r   z) Open "   "re      	   )r   r   rx   r   TimeLinerTypeCHANGEDMODIFIEDACCESSED)rn   ro   rM   row_depthrow_datar   s          r,   generate_timelinezLsof.generate_timeline   s     {{ud+{{8,??46C"FH$Xa[MHQK=RSUVWKy66>>KKy66??!LLy66??!LL 7s   CCN)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer-   objectsObjectInterfacerD   rL   ContextInterfacer   r   r*   boolr^   rk   rx   r   r   rG   r.   r,   r   r      s   ."+H
j&>&>&S&S!T 
 
* j&8&8&H&H  , 
 .=	6##446 6 seTk*	6 6. 
 .=	P##44P P seTk*	P P >W&Mr.   r   )r   loggingr   typingr   r   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.symbolsr   volatility3.plugins.linuxr   volatility3.pluginsr   	getLoggerr   r>   PluginInterfaceTimeLinerInterfacer   rG   r.   r,   <module>r      sX   '  ! N N < 4 1 / , )			8	$VM7""I$@$@ VMr.   