
    [
#gn"                         d dl Z d dlmZ d dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ  e j"                  e      Z G d	 d
ej(                        Zy)    N)List)	renderers
interfaces	constants)linux)format_hints)plugins)requirements)pslistc                      e Zd ZdZdZdZedeej                  j                     fd       ZdefdZd Zd Zd	 Zd
 Zd Zd Zd Zd Zdej,                  j.                  fdZ	 ddedej,                  j.                  fdZd Zy)PIDHashTablez/Enumerates processes through the PID hash table   r   r   )   r   r   returnc           	          t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      t        j                  dddd      gS )NkernelzLinux kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversion
linuxutils)r   r   r   )r   	componentr   decorate_commzXShow `user threads` comm in curly brackets, and `kernel threads` comm in square bracketsTF)r   r   optionaldefault)	r
   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   LinuxUtilitiesBooleanRequirement)clss    b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/pidhashtable.pyget_requirementszPIDHashTable.get_requirements   s~     ***()4
 **fmmY ++!U-A-A9 ++$v	
 	
    c                    | j                   j                  | j                  d      }| j                   j                  |j                     }t        |xr, |j                  dkD  xr |j                  |j                              S )Nr   r   )	contextmodulesconfiglayers
layer_nameboolpidis_validparent)selftaskvmlinuxvmlinux_layers       r'   _is_valid_taskzPIDHashTable._is_valid_task/   se    ,,&&t{{8'<=++G,>,>?DQTXX\Qm.D.DT[[.QRRr)   c                 
   | j                   j                  | j                  d      }|j                  d      }|st        j                  d       y |j                  j                  d      }|t        j                  d       y |S )Nr   pid_typez-Cannot find pid_type enum. Unsupported kernelPIDTYPE_PIDz+Cannot find PIDTYPE_PID. Unsupported kernel)r+   r,   r-   get_enumerationvollogerrorchoicesget)r4   r6   pid_type_enumpidtype_pids       r'   _get_pidtype_pidzPIDHashTable._get_pidtype_pid4   sx    ,,&&t{{8'<=  //
;LLHI#++//>LLFG r)   c                 R   | j                   j                  | j                  d      }|j                  d      }d|z  }|j                  t
        j                  z   dz   }|j                  d      }| j                  j                  |||j                  d      ||j                        }|S )Nr   pidhash_shiftr   arraypid_hash
hlist_head)offsetsubtypecountr/   )r+   r,   r-   object_from_symbolsymbol_table_namer   BANG_contextobjectget_typer/   )r4   r6   rE   pidhash_sizearray_type_namepidhash_ptrpidhashs          r'   _get_pidhash_arrayzPIDHashTable._get_pidhash_arrayE   s    ,,&&t{{8'<=22?CM)!33innDwN00<--&&$$\2)) ' 
 r)   c                 v   | j                   j                  | j                  d      }| j                   j                  |j                     }|r|j                  |j                  j                        r|j                  j                  |v ry |j                  |j                  j                         |j                  }|r%|j                  |j                  j                        sy t        j                  j                  |j                  dd|      }|r'|j                  |j                  j                        ry y y y Nr   upid	pid_chain)r+   r,   r-   r.   r/   r2   volrI   addrZ   r   r$   container_ofnext)r4   
seen_upidsrY   r6   r7   rZ   s         r'   
_walk_upidzPIDHashTable._walk_upidY   s    ,,&&t{{8'<=++G,>,>?}--dhhoo>xx*,NN488??+I-"8"89M9M"N''44WD }--dhhoo>d>dr)   c                 p   | j                   j                  | j                  d      }| j                   j                  |j                     }| j                         }t               }|D ]  }|j                  }|s|j                  |j                  j                        s8t        j                  j                  |j                  j                  dd|      }|j                  j                  |v r| j                  ||       |j                  }|s|j                  |j                  j                        r |S rX   )r+   r,   r-   r.   r/   rV   setfirstr2   r[   rI   r   r$   r]   r`   r^   )r4   r6   r7   rU   r_   hlistentrY   s           r'   
_get_upidszPIDHashTable._get_upidsj   s    ,,&&t{{8'<=++G,>,>? ))+U
E++C-00@++88GGNNFK 88??j0
D1hh -00@	 " r)   c              #     K   | j                   j                  | j                  d      }|j                  d      j	                  d      }| j                         }| j                         D ]p  }t        j                  j                  |dd|      }|s(|j                  |   j                  }|sD|j                  d||z
  d      }| j                  |      sm| r y w)Nr   task_structpidsr1   numbersTrI   absolute)r+   r,   r-   rQ   relative_child_offsetrC   rf   r   r$   r]   tasksrc   rP   r8   )r4   r6   task_pids_offrB   rY   r1   pid_tasks_0r5   s           r'   _pid_hash_implementationz%PIDHashTable._pid_hash_implementation   s     ,,&&t{{8'<=  ((7MMfU++-OO%D&&33D%GTC))K066K>>kM&AD " D ""4(
 &s   CCCc                    | j                   j                  | j                  d      }|j                  d|d      }| j	                         }|j
                  |   j                  }|sy |j                  d      }|j                  d      rd}n|j                  d      rd}ny |j                  |      }|j                  d||z
  d      }	|	S )Nr   r1   Trk   rh   ri   	pid_links)
r+   r,   r-   rP   rC   rn   rc   rQ   
has_memberrm   )
r4   nodepr6   r1   rB   rp   task_struct_typememberro   r5   s
             r'   _task_for_radix_pid_nodez%PIDHashTable._task_for_radix_pid_node   s    ,,&&t{{8'<= nnU54n@++-ii,22"++M:&&v.F((5 F(>>vF~~+"=  
 r)   c              #   @  K   | j                   j                  | j                  d      }|j                  d      j                  }|j                  d|      }|j                  j                         D ])  }| j                  |      }| j                  |      s&| + y w)Nr   init_pid_nspid_namespace)rI   )
r+   r,   r-   
get_symboladdressrP   idrget_entriesrx   r8   )r4   r6   ns_addrns	page_addrr5   s         r'   _pid_namespace_idrzPIDHashTable._pid_namespace_idr   s     ,,&&t{{8'<= $$]3;;^^OG^<++-I00;D""4(
 .s   BBBc                    | j                   j                  | j                  d      }|j                  d      xr |j                  d      }|j	                  d      xr  |j                  d      j                  d      }|j	                  d      xr  |j                  d      j                  d      }|j	                  d      xr  |j                  d      j                  d	      }|r| j                  S |r|r|r|r| j                  S y )
Nr   rG   rE   r1   rj   rY   rZ   r{   r~   )	r+   r,   r-   
has_symbolhas_typerQ   rt   r   rq   )r4   r6   rG   has_pid_numbershas_pid_chainpid_idrs         r'   _determine_pid_funcz PIDHashTable._determine_pid_func   s   ,,&&t{{8'<=%%j1 
g6H6H7
 "**51 
g6F6F7

*
 	  ((0 
W5E5E6

*
 	 ""?3 8H8H9

*U
 	 ***/o-000r)   c              #      K   | j                         }|st        j                  d       yt         |       d       E d{    y7 w)ziEnumerates processes through the PID hash table

        Yields:
            task_struct objects
        z:Cannot determine which PID hash table this kernel is usingNc                 2    | j                   | j                  fS )N)tgidr1   )ts    r'   <lambda>z(PIDHashTable.get_tasks.<locals>.<lambda>   s    QVVQUUOr)   )key)r   r=   r>   sorted)r4   pid_funcs     r'   	get_taskszPIDHashTable.get_tasks   s<      ++-LLUV(**CDDDs   ?A	AA	r   c              #      K   | j                         D ]H  }t        j                  j                  ||      \  }}}}}t	        j
                  |      ||||f}d|f J y w)Nr   )r   r   r"   get_task_fieldsr   Hex)	r4   r   r5   rI   r1   tidppidr   fieldss	            r'   
_generatorzPIDHashTable._generator   sc      NN$D+1==+H+Hm,(FCdD "%%f-sCtCFV)O %s   AAc                     | j                   j                  d      }dt        j                  fdt        fdt        fdt        fdt
        fg}t        j                  || j                  |            S )Nr   OFFSETPIDTIDPPIDCOMM)r   )	r-   r@   r   r   intstrr   TreeGridr   )r4   r   headerss      r'   runzPIDHashTable.run   sg    8 |''(CLCLSMSM
 !!'4???+WXXr)   N)F)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer(   r0   r8   rC   rV   r`   rf   rq   rx   r   r   objectsObjectInterfacer   r   r    r)   r'   r   r      s    9"+H
j&>&>&S&S!T 
 
*Sd S
"("6,2
BE:--== E %*!				+	+
Yr)   r   )loggingtypingr   volatility3.frameworkr   r   r   volatility3.framework.symbolsr   volatility3.framework.renderersr    volatility3.framework.interfacesr	   #volatility3.framework.configurationr
   volatility3.plugins.linuxr   	getLoggerr   r=   PluginInterfacer   r   r)   r'   <module>r      sJ   
   B B / 8 4 < ,			8	$pY7** pYr)   