
    df%                         d dl mZ d dlZd dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  G d d	e
j                  ZdS )
    )OptionalN)
exceptions
interfaces	renderers)requirements)plugins)utility)pslistc                   l    e Zd ZdZdZed             Zdej        j	        de
dee
         fdZd Zd	 Zd
S )PsAuxz1Lists processes with their command line arguments   r   r   c                     t          j        ddg d          t          j        dt          j        d          t          j        dd	t          d
          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr
   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/psaux.pyget_requirementszPsAux.get_requirements   su     **???  
 *fmY   (< 	  
 	
    taskr   returnc                 4   	 |j         }n# t          j        $ r d}Y nw xY w|r|                                }|t	          j                    S | j        j        |         }|j         j        }|j         j	        |j         j        z
  }d|cxk     rdk    sn t	          j                    S 	 |
                    ||          }n(# t          j        $ r t	          j                    cY S w xY w	 t          j        |          }	|	d         r/|                    |	d                                       d          }
n*|                    dd                              d          }
nt# t          $ rg 	 |                    d	                              d          }
n:# t          $ r- |                    dd                              d          }
Y nw xY wY nw xY wd
                    |
          }nd|z   dz   }t#          |          dk    r|d         d
k    r
|dd         }|S )aT  
        Reads the command line arguments of a process
        These are stored on the userland stack
        Kernel threads re-use the process data structure, but do not have a valid 'mm' pointer

        Parameters:
            task: task_struct object of the process
            name: string name of the process (from task.comm)
        Nr   i   encodingz\x00zutf-8replace)errorszlatin-1 []   )mmr   InvalidAddressExceptionadd_process_layerr   UnreadableValuecontextlayers	arg_startarg_endreadchardetdetectdecodesplitUnicodeDecodeErrorjoinlen)selfr%   r   r0   proc_layer_name
proc_layerstartsize_to_readargv_ressargss               r"   _get_command_line_argszPsAux._get_command_line_args(   s_   	BB1 	 	 	BBB	  )	$"4466O& 0222,_=J G%E  7?TW->>L,,,,,,,, 02223!ul;;5 3 3 3 0222223N~d++
# ND$455;;GDDAAGI>>DDWMMA% N N NNI..44W==AA) N N NGI>>DDWMMAAAN	N 88A;;DD
 :#D t99q==T"X__9DsU   
 'B> >"C#"C#'A5E 
G((FG4GGGGGc              #      K   |D ]g}|j         }	 |j        j         }n# t          j        $ r d}Y nw xY wt	          j        |j                  }|                     ||          }d||||ffV  hdS )zBGenerates a listing of processes along with command line argumentsr   N)r   parentr   r1   r	   array_to_stringcommrI   )r@   tasksr%   r   ppidr   rH   s          r"   
_generatorzPsAux._generatorl   s        	/ 	/D(C{5    *4955D..tT::DsD$-.....	/ 	/s   00c           
      b   t           j                            | j                            dd                     }t          j        dt          fdt          fdt          fdt          fg| 	                    t           j        
                    | j        | j        d         |                              S )Nr   PIDPPIDCOMMARGSr   )filter_func)r
   r   create_pid_filterconfiggetr   TreeGridr    strrP   
list_tasksr4   )r@   rV   s     r"   runz	PsAux.run~   s    m55dkooeT6R6RSS!S\FC=63-&#GOO((L$+h"7[ )   
 
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr#   r   objectsObjectInterfacer[   r   rI   rP   r]    r$   r"   r   r      s        ;;"+
 
 [
&B&6B>AB	#B B B BH/ / /$

 

 

 

 

r$   r   )typingr   r9   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr	   volatility3.plugins.linuxr
   PluginInterfacer   rf   r$   r"   <module>rn      s   
        C C C C C C C C C C < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 , , , , , ,y
 y
 y
 y
 y
G# y
 y
 y
 y
 y
r$   