
    df%                         d dl mZ d dlZd dlmZmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ  G d d	e
j                        Zy)
    )OptionalN)
exceptions
interfaces	renderers)requirements)plugins)utility)pslistc                   r    e Zd ZdZdZed        Zdej                  j                  de
dee
   fdZd Zd	 Zy
)PsAuxz1Lists processes with their command line arguments   r   r   c                     t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dd	t        d
      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitecturesr
   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/psaux.pyget_requirementszPsAux.get_requirements   s\     ***?
 **fmmY ((< 	
 	
    taskr   returnc                 :   	 |j                   }|r<|j                         }|t	        j
                         S | j                  j                  |   }|j                   j                  }|j                   j                  |j                   j                  z
  }d|cxk  rdk  s)t	        j
                         S  t	        j
                         S 	 |j                  ||      }	 t        j                  |      }	|	d   r$|j                  |	d         j                  d      }
n"|j                  dd      j                  d      }
d
j!                  |
      }nd|z   dz   }t#        |      dkD  r|d   d
k(  r|dd }|S # t        j                  $ r d}Y |w xY w# t        j                  $ r t	        j
                         cY S w xY w# t        $ rV 	 |j                  d	      j                  d      }
n1# t        $ r% |j                  dd      j                  d      }
Y nw xY wY w xY w)aT  
        Reads the command line arguments of a process
        These are stored on the userland stack
        Kernel threads re-use the process data structure, but do not have a valid 'mm' pointer

        Parameters:
            task: task_struct object of the process
            name: string name of the process (from task.comm)
        Nr   i   encodingz\x00zutf-8replace)errorszlatin-1 []   )mmr   InvalidAddressExceptionadd_process_layerr   UnreadableValuecontextlayers	arg_startarg_endreadchardetdetectdecodesplitUnicodeDecodeErrorjoinlen)selfr%   r   r0   proc_layer_name
proc_layerstartsize_to_readargv_ressargss               r"   _get_command_line_argszPsAux._get_command_line_args(   s   	B "446O& 0022,,_=J GG%%E  77??TWW->->>L,, 0022 - 00223!ul;
N~~d+
#D$45;;GDAGI>DDWMA 88A;D
 :#D t9q=T"X_9De 11 	B	* 55 3 00223 & NNI.44W=A) NGI>DDWMAN	NsZ   E2 F A F; 2F
F'F87F8;	H G&%H&+HHHHHc              #     K   |D ]`  }|j                   }	 |j                  j                   }t	        j
                  |j                        }| j                  ||      }d||||ff b y# t        j                  $ r d}Y Uw xY ww)zBGenerates a listing of processes along with command line argumentsr   N)r   parentr   r1   r	   array_to_stringcommrI   )r@   tasksr%   r   ppidr   rH   s          r"   
_generatorzPsAux._generatorl   s       	/D((C{{ **4995D..tT:DsD$-..	/
 55 s'   BA)>B)B>B BBc           
      d   t         j                  j                  | j                  j	                  dd             }t        j                  dt        fdt        fdt        fdt        fg| j                  t         j                  j                  | j                  | j                  d   |                  S )Nr   PIDPPIDCOMMARGSr   )filter_func)r
   r   create_pid_filterconfiggetr   TreeGridr    strrP   
list_tasksr4   )r@   rV   s     r"   runz	PsAux.run~   s    mm55dkkooeT6RS!!S\FC=63-&#GOO((LL$++h"7[ ) 
 	
r$   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr#   r   objectsObjectInterfacer[   r   rI   rP   r]    r$   r"   r   r      sY    ;"+
 
&B&&66B>AB	#BH/$

r$   r   )typingr   r9   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr	   volatility3.plugins.linuxr
   PluginInterfacer   rf   r$   r"   <module>rn      s3   
   C C < 4 1 ,y
G## y
r$   