*1fO"ddlmZmZmZmZmZddlmZmZddl m Z ddl m Z ddl mZddlmZddlmZddlmZGd d ejjZd S) )AnyCallableIterableListTuple) interfaces renderers) requirements)utility) format_hints)intermed)elf)elfsc eZdZdZdZdZedeej j fdZ eddee de egeffdZe dd ejjd edee e e effd Zd ejjdefd Z dde egefded edefdZedd fdejjdede e gefdedeejjf dZdZdS)PsListz?Lists the processes present in a particular linux memory image.rr)rrreturnc 8tjddgdtjdtjdtjdd t d tjd d d dtjddd dtjddd dgS)Nkernelz Linux kernel)Intel32Intel64AArch64)name description architecturesrr)rpluginversionpidzFilter on specific process IDsT)rr element_typeoptionalthreadszInclude user threadsF)rrr"default decorate_commzXShow `user threads` comm in curly brackets, and `kernel threads` comm in square bracketsdumpzExtract listed processes)r ModuleRequirementPluginRequirementrElfsListRequirementintBooleanRequirement)clss \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/pslist.pyget_requirementszPsList.get_requirementss  **???     *DIy     (<       +2      +$v      +6    7! ! Npid_listc<|pg}d|Drfd}|SdS)a/Constructs a filter function for process IDs. Args: pid_list: List of process IDs that are acceptable (or None if all are acceptable) Returns: Function which, when provided a process object, returns True if the process is to be filtered out of the list cg|]}||SN).0xs r. z,PsList.create_pid_filter..Gs<<.filter_funcJsuK//r0cdSNFr5_s r.z*PsList.create_pid_filter..OsUr0r5)r-r1r;r:s @r.create_pid_filterzPsList.create_pid_filter;sR>r<<(<<<  # 0 0 0 0 0 "? "r0Ftaskr%c|j}|j}|jr |jjnd}tj|j}|r|jrd|d}n |jrd|d}|jj ||||f}|S)aExtract the fields needed for the final output Args: task: A task object from where to get the fields. decorate_comm: If True, it decorates the comm string of user threads in curly brackets, and of Kernel threads in square brackets. Defaults to False. Returns: A tuple with the fields to show in the plugin output. r[]{}) tgidr parentr array_to_stringcommis_kernel_threadis_user_threadvoloffset)r-rBr%r tidppidr task_fieldss r.get_task_fieldszPsList.get_task_fieldsQsih#';5t{A&ty11  %$ %"4{{{$ %$D}}}xS$= r0c tj|j|jddt j}|}|stj Sd}|j D]q}|j |j j krZtj|j|||||j}|r(t%|j}|nr|S)zExtract the elf for the process if requested Args: task: A task object to extract from. Returns: A string showing the results of the extraction, either the filename used or an error. linuxr) class_typeszError outputting file)r IntermediateSymbolTablecreatecontext config_pathrrVadd_process_layerr NotApplicableValuemm get_vma_itervm_start start_coderr)elf_dumpopenstrpreferred_filenameclose)selfrBelf_table_nameproc_layer_name file_outputv file_handles r._get_file_outputzPsList._get_file_outputls"9@@ L     A  0022 /11 12KW))++  :!333"&)"4"4 '& ##K#,&)+*H&I&I #))+++E4r0 pid_filterinclude_threadsr&c#K||j|jd||D]V}|r||}nd}|||\}}} } } dt j||| | | |ffVWdS)aGenerates the tasks list. Args: pid_filter: A function which takes a process object and returns True if the process should be ignored/filtered include_threads: If True, the output will also show the user threads If False, only the thread group leaders will be shown Defaults to False. decorate_comm: If True, it decorates the comm string of - User threads: in curly brackets, - Kernel threads: in square brackets Defaults to False. dump: If True, the main executable of the process is written to a file Defaults to False. Yields: Each rows rDisabledrN) list_tasksrYconfigrlrSr Hex) rfrmrnr%r&rBrirOr rPrQrs r. _generatorzPsList._generators.OO L$+h/_    D )"33D99 ( +/+?+?m+T+T (FCdD ((       r0cdSr=r5r>s r.r@zPsList.sur0rYvmlinux_module_namer;c#K|j|}|d}|jD].}||r|V|r|Ed{V/dS)aLists all the tasks in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from vmlinux_module_name: The name of the kernel module on which to operate filter_func: A function which takes a process object and returns True if the process should be ignored/filtered include_threads: If True, it will also return user threads. Yields: Task objects init_task) symbol_nameN)modulesobject_from_symboltasks get_threads)r-rYrvr;rnvmlinuxrxrBs r.rqzPsList.list_taskss$/"56..;.GG O . .D{4   JJJ .++--------- . .r0c |jd}|jd}|jd}|jd}||}dtjfdt fdt fdt fd t fd t fg}tj|| ||||S) Nr r#r%r&z OFFSET (V)PIDTIDPPIDCOMMz File output) rrgetrAr rsr+rcr TreeGridrt)rfpidsrnr%r&r;columnss r.runz PsList.runs{u%%+//)44 88 {v&&,,T22 <+ , CL CL SM SM C  ! T__[/=RVWW   r0r4)F)FFF)__name__ __module__ __qualname____doc___required_framework_version_version classmethodrr configurationRequirementInterfacer/r+rrboolrAobjectsObjectInterfacerrcrSrlrtrYContextInterfacerrqrr5r0r.rrsII"+H" j&>&S!T" " " [" H##c#hud{>S###[#*MR%5FJ sCc! "[4%Z%7%G%C%%%%T!&# ((cUD[)(( (  ((((T .=_ % ..#4.!.seTk* .  . *$4 5 ...[.>     r0rN)typingrrrrrvolatility3.frameworkrr #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr .volatility3.framework.symbols.linux.extensionsrvolatility3.plugins.linuxrpluginsPluginInterfacerr5r0r.rs8777777777777777777777<<<<<<111111888888222222>>>>>>******_ _ _ _ _ Z  /_ _ _ _ _ r0