wf"ddlmZmZmZmZmZddlmZmZddl m Z ddl m Z ddl mZddlmZddlmZddlmZGd d ej*j,Zy ) )AnyCallableIterableListTuple) interfaces renderers) requirements)utility) format_hints)intermed)elf)elfsc eZdZdZdZdZedeejjfdZ eddee de egeffdZe dd ej"j$d edee e e effd Zd ej"j$defd Z dde egefded edefdZedd fdej0j2dede e gefdedeej"j$f dZdZy)PsListz?Lists the processes present in a particular linux memory image.rr)rrreturnc Jtjddgdtjdtjdtj dd t d tjd d d dtjddd dtjddd dgS)Nkernelz Linux kernel)Intel32Intel64AArch64)name description architecturesrr)rpluginversionpidzFilter on specific process IDsT)rr element_typeoptionalthreadszInclude user threadsF)rrr"default decorate_commzXShow `user threads` comm in curly brackets, and `kernel threads` comm in square bracketsdumpzExtract listed processes)r ModuleRequirementPluginRequirementrElfsListRequirementintBooleanRequirement)clss \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/pslist.pyget_requirementszPsList.get_requirementss  * **?   * *DIIy   ( (<     + +2    + +$v    + +6  7! ! Npid_listcX|xsg}|Dcgc]}|| c}rfd}|SdScc}w)a/Constructs a filter function for process IDs. Args: pid_list: List of process IDs that are acceptable (or None if all are acceptable) Returns: Function which, when provided a process object, returns True if the process is to be filtered out of the list c |jvSN)r )x filter_lists r. filter_funcz-PsList.create_pid_filter..filter_funcJsuuK//r0cyNF_s r.z*PsList.create_pid_filter..Or0r:)r-r1r5r7r6s @r.create_pid_filterzPsList.create_pid_filter;s=>r"*r>r0rWvmlinux_module_namer7c#K|j|}|jd}|jD]*}||r ||s|jEd{,y7w)aLists all the tasks in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from vmlinux_module_name: The name of the kernel module on which to operate filter_func: A function which takes a process object and returns True if the process should be ignored/filtered include_threads: If True, it will also return user threads. Yields: Task objects init_task) symbol_nameN)modulesobject_from_symboltasks get_threads)r-rWrtr7rlvmlinuxrvr@s r.rozPsList.list_taskssi$//"56..;.G OO .D4 J++--- ..sAA A AA c |jjd}|jjd}|jjd}|jjd}|j|}dtjfdt fdt fdt fd t fd t fg}tj||j||||S) Nr r#r%r&z OFFSET (V)PIDTIDPPIDCOMMz File output) rpgetr?r rqr+rar TreeGridrr)rdpidsrlr%r&r7columnss r.runz PsList.runs{{u%++//)4 8 {{v&,,T2 <++ , CL CL SM SM C  !! T__[/=RVW  r0r4)F)FFF)__name__ __module__ __qualname____doc___required_framework_version_version classmethodrr configurationRequirementInterfacer/r+rrboolr?objectsObjectInterfacerrarQrjrrrWContextInterfacerrorr:r0r.rrsI"+H" j&>&>&S&S!T" " H#c#hud{>S##*MR%%55FJ sCc! "4'Z%7%7%G%G'C'X!&# (cUD[)(( (  (T .= % .##44.!.seTk* .  . *$$44 5 ..> r0rN)typingrrrrrvolatility3.frameworkrr #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr .volatility3.framework.symbols.linux.extensionsrvolatility3.plugins.linuxrpluginsPluginInterfacerr:r0r.rs<877<182>*a Z   / /a r0