
    *1fB                         d dl Z d dlmZmZmZ d dlZd dlmZ d dlm	Z	m
Z
mZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ  e j        e          Z G d	 d
e          Z G d de
j        j                  ZdS )    N)IterableListTuple)Enum)	renderers
interfacessymbols	constants
exceptions)requirements)utility)scanners)format_hintsc                   (    e Zd ZdZdZdZdZeez  ZdS )DescExitStateEnumzBEnum for linux task exit_state as defined in include/linux/sched.hr          N)__name__
__module____qualname____doc__TASK_RUNNING	EXIT_DEADEXIT_ZOMBIE
EXIT_TRACE     \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/psscan.pyr   r      s-        LLLIKy(JJJr   r   c            
           e Zd ZdZdZdZedeej	        j
                 fd            Zdej        j        deeeeeef         fdZd Zed	ej        j        d
ededeej        j                 fd            Zd ZdS )PsScanz8Scans for processes present in a particular linux image.)   r   r   )   r   r"   returnc                 6    t          j        ddg d          gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures)r   ModuleRequirement)clss    r   get_requirementszPsScan.get_requirements!   s2     **???  
 	
r   taskc                    |j         }|j        }d}|j                                        r|j        j         }t	          j        |j                  }t          |j                  j	        }t          j        |j        j                  |||||f}|S )zExtract the fields needed for the final output

        Args:
            task: A task object from where to get the fields.
        Returns:
            A tuple with the fields to show in the plugin output.
        r   )tgidpidparentis_readabler   array_to_stringcommr   
exit_stater)   r   Hexvoloffset)selfr/   r2   tidppidr)   r7   task_fieldss           r   _get_task_fieldszPsScan._get_task_fields+   s     ih;""$$ 	$;#D&ty11&t77<
 TX_--
 r   c              #      K   | j         d         }| j        j        |         }|                     | j        ||j                  D ]}|                     |          }d|fV  dS )z(Generates the tasks found from scanning.r%   r   N)configcontextmodules
scan_tasks
layer_namer?   )r;   vmlinux_module_namevmlinuxr/   rows        r   
_generatorzPsScan._generatorH   s}       #k(3,&':;OOL-w/A
 
 	 	D ''--Cc(NNNN		 	r   rB   rF   kernel_layer_namec           
   #     K   |j         |         }t          j        ||j                   }|rd}nd}|                    d          j        d         d         }|j        |         }g }	|j        D ]}
d|
v r|                    |                    |
          j	        |j
        z             }t          j        ||          }t                              d|
 dt          |           d	|                                            |	                    |           t#          |j                  d
k    r*t                              d|j        d          d           nKt#          |j                  dk    r3t                              d           t+          j        |d| d          |j        d         }|j        |         }|                    |t1          j        |	                    D ]\  }}|                    |j        t6          j        z   dz   ||z
  ||          }	 t;          |j                   nM# t>          $ r@ t                              dt          |j         j
                   d|j         d           Y w xY wd|j!        cxk     rdk     s@n t                              dt          |j         j
                   d|j!         d           |V  dS )aQ  Scans for tasks in the memory layer.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            vmlinux_module_name: The name of the kernel module on which to operate
            kernel_layer_name: The name for the kernel layer
        Yields:
            Task objects
        IQtask_structsched_classr   _sched_classzFound a sched_class named z at offset z. Will scan for these bytes: r"   z5Kernel layer depends on multiple layers however only z  will be scanned by this plugin.z[Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan.zLayer z has no dependencies)r:   rE   native_layer_namezSkipping task_struct at z as exit_state z is likely not validi  z as pid N)"rC   r	   symbol_table_is_64bitsymbol_table_nameget_typememberslayerscanonicalize
get_symboladdressr:   structpackvollogdebughexappendlendependencieswarningerrorr   LayerExceptionscanr   MultiStringScannerobjectr
   BANGr   r7   
ValueErrorr9   r2   )r-   rB   rF   rJ   rG   is_32bitpack_formatsched_class_offsetkernel_layerneedlessymboladdrpacked_addrmemory_layer_namememory_layerrY   _ptasks                     r   rD   zPsScan.scan_tasksT   s\       /"56 4Wg>WXXX 	KKK$--m<<D]STUV~&78o 	, 	,F''#00&&v..6G  %k+t<< CIIlwl{l{l}l}  
 {+++|())A--NN GHabcHd  G  G  G    *++q00LLn   +!#S,=#S#S#S   )5a8~&78 '++X099
 
 	 	JGQ NN)IN:]J!33,"3	 #  E!%"23333   {s593C/D/D{{UZUe{{{   	 	))))E))))ms593C/D/Dmmeimmm   KKKK5	 	s   H11AI;:I;c                     dt           j        fdt          fdt          fdt          fdt          fdt          fg}t	          j        ||                                           S )Nz
OFFSET (P)PIDTIDPPIDCOMM
EXIT_STATE)r   r8   intstrr   TreeGridrI   )r;   columnss     r   runz
PsScan.run   sW    <+,CLCLSMSM3
 !'4??+<+<===r   N)r   r   r   r   _required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer.   objectsObjectInterfacer   r|   r}   r?   rI   rB   ContextInterfacer   rD   r   r   r   r   r    r       s       BB"+H
j&>&S!T 
 
 
 [
&6	sCc3&	'   :
 
 
 V#4V !V 	V
 
*$4	5V V V [Vp	> 	> 	> 	> 	>r   r    )loggingtypingr   r   r   rZ   enumr   volatility3.frameworkr   r   r	   r
   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.layersr   volatility3.framework.renderersr   	getLoggerr   r\   r   pluginsPluginInterfacer    r   r   r   <module>r      s;    ( ( ( ( ( ( ( ( ( (        W W W W W W W W W W W W W W < < < < < < 1 1 1 1 1 1 1 1 1 1 1 1 8 8 8 8 8 8		8	$	$) ) ) ) ) ) ) )[> [> [> [> [>Z/ [> [> [> [> [>r   