
    *1fB                         d dl Z d dlmZmZmZ d dlZd dlmZ d dlm	Z	m
Z
mZmZmZ d dlmZ d dlmZ d dlmZ d dlmZ  e j,                  e      Z G d	 d
e      Z G d de
j4                  j6                        Zy)    N)IterableListTuple)Enum)	renderers
interfacessymbols	constants
exceptions)requirements)utility)scanners)format_hintsc                   &    e Zd ZdZdZdZdZeez  Zy)DescExitStateEnumzBEnum for linux task exit_state as defined in include/linux/sched.hr          N)__name__
__module____qualname____doc__TASK_RUNNING	EXIT_DEADEXIT_ZOMBIE
EXIT_TRACE     \/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/psscan.pyr   r      s    LLIKy(Jr   r   c            
       (   e Zd ZdZdZdZedeej                  j                     fd       Zdej                  j                  deeeeeef   fdZd Zed	ej&                  j(                  d
ededeej                  j                     fd       Zd Zy)PsScanz8Scans for processes present in a particular linux image.)   r   r   )   r   r"   returnc                 8    t        j                  ddg d      gS )NkernelzLinux kernel)Intel32Intel64AArch64)namedescriptionarchitectures)r   ModuleRequirement)clss    r   get_requirementszPsScan.get_requirements!   s%     ***?
 	
r   taskc                 t   |j                   }|j                  }d}|j                  j                         r|j                  j                   }t	        j
                  |j                        }t        |j                        j                  }t        j                  |j                  j                        |||||f}|S )zExtract the fields needed for the final output

        Args:
            task: A task object from where to get the fields.
        Returns:
            A tuple with the fields to show in the plugin output.
        r   )tgidpidparentis_readabler   array_to_stringcommr   
exit_stater)   r   Hexvoloffset)selfr/   r2   tidppidr)   r7   task_fieldss           r   _get_task_fieldszPsScan._get_task_fields+   s     iihh;;""$;;##D&&tyy1&t7<<
 TXX__-
 r   c              #      K   | j                   d   }| j                  j                  |   }| j                  | j                  ||j                        D ]  }| j                  |      }d|f  yw)z(Generates the tasks found from scanning.r%   r   N)configcontextmodules
scan_tasks
layer_namer?   )r;   vmlinux_module_namevmlinuxr/   rows        r   
_generatorzPsScan._generatorH   sq      #kk(3,,&&':;OOLL-w/A/A
 	D ''-Cc(N		s   A-A/rB   rF   kernel_layer_namec           
   #     K   |j                   |   }t        j                  ||j                         }|rd}nd}|j	                  d      j
                  d   d   }|j                  |   }g }	|j                  D ]  }
d|
v s|j                  |j                  |
      j                  |j                  z         }t        j                  ||      }t        j                  d|
 dt        |       d	|j                                 |	j!                  |        t#        |j$                        d
kD  r't        j'                  d|j$                  d    d       nGt#        |j$                        dk(  r/t        j)                  d       t+        j,                  |d| d      |j$                  d   }|j                  |   }|j/                  |t1        j2                  |	            D ]  \  }}|j5                  |j                  t6        j8                  z   dz   ||z
  ||      }	 t;        |j<                         d|jB                  cxk  rdk  sFn t        j                  dt        |j@                  j                         d|jB                   d       |  y# t>        $ rG t        j                  dt        |j@                  j                         d|j<                   d       Y w xY ww)aQ  Scans for tasks in the memory layer.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            vmlinux_module_name: The name of the kernel module on which to operate
            kernel_layer_name: The name for the kernel layer
        Yields:
            Task objects
        IQtask_structsched_classr   _sched_classzFound a sched_class named z at offset z. Will scan for these bytes: r"   z5Kernel layer depends on multiple layers however only z  will be scanned by this plugin.z[Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan.zLayer z has no dependencies)r:   rE   native_layer_namezSkipping task_struct at z as exit_state z is likely not validi  z as pid N)"rC   r	   symbol_table_is_64bitsymbol_table_nameget_typememberslayerscanonicalize
get_symboladdressr:   structpackvollogdebughexappendlendependencieswarningerrorr   LayerExceptionscanr   MultiStringScannerobjectr
   BANGr   r7   
ValueErrorr9   r2   )r-   rB   rF   rJ   rG   is_32bitpack_formatsched_class_offsetkernel_layerneedlessymboladdrpacked_addrmemory_layer_namememory_layerrY   _ptasks                     r   rD   zPsScan.scan_tasksT   s      //"56 44Wg>W>WXXKK$--m<DD]STUV~~&78oo 	,F'#00&&v.66G %kk+t< 0CI;Nklwl{l{l}k~
 {+	," |(()A-NNGHaHabcHdGe  fF  G **+q0LLm ++!V,=+>>R#S  )55a8~~&78 '++X009
 	JGQ NN))INN:]J!33,"3	 # E!%"2"23 		)E).s5993C3C/D.EXeii[Xlm K5	  .s5993C3C/D.E_UZUeUeTffz{ 	s3   A=K% FK%J0A"K%AK"K%!K""K%c                     dt         j                  fdt        fdt        fdt        fdt        fdt        fg}t	        j
                  || j                               S )Nz
OFFSET (P)PIDTIDPPIDCOMM
EXIT_STATE)r   r8   intstrr   TreeGridrI   )r;   columnss     r   runz
PsScan.run   sW    <++,CLCLSMSM3
 !!'4??+<==r   N)r   r   r   r   _required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer.   objectsObjectInterfacer   r|   r}   r?   rI   rB   ContextInterfacer   rD   r   r   r   r   r    r       s    B"+H
j&>&>&S&S!T 
 
&&66	sCc3&	':
 V##44V !V 	V
 
*$$44	5V Vp	>r   r    )loggingtypingr   r   r   rZ   enumr   volatility3.frameworkr   r   r	   r
   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.layersr   volatility3.framework.renderersr   	getLoggerr   r\   r   pluginsPluginInterfacer    r   r   r   <module>r      s`     ( (   W W < 1 1 8			8	$) )[>Z// [>r   