
    XfS                         d Z ddlZddlZddlmZmZmZ ddlmZ ddl	m
Z
 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ  G d de
j        ej                  ZdS )ziA module containing a collection of plugins that produce data typically
found in mac's /proc file system.    N)	constants	rendererssymbols)requirements)plugins)scanners)utility)BashIntermedSymbols)	timeliner)pslistc                   >    e Zd ZdZdZed             Zd Zd Zd Z	dS )Bashz*Recovers bash command history from memory.)   r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	d
t          d          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    X/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/bash.pyget_requirementszBash.get_requirements   st     *6()4  
 *fmY   (< 	  
 	
    c           
   #     K   | j         j        | j        d                  }t          j        | j         |j                   }|rd}d}nd}d}t          j        | j         | j        d|          }| j         j	        
                    |t          j        z   dz                                 d          }|D ]}t          j        |j                  }	|	d	vr!|                                }
|
8| j         j        |
         }g }|                    | j         t)          j        d
          |                    | j         | j        d         d                    D ]*}|                    t1          j        ||                     +g }|                    | j         t)          j        |          |                    | j         | j        d         d                    D ]^\  }}| j                             |t          j        z   dz   ||z
  |
          }|                                r|                    |           _t;          |d           D ]B}dt=          |j                  |	|                                 |!                                ffV  Cd S )Nr   Ibash32Qbash64linux
hist_entry	timestamp)bashshdash   #T)
rw_no_file)sections)offset
layer_namec                 *    |                                  S )N)get_time_as_integer)xs    r#   <lambda>z!Bash._generator.<locals>.<lambda>i   s    a>S>S>U>U r%   )keyr   )"contextmodulesconfigr   symbol_table_is_64bitsymbol_table_namer
   createconfig_pathsymbol_spaceget_typer   BANGrelative_child_offsetr	   array_to_stringp_commadd_process_layerlayersscanr   BytesScannerget_process_memory_sectionsappendstructpackMultiStringScannerobjectis_validsortedr!   p_pidget_time_objectget_command)selftasksdarwinis_32bitpack_formatbash_json_filebash_table_name	ts_offsettask	task_nameproc_layer_name
proc_layer
bang_addrsaddresshistory_entries_hists                    r#   
_generatorzBash._generator,   s     %dk(&;<4L&2
 
 
  	&K%NNK%N-4L$*G^
 
 L-66in,|;
 



,
, 	  2	 2	D/<<I 666"4466O&,_=JJ &??%d++99L$+h"7D :   +   E E !!&+k7"C"CDDDD O(oo+J7799L$+h"7D :   .   1 1
 |**#in4|C"Y.. +   ==?? 1#**40004U4UVVV 	 	DJ!,,..((**	    	S2	 2	r%   c           
         t           j                            | j                            dd                     }t           j                            | j                            dt           j        j        d                             }t          j        dt          fdt          fdt          j        fdt          fg|                      || j        | j        d         |	                              S )
Nr   pslist_methodr   PIDProcessCommandTimeCommandr   filter_func)r   r   create_pid_filterr=   getget_list_taskspslist_methodsr   TreeGridr!   strdatetimerh   r;   )rW   rp   
list_taskss      r#   runzBash.runt   s    m55dkooeT6R6RSS]11KOOOV]-I!-LMM
 

 !C  12C 	 OO
4<X)>KXXX 

 

 
	
r%   c              #     K   t           j                            | j                            dd                     }t           j                            | j                            dt           j        j        d                             }|                      || j        | j        d         |                    D ]@}|\  }}|d          d|d          d|d	          d
}|t          j
        j        |d         fV  Ad S )Nr   rj   r   r   ro   z (   z): "r   "r   )r   r   rq   r=   rr   rs   rt   rh   r;   r   TimeLinerTypeCREATED)rW   rp   rx   row_depthrow_datar   s          r#   generate_timelinezBash.generate_timeline   s      m55dkooeT6R6RSS]11KOOOV]-I!-LMM
 

 ??Jt|T[%:TTT
 
 	N 	NC  #FH%a[KKHQKKKXa[KKKK	 7 ?!MMMMM	N 	Nr%   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr$   rh   ry   r    r%   r#   r   r      so        44"+
 
 [
$F F FP
 
 
$N N N N Nr%   r   )r   rw   rN   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.layersr   volatility3.framework.objectsr	   (volatility3.framework.symbols.linux.bashr
   volatility3.pluginsr   volatility3.plugins.macr   PluginInterfaceTimeLinerInterfacer   r   r%   r#   <module>r      s  % %   ? ? ? ? ? ? ? ? ? ? < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 1 1 1 1 1 1 H H H H H H ) ) ) ) ) ) * * * * * *}N }N }N }N }N7"I$@ }N }N }N }N }Nr%   