
    XfS                         d Z ddlZddlZddlmZmZmZ ddlmZ ddl	m
Z
 ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ  G d de
j*                  ej,                        Zy)ziA module containing a collection of plugins that produce data typically
found in mac's /proc file system.    N)	constants	rendererssymbols)requirements)plugins)scanners)utility)BashIntermedSymbols)	timeliner)pslistc                   6    e Zd ZdZdZed        Zd Zd Zd Z	y)Bashz*Recovers bash command history from memory.)   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    X/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/bash.pyget_requirementszBash.get_requirements   sa     **6()4
 **fmmY ((< 	
 	
    c           
   #   x  K   | j                   j                  | j                  d      }t        j                  | j                   |j
                         }|rd}d}nd}d}t        j                  | j                   | j                  d|      }| j                   j                  j                  |t        j                  z   dz         j                  d      }|D ]  }t        j                  |j                         }	|	d	vr(|j#                         }
|
;| j                   j$                  |
   }g }|j'                  | j                   t)        j*                  d
      |j-                  | j                   | j                  d   d            D ]'  }|j/                  t1        j2                  ||             ) g }|j'                  | j                   t)        j4                  |      |j-                  | j                   | j                  d   d            D ]\  \  }}| j                   j7                  |t        j                  z   dz   ||z
  |
      }|j9                         sL|j/                  |       ^ t;        |d       D ];  }dt=        |j>                        |	|jA                         |jC                         ff =  y w)Nr   Ibash32Qbash64linux
hist_entry	timestamp)bashshdash   #T)
rw_no_file)sections)offset
layer_namec                 "    | j                         S )N)get_time_as_integer)xs    r#   <lambda>z!Bash._generator.<locals>.<lambda>i   s    a>S>S>U r%   )keyr   )"contextmodulesconfigr   symbol_table_is_64bitsymbol_table_namer
   createconfig_pathsymbol_spaceget_typer   BANGrelative_child_offsetr	   array_to_stringp_commadd_process_layerlayersscanr   BytesScannerget_process_memory_sectionsappendstructpackMultiStringScannerobjectis_validsortedr!   p_pidget_time_objectget_command)selftasksdarwinis_32bitpack_formatbash_json_filebash_table_name	ts_offsettask	task_nameproc_layer_name
proc_layer
bang_addrsaddresshistory_entries_hists                    r#   
_generatorzBash._generator,   s    %%dkk(&;<44LL&22
 
 K%NK%N-44LL$**G^
 LL--66inn,|;



, 	  2	D//<I 66"446O&,,_=JJ &??%%d+99LL$++h"7D :  +  E !!&++k7"CDE !O(oo++J799LL$++h"7D :  .  1
 ||**#inn4|C"Y.. +  ==?#**401  4UV 	DJJ!,,.((*	 	S2	s   IJ:A#J:c           
         t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  j	                  dt         j                  j                  d               }t        j                  dt        fdt        fdt        j                  fdt        fg| j                   || j                  | j                  d   |	                  S )
Nr   pslist_methodr   PIDProcessCommandTimeCommandr   filter_func)r   r   create_pid_filterr=   getget_list_taskspslist_methodsr   TreeGridr!   strdatetimerh   r;   )rW   rp   
list_taskss      r#   runzBash.runt   s    mm55dkkooeT6RS]]11KKOOOV]]-I-I!-LM

 !!C  1 12C 	 OO4<<X)>KX

 
	
r%   c              #     K   t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  j	                  dt         j                  j                  d               }| j                   || j                  | j                  d   |            D ]=  }|\  }}|d    d|d    d|d	    d
}|t        j                  j                  |d   f ? y w)Nr   rj   r   r   ro   z (   z): "r   "r   )r   r   rq   r=   rr   rs   rt   rh   r;   r   TimeLinerTypeCREATED)rW   rp   rx   row_depthrow_datar   s          r#   generate_timelinezBash.generate_timeline   s     mm55dkkooeT6RS]]11KKOOOV]]-I-I!-LM

 ??t||T[[%:T
 	NC  #FH%a[MHQK=Xa[MKK	 7 7 ? ?!MM	Ns   D DN)
__name__
__module____qualname____doc___required_framework_versionclassmethodr$   rh   ry   r    r%   r#   r   r      s/    4"+
 
$FP
$Nr%   r   )r   rw   rN   volatility3.frameworkr   r   r   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.layersr   volatility3.framework.objectsr	   (volatility3.framework.symbols.linux.bashr
   volatility3.pluginsr   volatility3.plugins.macr   PluginInterfaceTimeLinerInterfacer   r   r%   r#   <module>r      sK   %   ? ? < 4 1 1 H ) *}N7""I$@$@ }Nr%   