
    Xf                         d Z ddlmZmZmZmZmZ ddlmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ ddlmZ  G d d	ej                  Zd
S )z%In-memory artifacts from OSX systems.    )IteratorTupleAny	GeneratorList)
exceptions	renderers
interfaces)requirements)plugins)utility)pslistc                       e Zd ZdZdZedeej        j	                 fd            Z
dee         deeeeeeeef         f         ddf         fdZdej        fdZdS )	Psauxz(Recovers program command line arguments.)   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	d
t          d          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    Y/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/psaux.pyget_requirementszPsaux.get_requirements   st     *6()4  
 *fmY   (< 	  
 	
    tasksNc              #     K   |D ]}|                                 }|| j        j        |         }|j        |j        z
  }|                    |          r|j        dk    s|j        dk    rg|j        dz   }|dk    rxt          j        |j	                  }g }|dk    r	 |
                    |d          }	n# t          j        $ r Y nw xY w|	                    d          }
|
dk    r
|	d |
         }	|t          t          |	                    dz   z  }t          |          dk    re||j        k     rD	 |
                    |d          }n# t          j        $ r Y nw xY w|dk    rn|dz   }||j        k     D|                    |	           n!|	|d         k    r|                    |	           |dz
  }|dk    d                    d |D                       }d|j        ||j        |ffV  d S )	Nr      i           c                 <    g | ]}|                     d d          S )zutf-8replace)errors)decode).0ss     r&   
<listcomp>z$Psaux._generator.<locals>.<listcomp>e   s(     S S S')!D!D S S Sr(   )add_process_layercontextlayers
user_stack	p_argslenis_validp_argcr   array_to_stringp_commreadr   InvalidAddressExceptionfindlenstrappendjoinp_pid)selfr)   taskproc_layer_name
proc_layer	argsstartargc	task_nameargsargidxcheckargs_strs                r&   
_generatorzPsaux._generator&   sa       >	F >	FD"4466O&,_=J$.8I ''	22>Q&&;!## ;?D d{{/<<I "D(($//)S99CC!9   E hhw''"99dsd)CSS]]Q..	 t99>>#do55"$.OOIq$A$AEE)A " " "!E" !G++!$-M	 $do55 KK$$$$ DG^^KK$$$ax? ((B xx S Sd S S STTHtz9dk8DEEEEE}>	F >	Fs$    B77C	C	2E		EEc           
         t           j                            | j                            dd                     }t           j                            | j                            dt           j        j        d                             }t          j        dt          fdt          fdt          fdt          fg|                      || j        | j        d         |	                              S )
Nr   pslist_methodr   PIDProcessArgc	Argumentsr   )filter_func)r   r"   create_pid_filterconfiggetget_list_taskspslist_methodsr	   TreeGridr$   rD   rT   r8   )rH   r[   
list_taskss      r&   runz	Psaux.runi   s    m55dkooeT6R6RSS]11KOOOV]-I!-LMM
 

 !S\Is+fc][#<NOOO
4<X)>KXXX 
 
 	
r(   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r
   configurationRequirementInterfacer'   r   r   r   r   r$   rD   rT   r	   ra   rc    r(   r&   r   r      s        22"+
j&>&S!T 
 
 
 [
$AFc]AF	5eCc3$6778$D	EAF AF AF AFF
Y' 
 
 
 
 
 
r(   r   N)rg   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.plugins.macr   PluginInterfacer   rl   r(   r&   <module>rt      s    , + 8 8 8 8 8 8 8 8 8 8 8 8 8 8 C C C C C C C C C C < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 * * * * * *f
 f
 f
 f
 f
G# f
 f
 f
 f
 f
r(   