
    Xf                         d Z ddlmZmZmZmZmZ ddlmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ ddlmZ  G d d	ej&                        Zy
)z%In-memory artifacts from OSX systems.    )IteratorTupleAny	GeneratorList)
exceptions	renderers
interfaces)requirements)plugins)utility)pslistc                       e Zd ZdZdZedeej                  j                     fd       Z
dee   deeeeeeeef   f   ddf   fdZdej&                  fdZy)	Psauxz(Recovers program command line arguments.)   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	d
t        d      gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionpidzFilter on specific process IDsT)r   r   element_typeoptional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    Y/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/psaux.pyget_requirementszPsaux.get_requirements   sa     **6()4
 **fmmY ((< 	
 	
    tasksNc           
   #     K   |D ]  }|j                         }|| j                  j                  |   }|j                  |j                  z
  }|j                  |      r|j                  dk(  s|j                  dk(  ry|j                  dz   }|dkD  rt        j                  |j                        }g }|dkD  r	 |j                  |d      }	|	j                  d      }
|
dk7  r|	d |
 }	|t        t        |	            dz   z  }t        |      dk(  rO||j                  k  r.	 |j                  |d      }|dk7  rn|dz   }||j                  k  r.|j!                  |	       n|	|d   k7  r|j!                  |	       |dz
  }|dkD  rdj#                  |D cg c]  }|j%                  dd	
       c}      }d|j&                  ||j                  |ff  y # t        j                  $ r Y gw xY w# t        j                  $ r Y w xY wc c}w w)Nr      i           zutf-8replace)errors)add_process_layercontextlayers
user_stack	p_argslenis_validp_argcr   array_to_stringp_commreadr   InvalidAddressExceptionfindlenstrappendjoindecodep_pid)selfr)   taskproc_layer_name
proc_layer	argsstartargc	task_nameargsargidxchecksargs_strs                 r&   
_generatorzPsaux._generator&   s      >	FD"446O&,,_=J$..8I ''	2>>Q&;;!# ;;?D d{//<I "D($//)S9C hhw'"9ds)CSS]Q..	 t9>#doo5"$.OOIq$AE !G+!$-M	 $doo5 KK$ DG^KK$ax? (B xxd S')!D STHtzz9dkk8DEE}>	F< "99   *AA "!"  !Tsg   B7H:GAHG-1H5HHH
+)HG*'H)G**H-H HHHc           
         t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  j	                  dt         j                  j                  d               }t        j                  dt        fdt        fdt        fdt        fg| j                   || j                  | j                  d   |	                  S )
Nr   pslist_methodr   PIDProcessArgc	Argumentsr   )filter_func)r   r"   create_pid_filterconfiggetget_list_taskspslist_methodsr	   TreeGridr$   r?   rQ   r3   )rD   rX   
list_taskss      r&   runz	Psaux.runi   s    mm55dkkooeT6RS]]11KKOOOV]]-I-I!-LM

 !!S\Is+fc][#<NOOO4<<X)>KX
 	
r(   )__name__
__module____qualname____doc___required_framework_versionclassmethodr   r
   configurationRequirementInterfacer'   r   r   r   r   r$   r?   rQ   r	   r^   r`    r(   r&   r   r      s    2"+
j&>&>&S&S!T 
 
$AFc]AF	5eCc3$6778$D	EAFF
Y'' 
r(   r   N)rd   typingr   r   r   r   r   volatility3.frameworkr   r	   r
   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.plugins.macr   PluginInterfacer   ri   r(   r&   <module>rq      s6    , 8 8 C C < 4 1 *f
G## f
r(   