X f/ddlZddlZddlmZmZmZmZddlmZm Z m Z ddl m Z ddl mZddlmZddlmZejeZGdd e jjZdS) N)CallableDictIterableList) exceptions interfaces renderers) requirements)utility) format_hints)macc DeZdZdZdZdZgdZedZede de e j j e e egefgee jjffdZedd eede egeffd Zd Zed fde j j de de egefdee jjfdZedfde j j de de egefdee jjfdZedfde j j de de egefdee jjfdZedfde j j de de egefdee jjfdZedfde j j de de egefdee jjfdZdZd S)PsListz=Lists the processes present in a particular mac memory image.)rr)rr)tasksallproc process_groupsessionspid_hash_tablec tjddddgtjdtjdtjd d |j|jd d tjddtd gS)NkernelzKernel module for the OSIntel32Intel64)name description architecturesmacutils)rr)r componentversion pslist_methodz!Method to determine for processesrT)rrchoicesdefaultoptionalpidzFilter on specific process IDs)rr element_typer%) r ModuleRequirementVersionRequirementr MacUtilitiesChoiceRequirementpslist_methodsListRequirementint)clss Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/pslist.pyget_requirementszPsList.get_requirementss  *6()4     +3+;Y     *$?**1-      (<     !  methodreturnc||jvr |jd}|dkr|j}nG|dkr|j}n9|dkr|j}n+|dkr|j}n|dkr|j}nt dtd||S) zReturns the list_tasks method based on the selector Args: method: Must be one fo the available methods in get_task_choices Returns: list_tasks method for listing tasks rrrrrrzImpossible method choice chosenz Using method ) r,list_tasks_allproclist_tasks_taskslist_tasks_process_grouplist_tasks_sessionslist_tasks_pid_hash_table ValueErrorvollogdebug)r/r3 list_taskss r0get_list_taskszPsList.get_list_tasks3s + + +'*F Y  /JJ w  -JJ  & &5JJ z ! !0JJ ' ' '6JJ>?? ? -V--...r2Npid_listc@d}|pg}d|Drfd}|}|S)NcdSNF_s r0z*PsList.create_pid_filter..Vsr2cg|]}||SNrD).0xs r0 z,PsList.create_pid_filter..Ys<<.list_filter\swk11r2rD)r/r@ filter_funcrPrOs @r0create_pid_filterzPsList.create_pid_filterTsT%o >r<<(<<<  & 2 2 2 2 2&Kr2c #PK||jd|jd}||j|jd||jddD]}t j|jj }tj |j }|j }|j}|j}|jj}|jj} t&j|| dz z} |j} d|||||| | ffVdS)Nr"rrr&)rQg.A)r?configgetr,contextrRr Hexvoloffsetr array_to_stringp_commrNp_uidp_gidp_starttv_sectv_usecdatetime fromtimestampp_ppid) selfr>taskrYrr&uidgidstart_time_secondsstart_time_microseconds start_timeppids r0 _generatorzPsList._generatorbs;(( KOOOT-@-C D D  J L K !..t{ud/K/KLL    G GD "%dho66F*4;77D*C*C*C!%!4 &*l&: #!*88"%ur2rVkernel_module_namerQc#<K|j|}|j|j}|dj}i}||jjdkr|jj|vr'ttj ddSd||jj<| |jj|jj r||s|V |j j}n#t j$rYdSwxYw||jjdkdSdSdSdS)aLists all the processes in the primary layer based on the allproc method Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a process object and returns True if the process should be ignored/filtered Returns: The list of process objects from the processes linked list after filtering r symbol_nameNrERecursive process list detected (a result of non-atomic acquisition).r)moduleslayers layer_nameobject_from_symbollh_firstrXrYr<logloggingINFOis_validsizep_listle_next dereferencerInvalidAddressException)r/rVrorQr kernel_layerprocseens r0r6zPsList.list_tasks_allproc{sJ$!34~f&78 ((Y(??H!48?a#7#7x$&& L[()TX_%$$ !k$''   {*66885    #48?a#7#7#7#7#7#7sC..DDcdSrCrDrEs r0rGzPsList.rnr2c#.K|j|}|j|j}|d}i}||ddD]}|jj|vr(ttj ddSd||jj< |j d} n#tj$rYwxYw|| jj| jjr|| s| VdS)aLists all the tasks in the primary layer based on the tasks queue Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering rrqrersrrN)rtrurvrw walk_listrXrYr<ryrzr{bsd_inforcastrrr|r}) r/rVrorQrr queue_entryrrers r0r7zPsList.list_tasks_taskss>"!34~f&78 //G/DD !))+wGG  Dx$&& L[()TX_% }002277??5    $$ !k$''  %  s,CCCcdSrCrDrEs r0rGzPsList.rnr2c#K|j|}|d}|d}|d||dz|d}|D]W}tj|dD]4} | jr|| js | jV5Xd S) aLists all the tasks in the primary layer using sessions Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering sesshashrq sesshashtblarrayr sesshashhead object_typerYcountsubtypes_hashN) rtrwobjectget_typer r*walk_list_heads_leader is_readable) r/rVrorQr table_sizer proc_array proc_listrs r0r9zPsList.list_tasks_sessionss"!34..:.FF //M/JJ ]]q.OON33 #  $ ( (I(77 8LL ( (=,,..({{4=7Q7Q(-''' ( ( (r2cdSrCrDrEs r0rGzPsList.rnr2c#K|j|}|d}|d}|d||dz|d}|D]\}tj|dD]9} tj| jd D]} || s| V:]d S) aLists all the tasks in the primary layer using process groups Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering pgrphashrq pgrphashtblrr pgrphashheadrpg_hashp_pglistN)rtrwrrr r*r pg_members) r/rVrorQrrrrrpgrprs r0r8zPsList.list_tasks_process_groups"!34..:.FF //M/JJ ]]q.OON33 #  $ # #I(77 9MM # #,;;OZ##D';t,,#" # # # #r2cdSrCrDrEs r0rGzPsList."rnr2c#HK|j|}|d}|d}|d||dz|d}|D]4}tj|dD]} || s| V5d S) aLists all the tasks in the primary layer using the pid hash table Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering pidhashrq pidhashtblrr pidhashheadrp_hashN)rtrwrrr r*r) r/rVrorQrrrrrrs r0r:z PsList.list_tasks_pid_hash_tables$!34..9.EE ..<.HH ]]q.OOM22 #  $  I(77 8LL  "{4((JJJ   r2c tjdtjfdtfdt fdt fdt fdt jfdt fg|S)NOFFSETNAMEPIDUIDGIDz Start TimePPID)r TreeGridr rWstrr.rarl)rds r0runz PsList.runAsd!<+,    x01   OO     r2rI)__name__ __module__ __qualname____doc___required_framework_version_versionr, classmethodr1rrrrVContextInterfacer.boolrobjectsObjectInterfacer?rrRrlr6r7r9r8r:rrDr2r0rrs9GG"+HXXXN  [ 2CH   ,c8SE4K3HI#34 6-[@  c hud{>S   [ GGG2 .=_ **#4* *seTk* * *$4 5 ***[*X .=_ ))#4) )seTk* ) *$4 5 )))[)V .=_ ( (#4 (  (seTk* ( *$4 5 ( ( ([ (D .=_ #####4## ##seTk* ## *$4 5 ######[##J .=_ !!#4! !seTk* ! *$4 5 !!![!F      r2r)rarztypingrrrrvolatility3.frameworkrrr #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr getLoggerrr<pluginsPluginInterfacerrDr2r0rs 111111111111CCCCCCCCCC<<<<<<111111888888------  8 $ ${ { { { { Z  /{ { { { { r2