X f/ddlZddlZddlmZmZmZmZddlmZm Z m Z ddl m Z ddl mZddlmZddlmZej&eZGdd e j,j.Zy) N)CallableDictIterableList) exceptions interfaces renderers) requirements)utility) format_hints)macc eZdZdZdZdZgdZedZede de e jje e egefgee j"j$ffdZedd eede egeffd Zd Zed fde jjde de egefdee j"j$fdZedfde jjde de egefdee j"j$fdZedfde jjde de egefdee j"j$fdZedfde jjde de egefdee j"j$fdZedfde jjde de egefdee j"j$fdZdZy )PsListz=Lists the processes present in a particular mac memory image.)rr)rr)tasksallproc process_groupsessionspid_hash_tablec tjddddgtjdtjdtj d d |j |j d d tjddtd gS)NkernelzKernel module for the OSIntel32Intel64)name description architecturesmacutils)rr)r componentversion pslist_methodz!Method to determine for processesrT)rrchoicesdefaultoptionalpidzFilter on specific process IDs)rr element_typer%) r ModuleRequirementVersionRequirementr MacUtilitiesChoiceRequirementpslist_methodsListRequirementint)clss Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/pslist.pyget_requirementszPsList.get_requirementss  * *6()4   + +3+;+;Y   * *$?****1-    ( (<   !  methodreturnc:||jvr|jd}|dk(r |j}nS|dk(r |j}nA|dk(r |j}n/|dk(r |j}n|dk(r |j }n t dtjd||S) zReturns the list_tasks method based on the selector Args: method: Must be one fo the available methods in get_task_choices Returns: list_tasks method for listing tasks rrrrrrzImpossible method choice chosenz Using method ) r,list_tasks_allproclist_tasks_taskslist_tasks_process_grouplist_tasks_sessionslist_tasks_pid_hash_table ValueErrorvollogdebug)r/r3 list_taskss r0get_list_taskszPsList.get_list_tasks3s ++ +''*F Y //J w --J  &55J z !00J ' '66J>? ? }VH-.r2Npid_listc\d}|xsg}|Dcgc]}|| c}rfd}|}|Scc}w)NcyNF_s r0z*PsList.create_pid_filter..Vr2c |jvSN)p_pid)x filter_lists r0 list_filterz-PsList.create_pid_filter..list_filter\swwk11r2rD)r/r@ filter_funcrLrNrMs @r0create_pid_filterzPsList.create_pid_filterTs?% >r"*taskrWrr&uidgidstart_time_secondsstart_time_microseconds start_timeppids r0 _generatorzPsList._generatorbs-(( KKOOOT-@-@-C D  LL KK !..t{{ud/KL  GD "%%dhhoo6F**4;;7D**C**C**C!%!4!4 &*ll&:&: #!**88"%rHr2rTkernel_module_namerOc#K|j|}|j|j}|jdj}i}||j j dk7r|j j |vr%tjtjdyd||j j <|j|j j |j jr ||s| |jjj}||j j dk7ryyyy#t j"$rYywxYww)aLists all the processes in the primary layer based on the allproc method Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a process object and returns True if the process should be ignored/filtered Returns: The list of process objects from the processes linked list after filtering r symbol_nameNrERecursive process list detected (a result of non-atomic acquisition).r)moduleslayers layer_nameobject_from_symbollh_firstrVrWr<logloggingINFOis_validsizep_listle_next dereferencerInvalidAddressException)r/rTrlrOr kernel_layerprocseens r0r6zPsList.list_tasks_allproc{s!$!34~~f&7&78 ((Y(?HH!488??a#7xx$& LL[()TXX__%$$!$'  {{**668!488??a#7#7"55  s0C>E$E%EEEEEEcyrCrDrEs r0rGzPsList.rHr2c#xK|j|}|j|j}|jd}i}|j |ddD]}|j j |vr&tjtjdyd||j j < |jjjd} |j!| j j | j j"s|| r| y#tj$rYwxYww)aLists all the tasks in the primary layer based on the tasks queue Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering rrnrcrprrN)rqrrrsrt walk_listrVrWr<rvrwrxbsd_infor}castrr~ryrz) r/rTrlrOrr queue_entryrrcrs r0r7zPsList.list_tasks_taskss "!34~~f&7&78 //G/D !))+wG Dxx$& LL[()TXX__% }}00277?$$!$' % 55  s6B*D:-)D!:D:D:D:!D74D:6D77D:cyrCrDrEs r0rGzPsList.rHr2c#K|j|}|jd}|jd}|jd||dz|jd}|D]c}tj j |dD]>} | jjs|| jr1| j@ey w) aLists all the tasks in the primary layer using sessions Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering sesshashrn sesshashtblarrayr sesshashhead object_typerWcountsubtypes_hashN) rqrtobjectget_typer r*walk_list_heads_leader is_readable) r/rTrlrOr table_sizer proc_array proc_listrs r0r9zPsList.list_tasks_sessionss"!34..:.F //M/J ]]q.OON3 # $ (I((77 8L (==,,.{4==7Q--' ( (sBC C3CcyrCrDrEs r0rGzPsList.rHr2c#K|j|}|jd}|jd}|jd||dz|jd}|D]c}tj j |dD]>} tj j | jd D]} || r | @ey w) aLists all the tasks in the primary layer using process groups Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering pgrphashrn pgrphashtblrr pgrphashheadrpg_hashp_pglistN)rqrtrrr r*r pg_members) r/rTrlrOrrrrrpgrprs r0r8zPsList.list_tasks_process_groups"!34..:.F //M/J ]]q.OON3 # $ #I((77 9M #,,;;OOZ#D't," # # #s B8C; CcyrCrDrEs r0rGzPsList."rHr2c#2K|j|}|jd}|jd}|jd||dz|jd}|D]4}tj j |dD]} || r | 6y w) aLists all the tasks in the primary layer using the pid hash table Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: The list of task objects from the `layer_name` layer's `tasks` list after filtering pidhashrn pidhashtblrr pidhashheadrp_hashN)rqrtrrr r*r) r/rTrlrOrrrrrrs r0r:z PsList.list_tasks_pid_hash_tables$!34..9.E ..<.H ]]q.OOM2 # $ I((77 8L "4(J  s B B Bc tjdtjfdtfdt fdt fdt fdt j fdt fg|jS)NOFFSETNAMEPIDUIDGIDz Start TimePPID)r TreeGridr rUstrr.r_rj)rbs r0runz PsList.runAse!!<++,    x001   OO   r2rJ)__name__ __module__ __qualname____doc___required_framework_version_versionr, classmethodr1rrrrTContextInterfacer.boolrobjectsObjectInterfacer?rrPrjr6r7r9r8r:rrDr2r0rrsG"+HXN  2CH    , ,c8SE4K3HI##334 6-@ c hud{>S  G2 .= *##44* *seTk* * *$$44 5 **X .= )##44) )seTk* ) *$$44 5 ))V .= (##44 (  (seTk* ( *$$44 5 ( (D .= ####44## ##seTk* ## *$$44 5 ####J .= !##44! !seTk* ! *$$44 5 !!F  r2r)r_rwtypingrrrrvolatility3.frameworkrrr #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersr volatility3.framework.symbolsr getLoggerrr<pluginsPluginInterfacerrDr2r0rsQ 11CC<18-   8 ${ Z   / /{ r2