
    Xf1                     h    d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z	  G d dej
                  ZdS )	    )	renderers)requirements)plugins)utility)pslistc                   N     e Zd ZdZdZ fdZed             Zd Zd Z	d Z
 xZS )PsTreezLPlugin for listing processes in a tree based on their parent process
    ID.)   r   r   c                 d     t                      j        |i | i | _        i | _        i | _        d S )N)super__init__
_processes_levels	_children)selfargskwargs	__class__s      Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/pstree.pyr   zPsTree.__init__   s8    $)&)))    c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   PsList)clss    r   get_requirementszPsTree.get_requirements   sQ     *6()4  
 *fmY  	
 		
r   c                 4   t          g           }|                    |           d}| j                            |d          }||j        j        dk    r|j        dk    r|j        |vrt          |j                  }| j                            |t          g                     }|                    |j	                   || j        |<   | j                            |d          }|dz  }|$|j        j        dk    r|j        dk    r	|j        |v|| j
        |<   dS )z0Finds how deep the pid is in the processes list.r   N   )setaddr   getvoloffsetp_ppidintr   p_pidr   )r   pidseenlevelprocppid
child_lists          r   _find_levelzPsTree._find_level%   s   2ww""3--1$$q  4''t{##D++D#b''::JNN4:&&&#-DN4 ?&&tT22DQJE 1$$q  4'' "Sr   c              #      K   t           j                             j                            dt           j        j        d                             } | j         j        d                   D ]}| j        |j        <    j        D ]} 	                    |            fd j
        D ]$} j
        |         dk    r |          E d{V  %dS )z$Generates the tree list of processespslist_methodr   r   c              3      K   j         |          }|j        |j        t          j        |j                  f}j        |          dz
  |fV  j                            | g           D ]} |          E d {V  d S )Nr'   )	r   r/   r-   r   array_to_stringp_commr   r   r*   )r0   r3   row	child_pidr   yield_processess       r   r>   z*PsTree._generator.<locals>.yield_processesF   s      ?3'D:t{G,CDK,P,PQC<$q(#....!^//R88 6 6	*?955555555556 6r   r'   N)r   r#   get_list_tasksconfigr*   pslist_methodscontextr   r/   r6   r   )r   
list_tasksr3   r0   r>   s   `   @r   
_generatorzPsTree._generator9   s     ]11KOOOV]-I!-LMM
 

 Jt|T[-BCC 	/ 	/D*.DODJ'' ? 	" 	"CS!!!!	6 	6 	6 	6 	6 	6 < 	0 	0C|C A%%*?3/////////	0 	0r   c                     t          j        dt          fdt          fdt          fg|                                           S )NPIDPPIDCOMM)r   TreeGridr.   strrD   )r   s    r   runz
PsTree.runR   s9    !S\FC=63-8$//:K:K
 
 	
r   )__name__
__module____qualname____doc___required_framework_versionr   classmethodr%   r6   rD   rK   __classcell__)r   s   @r   r	   r	      s          #,     

 

 [

" " "(0 0 02
 
 
 
 
 
 
r   r	   N)volatility3.frameworkr   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.plugins.macr   PluginInterfacer	    r   r   <module>rZ      s   
 , + + + + + < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 * * * * * *I
 I
 I
 I
 I
W$ I
 I
 I
 I
 I
r   