
    Xf1                     j    d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z	  G d dej                        Zy)	    )	renderers)requirements)plugins)utility)pslistc                   H     e Zd ZdZdZ fdZed        Zd Zd Z	d Z
 xZS )PsTreezLPlugin for listing processes in a tree based on their parent process
    ID.)   r   r   c                 N    t        |   |i | i | _        i | _        i | _        y )N)super__init__
_processes_levels	_children)selfargskwargs	__class__s      Z/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/pstree.pyr   zPsTree.__init__   s*    $)&)    c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   PsList)clss    r   get_requirementszPsTree.get_requirements   sE     **6()4
 **fmmY	
 		
r   c                    t        g       }|j                  |       d}| j                  j                  |d      }||j                  j
                  dk7  r|j                  dk7  r|j                  |vrt        |j                        }| j                  j                  |t        g             }|j                  |j                         || j                  |<   | j                  j                  |d      }|dz  }|7|j                  j
                  dk7  r|j                  dk7  r|j                  |vr|| j                  |<   y)z0Finds how deep the pid is in the processes list.r   N   )setaddr   getvoloffsetp_ppidintr   p_pidr   )r   pidseenlevelprocppid
child_lists          r   _find_levelzPsTree._find_level%   s   2w""3-1$q 4't{{#D++D#b':JNN4::&#-DNN4 ??&&tT2DQJE 1$q 4' "Sr   c              #      K   t         j                  j                   j                  j	                  dt         j                  j
                  d               } | j                   j                  d         D ]  }| j                  |j                  <     j                  D ]  } j                  |         fd j                  D ]%  } j                  |   dk(  s |      E d{    ' y7 w)z$Generates the tree list of processespslist_methodr   r   c              3   *  K   j                   |    }|j                  |j                  t        j                  |j
                        f}j                  |    dz
  |f j                  j                  | g       D ]  } |      E d {     y 7 w)Nr'   )	r   r/   r-   r   array_to_stringp_commr   r   r*   )r0   r3   row	child_pidr   yield_processess       r   r>   z*PsTree._generator.<locals>.yield_processesF   s     ??3'D::t{{G,C,CDKK,PQC<<$q(#..!^^//R8 6	*955565s   BB	B
Br'   N)r   r#   get_list_tasksconfigr*   pslist_methodscontextr   r/   r6   r   )r   
list_tasksr3   r0   r>   s   `   @r   
_generatorzPsTree._generator9   s     ]]11KKOOOV]]-I-I!-LM

 t||T[[-BC 	/D*.DOODJJ'	/ ?? 	"CS!	"	6 << 	0C||C A%*3///	0/s   CC6!C6,C4-C6c                 t    t        j                  dt        fdt        fdt        fg| j	                               S )NPIDPPIDCOMM)r   TreeGridr.   strrD   )r   s    r   runz
PsTree.runR   s4    !!S\FC=63-8$//:K
 	
r   )__name__
__module____qualname____doc___required_framework_versionr   classmethodr%   r6   rD   rK   __classcell__)r   s   @r   r	   r	      s8     #, 

 

"(02
r   r	   N)volatility3.frameworkr   #volatility3.framework.configurationr    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.plugins.macr   PluginInterfacer	    r   r   <module>rZ      s*   
 , < 4 1 *I
W$$ I
r   