
    Xf/                         d dl Z d dlmZ d dlmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j        e          Z G d dej        j                  ZdS )	    N)List)	constants
exceptions	renderers
interfaces)requirements)utility)pslistc                       e Zd ZdZdZdZedeej	        j
                 fd            Zedej        j        defd            Zd	 Zd
 ZdS )CmdLinez%Lists process command line arguments.   r   r   )   r   r   returnc                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          d
d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/cmdline.pyget_requirementszCmdLine.get_requirements   st     *,()4  
 *fmY   ( W	  
 	
    contextkernel_table_namec                     |                                 }|                    |t          j        z   dz   ||j                  }|j        j                                        }|S )a%  Extracts the cmdline from PEB

        Args:
            context: the context to operate upon
            kernel_table_name: the name for the symbol table containing the kernel's symbols
            proc: the process object

        Returns:
            A string with the command line
        _PEB)
layer_nameoffset)add_process_layerobjectr   BANGPebProcessParametersCommandLine
get_string)r"   r&   r'   procproc_layer_namepebresult_texts          r#   get_cmdlinezCmdLine.get_cmdline)   sc     0022nn	.7&8  
 

 +7BBDDr%   c              #     K   | j         j        | j        d                  }|D ]}t          j        |j                  }d}	 |j        }|                     | j         |j        |          }n# t          j
        $ r}d|j        dd}Y d }~ncd }~wt          j        $ r}d|j        dd}Y d }~n@d }~wt          j        $ r+}d                    ||j        |j                  }Y d }~nd }~ww xY wd|j        ||ffV  d S )	Nr   UnknownzRequired memory at z#xz is inaccessible (swapped)z is not valid (process exited?)zHProcess {}: Required memory at {:#x} is not valid (incomplete layer {}?)r   )r&   modulesconfigr	   array_to_stringImageFileNameUniqueProcessIdr7   symbol_table_namer   SwappedInvalidAddressExceptioninvalid_addressPagedInvalidAddressExceptionInvalidAddressExceptionformatr*   )selfprocsr   r3   process_nameproc_idr6   exps           r#   
_generatorzCmdLine._generatorC   sh     %dk(&;< 	I 	ID"243EFFLG."..L&":D  < g g gfC4Gffff: l l lkC4Gkkkk5   hooS0#. 
 t+\;GHHHHH+	I 	Is0    (A))C)8B		C)B,,C)>!C$$C)c                    | j         j        | j        d                  }t          j                            | j                            dd                     }t          j        dt          fdt          fdt          fg|                     t          j                            | j         |j        |j        |                              S )Nr   r   PIDProcessArgs)r&   r*   symbol_tablefilter_func)r&   r:   r;   r
   r   create_pid_filtergetr   TreeGridr!   strrJ   list_processesr*   r?   )rE   r   rP   s      r#   runzCmdLine.run]   s    %dk(&;<m55dkooeT6R6RSS!S\Is+fc];OO,, L%0!'!9 +	 -   

 

 
	
r%   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer$   r&   ContextInterfacerT   r7   rJ   rV    r%   r#   r   r      s        //"+H
j&>&S!T 
 
 
 [
&  (9NQ   [2I I I4
 
 
 
 
r%   r   )loggingtypingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr	   volatility3.plugins.windowsr
   	getLoggerrW   vollogpluginsPluginInterfacer   ra   r%   r#   <module>rl      s           N N N N N N N N N N N N < < < < < < 1 1 1 1 1 1 . . . . . .		8	$	$\
 \
 \
 \
 \
j 0 \
 \
 \
 \
 \
r%   