
    Xf/                         d dl Z d dlmZ d dlmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZ  e j                  e      Z G d dej"                  j$                        Zy)	    N)List)	constants
exceptions	renderers
interfaces)requirements)utility)pslistc                       e Zd ZdZdZdZedeej                  j                     fd       Zedej                  j                  defd       Zd	 Zd
 Zy)CmdLinez%Lists process command line arguments.   r   r   )   r   r   returnc                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        d
d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr
   PsListListRequirementint)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/cmdline.pyget_requirementszCmdLine.get_requirements   sa     **,()4
 **fmmY (( W	
 	
    contextkernel_table_namec                     |j                         }|j                  |t        j                  z   dz   ||j                        }|j
                  j                  j                         }|S )a%  Extracts the cmdline from PEB

        Args:
            context: the context to operate upon
            kernel_table_name: the name for the symbol table containing the kernel's symbols
            proc: the process object

        Returns:
            A string with the command line
        _PEB)
layer_nameoffset)add_process_layerobjectr   BANGPebProcessParametersCommandLine
get_string)r"   r&   r'   procproc_layer_namepebresult_texts          r#   get_cmdlinezCmdLine.get_cmdline)   sb     002nn	.7&88  

 ++77BBDr%   c              #   t  K   | j                   j                  | j                  d      }|D ]j  }t        j                  |j
                        }d}	 |j                  }| j                  | j                   |j                  |      }d|j                  ||ff l y # t        j                  $ r}d|j                  dd}Y d }~?d }~wt        j                  $ r}d|j                  dd}Y d }~kd }~wt        j                  $ r1}dj                  ||j                  |j                        }Y d }~d }~ww xY ww)	Nr   UnknownzRequired memory at z#xz is inaccessible (swapped)z is not valid (process exited?)zHProcess {}: Required memory at {:#x} is not valid (incomplete layer {}?)r   )r&   modulesconfigr	   array_to_stringImageFileNameUniqueProcessIdr7   symbol_table_namer   SwappedInvalidAddressExceptioninvalid_addressPagedInvalidAddressExceptionInvalidAddressExceptionformatr*   )selfprocsr   r3   process_nameproc_idr6   exps           r#   
_generatorzCmdLine._generatorC   s"    %%dkk(&;< 	ID"2243E3EFLG.."..LL&":":D t++\;GHH+	I << g 3C4G4G3KKef:: l 3C4G4G3KKjk55 hooS00#..sT   AD83BD8D5,C=D8D5C.)D8.D5'D0+D80D55D8c                    | j                   j                  | j                  d      }t        j                  j                  | j                  j                  dd             }t        j                  dt        fdt        fdt        fg| j                  t        j                  j                  | j                   |j                  |j                  |                  S )Nr   r   PIDProcessArgs)r&   r*   symbol_tablefilter_func)r&   r:   r;   r
   r   create_pid_filtergetr   TreeGridr!   strrJ   list_processesr*   r?   )rE   r   rP   s      r#   runzCmdLine.run]   s    %%dkk(&;<mm55dkkooeT6RS!!S\Is+fc];OO,, LL%00!'!9!9 +	 - 

 
	
r%   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer$   r&   ContextInterfacerT   r7   rJ   rV    r%   r#   r   r      su    /"+H
j&>&>&S&S!T 
 
&  ((99NQ 2I4
r%   r   )loggingtypingr   volatility3.frameworkr   r   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr	   volatility3.plugins.windowsr
   	getLoggerrW   vollogpluginsPluginInterfacer   ra   r%   r#   <module>rl      sH      N N < 1 .			8	$\
j  00 \
r%   