
    Xf#                         d dl Z d dlZd dlmZ d dlmZmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ  ej        e          Z G d d	ej        j                  ZdS )
    N)List)	constants
exceptions
interfacesobjects	renderers)requirements)registry)pslist)hivelistc                   z    e Zd ZdZdZdZedeej	        j
                 fd            Zdee         fdZd Zd Zd	S )
Envarsz%Display process environment variables   r   r      r   r   returnc           	         t          j        ddddg          t          j        ddt          d	          t          j        d
dd          t          j        dt          j        d          t          j        dt          j	        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r   r   element_typeoptionalsilentz,Suppress common and non-persistent variables)r   r   r   r   r   )r   pluginversionr   r   )
r	   ModuleRequirementListRequirementintBooleanRequirementPluginRequirementr   PsListr   HiveList)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/envars.pyget_requirementszEnvars.get_requirements   s     *,()4  
 (< 	   +J  
 *fmY   *(99  )
 	
    c                 
   g }| j         j        | j        d                  }t          j                            | j         | j        |j        |j        d          D ]}d}d}	 |	                    d          }d}nX# t          $ rK t          j        t                    5  |	                    d          }d}ddd           n# 1 swxY w Y   Y nw xY w|rt          j        t                    5  |                                D ]{}	 |                                }|r|                    |           /# t           j        t$          j        f$ r/}	t(                              t,          j        d           Y d}	~	td}	~	ww xY w	 ddd           n# 1 swxY w Y   t          j        t                    5  |	                    d	          }d}ddd           n# 1 swxY w Y   |rt          j        t                    5  |                                D ]{}	 |                                }|r|                    |           /# t           j        t$          j        f$ r/}	t(                              t,          j        d
           Y d}	~	td}	~	ww xY w	 ddd           n# 1 swxY w Y   	 |	                    d          }n# t          $ r Y lw xY w	 |                                D ]{}	 |                                }|r|                    |           /# t           j        t$          j        f$ r/}	t(                              t,          j        d           Y d}	~	td}	~	ww xY w# t          $ r Y w xY w|                    g d           |S )aM  Enumerate persistent & common variables.

        This function collects the global (all users) and
        user-specific environment variables from the
        registry. Any variables in a process env block that
        does not exist in the persistent list was explicitly
        set with the SetEnvironmentVariable() API.
        r   N)contextbase_config_path
layer_namesymbol_tablehive_offsetsFz5CurrentControlSet\Control\Session Manager\EnvironmentTz1ControlSet001\Control\Session Manager\EnvironmentzSError while parsing global environment variables keys (some keys might be excluded)EnvironmentzQError while parsing user environment variables keys (some keys might be excluded)zVolatile EnvironmentzUError while parsing volatile environment variables keys (some keys might be excluded))/ProgramFilesCommonProgramFilesSystemDrive
SystemRootProgramDataPUBLICALLUSERSPROFILECOMPUTERNAMESESSIONNAMEUSERNAMEUSERPROFILEPROMPT
USERDOMAINAppDataCommonFilesCommonDesktopCommonProgramGroupsCommonStartMenuCommonStartUpCookiesDesktopDirectory	FavoritesHistoryNetHoodPersonalDocuments
RecycleBin	StartMenu	Templates
AltStartupCommonFavoritesConnectionWizardDocAndSettingRootInternetCachewindirPath	HOMEDRIVEPROCESSOR_ARCHITECTURENUMBER_OF_PROCESSORSzProgramFiles(x86)zCommonProgramFiles(x86)CommonProgramW6432PSModulePathPROCESSOR_IDENTIFIERFP_NO_HOST_CHECKLOCALAPPDATATMPProgramW6432)r-   modulesconfigr   r'   
list_hivesconfig_pathr/   symbol_table_nameget_keyKeyError
contextlibsuppress
get_valuesget_nameappendr   InvalidAddressExceptionr
   RegistryFormatExceptionvolloglogr   LOGLEVEL_VVVextend)
selfvaluesr   hivesysntuserkeynodevalue_node_nameexcps
             r)   _get_silent_varszEnvars._get_silent_vars2   s    %dk(&;<%00L!-(1 1 
 
 Q	 Q	D CF
llN     (22  ,,N C C	                %(22 % % # 0 0 % %%.2mmooO. ? &o > > >&>$<  % % % #JJ ) 6 u   %HHHH%%% % % % % % % % % % % % % % %" $X..  ll=11                %(22 % % # 0 0 % %%.2mmooO. ? &o > > >&>$<  % % % #JJ ) 6 s   %HHHH%%% % % % % % % % % % % % % % %"ll#9::   NN,, ! !D!*.--//* ;"MM/:::": 8 ! ! ! 

%2s   !!!    
 	0 0 02	
 2	
 2	
h s   A88#CB?3C?CCCCC+F	+D/.F	/E9	
%E4	/F	4E9	9F		F	F	-GG	G	7J+H;:J;J	%J 	;J J	JJ	J	!J77
KK	M +LMM'%MMMM
M)(M)c           
   #     K   g }| j                             dd           r|                                 }|D ]}|                                D ]\  }}| j                             dd           r||v r%dt	          |j                  t          t          j        	                    |j
                            t          |                                j        j        j        j                  t          |          t          |          ffV  d S )NSILENTr   r   )ra   getr{   environment_variablesr#   UniqueProcessIdstrr   utilityarray_to_stringImageFileNamehexget_pebProcessParametersr2   voloffset)rr   datasilent_varstaskvarvals         r)   
_generatorzEnvars._generator   s     ;??8T** 	2//11K 	 	D 6688  S;??8T22 !k)) D011GO;;D<NOOPPDLLNN<HLSTTCC	 	 	 	 			 	r+   c                    t           j                            | j                            dd                     }| j        j        | j        d                  }t          j        dt          fdt          fdt          fdt          fdt          fg|                     t           j                            | j        |j        |j        |                              S )	Nr   r   PIDProcessBlockVariableValue)r-   r/   r0   filter_func)r   r&   create_pid_filterra   r~   r-   r`   r   TreeGridr#   r   r   list_processesr/   rd   )rr   r   r   s      r)   runz
Envars.run   s    m55dkooeT6R6RSS%dk(&;<!C #S!# OO,, L%0!'!9 +	 -   
 
 	
r+   N)__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r   configurationRequirementInterfacer*   r   r{   r   r    r+   r)   r   r      s        ++H"+
j&>&S!T 
 
 
 [
6V$s) V V V Vp  *
 
 
 
 
r+   r   )rg   loggingtypingr   volatility3.frameworkr   r   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.layersr
   volatility3.plugins.windowsr   $volatility3.plugins.windows.registryr   	getLoggerr   rn   pluginsPluginInterfacer   r   r+   r)   <module>r      s               W W W W W W W W W W W W W W < < < < < < 1 1 1 1 1 1 . . . . . . 9 9 9 9 9 9		8	$	$c
 c
 c
 c
 c
Z/ c
 c
 c
 c
 c
r+   