
    Xf#                         d dl Z d dlZd dlmZ d dlmZmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ  ej$                  e      Z G d d	ej*                  j,                        Zy)
    N)List)	constants
exceptions
interfacesobjects	renderers)requirements)registry)pslist)hivelistc                   z    e Zd ZdZdZdZedeej                  j                     fd       Zdee   fdZd Zd Zy	)
Envarsz%Display process environment variables   r   r      r   r   returnc           	      2   t        j                  ddddg      t        j                  ddt        d	      t        j                  d
dd      t        j
                  dt        j                  d      t        j
                  dt        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r   r   element_typeoptionalsilentz,Suppress common and non-persistent variables)r   r   r   r   r   )r   pluginversionr   r   )
r	   ModuleRequirementListRequirementintBooleanRequirementPluginRequirementr   PsListr   HiveList)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/envars.pyget_requirementszEnvars.get_requirements   s     **,()4
 ((< 	 ++J
 **fmmY **(9(99)
 	
    c                    g }| j                   j                  | j                  d      }t        j                  j                  | j                   | j                  |j                  |j                  d      D ]X  }d}d}	 |j                  d      }d}|r\t        j                  t              5  j                         D ]&  }	 |j                         }|r|j                  |       ( 	 ddd       t        j                  t              5  |j                  d	      }d}ddd       |r\t        j                  t              5  j                         D ]&  }	 |j                         }|r|j                  |       ( 	 ddd       	 |j                  d      }	 |j                         D ]&  }	 |j                         }|r|j                  |       ( [ |j1                  g d       |S # t        $ rF t        j                  t              5  |j                  d      }d}ddd       n# 1 sw Y   nxY wY w xY w# t         j"                  t$        j&                  f$ r/}	t(        j+                  t,        j.                  d       Y d}	~	d}	~	ww xY w# 1 sw Y   xY w# 1 sw Y   xY w# t         j"                  t$        j&                  f$ r/}	t(        j+                  t,        j.                  d
       Y d}	~	d}	~	ww xY w# 1 sw Y   xY w# t        $ r Y w xY w# t         j"                  t$        j&                  f$ r/}	t(        j+                  t,        j.                  d       Y d}	~	d}	~	ww xY w# t        $ r Y w xY w)aM  Enumerate persistent & common variables.

        This function collects the global (all users) and
        user-specific environment variables from the
        registry. Any variables in a process env block that
        does not exist in the persistent list was explicitly
        set with the SetEnvironmentVariable() API.
        r   N)contextbase_config_path
layer_namesymbol_tablehive_offsetsFz5CurrentControlSet\Control\Session Manager\EnvironmentTz1ControlSet001\Control\Session Manager\EnvironmentzSError while parsing global environment variables keys (some keys might be excluded)EnvironmentzQError while parsing user environment variables keys (some keys might be excluded)zVolatile EnvironmentzUError while parsing volatile environment variables keys (some keys might be excluded))/ProgramFilesCommonProgramFilesSystemDrive
SystemRootProgramDataPUBLICALLUSERSPROFILECOMPUTERNAMESESSIONNAMEUSERNAMEUSERPROFILEPROMPT
USERDOMAINAppDataCommonFilesCommonDesktopCommonProgramGroupsCommonStartMenuCommonStartUpCookiesDesktopDirectory	FavoritesHistoryNetHoodPersonalDocuments
RecycleBin	StartMenu	Templates
AltStartupCommonFavoritesConnectionWizardDocAndSettingRootInternetCachewindirPath	HOMEDRIVEPROCESSOR_ARCHITECTURENUMBER_OF_PROCESSORSzProgramFiles(x86)zCommonProgramFiles(x86)CommonProgramW6432PSModulePathPROCESSOR_IDENTIFIERFP_NO_HOST_CHECKLOCALAPPDATATMPProgramW6432)r-   modulesconfigr   r'   
list_hivesconfig_pathr/   symbol_table_nameget_keyKeyError
contextlibsuppress
get_valuesget_nameappendr   InvalidAddressExceptionr
   RegistryFormatExceptionvolloglogr   LOGLEVEL_VVVextend)
selfvaluesr   hivesysntuserkeynodevalue_node_nameexcps
             r)   _get_silent_varszEnvars._get_silent_vars2   s:    %%dkk(&;<%%00LL!--((11 1 
 Q	D CF
llN  ((2 % # 0 %%.2mmoO. &o >	%%" $$X. ll=1 ((2 % # 0 %%.2mmoO. &o >	%%"ll#9:NN, !D!*.--/*"MM/:	!EQ	j 	02	
h s  ((2 ,,NC C	   '>>$<<  % #JJ ) 6 6 u %%% %"  '>>$<<  % #JJ ) 6 6 s %%% %&   #:: 88 ! 

%22s !!  s   >G&,J#H8$JJ?K<#J'7K<L	M.)#LM.&"H5H%	H5%H.*H54H58#J
	$J	?JJ
	
JJ	J$	'#K9	
$K4	.K<4K9	9K<<L			LL#M+<$M& M.&M++M..	M;:M;c           
   #   &  K   g }| j                   j                  dd       r| j                         }|D ]  }|j                         D ]  \  }}| j                   j                  dd       r||v r'dt	        |j
                        t        t        j                  j                  |j                              t        |j                         j                  j                  j                  j                         t        |      t        |      ff   y w)NSILENTr   r   )ra   getr{   environment_variablesr#   UniqueProcessIdstrr   utilityarray_to_stringImageFileNamehexget_pebProcessParametersr2   voloffset)rr   datasilent_varstaskvarvals         r)   
_generatorzEnvars._generator   s     ;;??8T*//1K 	D 668 S;;??8T2k) D001GOO;;D<N<NOPDLLN<<HHLLSSTCC	 			s   DDc                    t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }t        j                  dt        fdt        fdt        fdt        fdt        fg| j                  t         j                  j                  | j
                  |j                  |j                  |                  S )	Nr   r   PIDProcessBlockVariableValue)r-   r/   r0   filter_func)r   r&   create_pid_filterra   r~   r-   r`   r   TreeGridr#   r   r   list_processesr/   rd   )rr   r   r   s      r)   runz
Envars.run   s    mm55dkkooeT6RS%%dkk(&;<!!C #S!# OO,, LL%00!'!9!9 +	 - 
 	
r+   N)__name__
__module____qualname____doc___version_required_framework_versionclassmethodr   r   configurationRequirementInterfacer*   r   r{   r   r    r+   r)   r   r      sW    +H"+
j&>&>&S&S!T 
 
6V$s) Vp*
r+   r   )rg   loggingtypingr   volatility3.frameworkr   r   r   r   r   #volatility3.framework.configurationr	   volatility3.framework.layersr
   volatility3.plugins.windowsr   $volatility3.plugins.windows.registryr   	getLoggerr   rn   pluginsPluginInterfacer   r   r+   r)   <module>r      sN       W W < 1 . 9			8	$c
Z// c
r+   