
    XfP                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ  e j        e          Z G d d	ej        j                  ZdS )
    N)IteratorListTuple)
exceptions
interfaces	renderers)requirements)utility)format_hints)pslistc                       e Zd ZdZdZdZedeej	        j
                 fd            Zdee         fdZdej        fdZdS )	JobLinksz"Print process job link information   r   r   )   r   r   returnc                     t          j        ddddg          t          j        dddd	
          t          j        dt          j        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesphysicalz*Display physical offset instead of virtualFT)r   r   defaultoptionalr   r   )r   	componentversion)r	   ModuleRequirementBooleanRequirementVersionRequirementr   PsList)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/joblinks.pyget_requirementszJobLinks.get_requirements   st     *,()4  
 +H	   +	  
 	
    c              #   &  K   | j         j        | j        d                  }| j         j        |j                 }t
          j                            | j         |j        |j                  D ](}	 | j        d         s|j	        j
        }n:t          |                    |j	        j
        d                    d         \  }}}}}|j                                        }dt          j        |          t#          j        |j                  |j        |j        |                                |j        |                                |j        |j        |j        t9          j                    dffV  |j                            |j	        j         d          D ]}| j        d         s|j	        j
        }n:t          |                    |j	        j
        d                    d         \  }}}}}dt          j        |          t#          j        |j                  |j        |j        |                                d|                                dddd|!                                j"        j#        $                                ffV  # tJ          j&        $ r Y &w xY wd S )	Nr   r   r   )offsetlengthz(Original Process)r   r   Yes)'contextmodulesconfiglayers
layer_namer   r"   list_processessymbol_table_namevolr(   listmappingJobdereferencer   Hexr
   array_to_stringImageFileNameUniqueProcessIdInheritedFromUniqueProcessIdget_session_id	SessionIdget_is_wow64TotalProcessesActiveProcessesTotalTerminatedProcessesr   NotApplicableValueProcessListHeadto_list	type_nameget_pebProcessParametersImagePathName
get_stringr   InvalidAddressException)selfr   memoryprocr(   _jobentrys           r$   
_generatorzJobLinks._generator+   s     %dk(&;<$V%67M00L&+V-E
 
 <	 <	D9{:. !X_FF+/dhoaHH, ,,(Q61a h**,, $(00/0BCC,9++--))++*+4!466,   $ !088H&
   E  ;z2 !&!1/3"NN%)2B1NMM0 00,Avq!
 (,V44#3E4GHH!1!>!0022!..00!!MMOO=KVVXX    8 5   w<	 <	s   +HI;;JJc                 |   | j                             dt          j        j                  sdnd}t          j        d| t          j        fdt          fdt          fdt          fdt          fd	t          fd
t          fdt          fdt          fdt          fdt          fdt          fg|                                           S )Nr   z(V)z(P)OffsetNamePIDPPIDSessJobSessWow64TotalActiveTermJobLinkProcess)r-   getr   r"   PHYSICAL_DEFAULTr   TreeGridr   r7   strintboolrQ   )rK   
offsettypes     r$   runzJobLinks.runm   s     ;??:v}/MNNEE 	 !&*&&(89C $#3C C  OO
 
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer%   r   r   rQ   r   ra   rf    r&   r$   r   r      s        ,,"+H
j&>&S!T 
 
 
 [
$@HUO @ @ @ @D
Y' 
 
 
 
 
 
r&   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   	getLoggerrg   vollogpluginsPluginInterfacer   rp   r&   r$   <module>r|      s   
  ( ( ( ( ( ( ( ( ( ( C C C C C C C C C C < < < < < < 1 1 1 1 1 1 8 8 8 8 8 8 . . . . . .		8	$	$r
 r
 r
 r
 r
z!1 r
 r
 r
 r
 r
r&   