
    XfP                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ  e j"                  e      Z G d d	ej(                  j*                        Zy)
    N)IteratorListTuple)
exceptions
interfaces	renderers)requirements)utility)format_hints)pslistc                       e Zd ZdZdZdZedeej                  j                     fd       Zdee   fdZdej                   fdZy)	JobLinksz"Print process job link information   r   r   )   r   r   returnc                     t        j                  ddddg      t        j                  dddd	
      t        j                  dt        j
                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesphysicalz*Display physical offset instead of virtualFT)r   r   defaultoptionalr   r   )r   	componentversion)r	   ModuleRequirementBooleanRequirementVersionRequirementr   PsList)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/joblinks.pyget_requirementszJobLinks.get_requirements   sa     **,()4
 ++H	 ++	
 	
    c              #     K   | j                   j                  | j                  d      }| j                   j                  |j                     }t
        j                  j                  | j                   |j                  |j                        D ]a  }	 | j                  d   s|j                  j                  }n9t        |j                  |j                  j                  d            d   \  }}}}}|j                  j                         }dt        j                   |      t#        j$                  |j&                        |j(                  |j*                  |j-                         |j.                  |j1                         |j2                  |j4                  |j6                  t9        j:                         dff |j<                  j?                  |j                  j@                  d      D ]  }| j                  d   s|j                  j                  }n9t        |j                  |j                  j                  d            d   \  }}}}}dt        j                   |      t#        j$                  |j&                        |j(                  |j*                  |j-                         d|j1                         dddd|jC                         jD                  jF                  jI                         ff  d y # tJ        jL                  $ r Y |w xY ww)	Nr   r   r   )offsetlengthz(Original Process)r   r   Yes)'contextmodulesconfiglayers
layer_namer   r"   list_processessymbol_table_namevolr(   listmappingJobdereferencer   Hexr
   array_to_stringImageFileNameUniqueProcessIdInheritedFromUniqueProcessIdget_session_id	SessionIdget_is_wow64TotalProcessesActiveProcessesTotalTerminatedProcessesr   NotApplicableValueProcessListHeadto_list	type_nameget_pebProcessParametersImagePathName
get_stringr   InvalidAddressException)selfr   memoryprocr(   _jobentrys           r$   
_generatorzJobLinks._generator+   s    %%dkk(&;<$$V%6%67MM00LL&++V-E-E
 <	D9{{:.!XX__F+/dhhooaH,,(Q61a hh**, $((0//0B0BC,,99++-))+**++44!446, $ !0088HH&&
 E  ;;z2!&!1!1/3"NN%))2B2B1NM00,Avq!
 (,,V4#33E4G4GH!11!>>!002!..0!!MMO==KKVVX ?<	v 55 s+   BLIK1-L1LLLLc                 |   | j                   j                  dt        j                  j                        sdnd}t        j                  d| t        j                  fdt        fdt        fdt        fdt        fd	t        fd
t        fdt        fdt        fdt        fdt        fdt        fg| j                               S )Nr   z(V)z(P)OffsetNamePIDPPIDSessJobSessWow64TotalActiveTermJobLinkProcess)r-   getr   r"   PHYSICAL_DEFAULTr   TreeGridr   r7   strintboolrQ   )rK   
offsettypes     r$   runzJobLinks.runm   s     ;;??:v}}/M/MN  	 !!*&(8(89C $#3C C  OO
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer%   r   r   rQ   r   ra   rf    r&   r$   r   r      s_    ,"+H
j&>&>&S&S!T 
 
$@HUO @D
Y'' 
r&   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   	getLoggerrg   vollogpluginsPluginInterfacer   rp   r&   r$   <module>r|      sN   
  ( ( C C < 1 8 .			8	$r
z!!11 r
r&   