
    Xf                         d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	m
Z
 d dlmZ d dlmZ  ej        e          Z G d dej        j                  ZdS )    N)List)	renderers
interfacesobjects
exceptions	constants)requirements)pslistc                   r     e Zd ZdZdZdZ fdZedee	j
        j                 fd            Zd Zd Z xZS )	PrivszLists process token privileges)      r   r   r   r   c                 ,    t                      j        |i | t          j        D ]a}t          j                            |t          j                            dd                    }t          j                            |          r n5bt          	                    t          j
        d           t          d          t          |d          5 }t          j        |          d         fdD             | _        d d d            d S # 1 swxY w Y   d S )Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryr
privilegesc                 <    i | ]}t          |          |         S  )int).0priv_num	temp_jsons     b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/privileges.py
<dictcomp>z"Privs.__init__.<locals>.<dictcomp>,   s3     # # #7?Hy2# # #    )super__init__r   PLUGINS_PATHospathjoinexistsvolloglogLOGLEVEL_VVVRuntimeErroropenjsonloadprivilege_info)selfargskwargs
plugin_dirsids_json_file_namefile_handler   	__class__s         @r   r   zPrivs.__init__   sn   $)&))) $0 	 	J"$',,BGLL4NOO# # w~~122  JJ&G   T  
 %s++ 	{	+..|<I# # # #CL# # #D	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	s   .D		DDreturnc                     t          j        ddddg          t          j        ddt          d	          t          j        d
t
          j        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r8   r9   element_typeoptionalr
   r   )r8   pluginversion)r	   ModuleRequirementListRequirementr   PluginRequirementr
   PsList)clss    r   get_requirementszPrivs.get_requirements0   st     *,()4  
 (< 	   *fmY  
 	
r   c              #     K   |D ]}	 |j                                                             d          }n:# t          j        $ r( t
                              t          j        d           Y gw xY w|	                                D ]D\  }}}}| j
                            t          |                    s*t
                              t          j        d| d           Y| j
                            t          |                    \  }}	g }
|r|
                    d           |r|
                    d           |r|
                    d           dt          |j                  t          j                            |j                  t          |          t'          |          d	                    |
          t'          |	          gfV  Fd S )
N_TOKENzSkip invalid token.zSkip invalid privilege (z).PresentEnabledDefaultr   ,)Tokendereferencecastr   InvalidAddressExceptionr$   r%   r   r&   r   r+   getr   appendUniqueProcessIdr   utilityarray_to_stringImageFileNamestrr"   )r,   procstaskprocess_tokenvaluepresentenableddefaultr8   desc
attributess              r   
_generatorzPrivs._generatorD   s      %	 %	D $
 6 6 8 8 = =h G G5   

913HIII 5B4L4L4N4N  0w *..s5zz:: JJ!.0T50T0T0T   !044SZZ@@
d  
 1%%i000 1%%i000 1%%i000 D011778JKKE

D		,,D		
 
 
 
 
)%	 %	s   ,64A-,A-c                    t           j                            | j                            dd                     }| j        j        | j        d                  }t          j        dt          fdt          fdt          fdt          fdt          fdt          fg|                     t           j                            | j        |j        |j        |	                              S )
Nr;   r5   PIDProcessValue	Privilege
AttributesDescription)context
layer_namesymbol_tablefilter_func)r
   rC   create_pid_filterconfigrP   rh   modulesr   TreeGridr   rV   r`   list_processesri   symbol_table_name)r,   rk   r5   s      r   runz	Privs.runl   s    m55dkooeT6R6RSS%dk(&;<!C #c"s#$ OO,, L%0!'!9 +	 -   
 
 	
r   )__name__
__module____qualname____doc___version_required_framework_versionr   classmethodr   r   configurationRequirementInterfacerE   r`   rr   __classcell__)r2   s   @r   r   r      s        ((H"+    4 
j&>&S!T 
 
 
 [
&& & &P
 
 
 
 
 
 
r   r   )r)   loggingr    typingr   volatility3.frameworkr   r   r   r   r   #volatility3.framework.configurationr	   volatility3.plugins.windowsr
   	getLoggerrs   r$   pluginsPluginInterfacer   r   r   r   <module>r      s      				       W W W W W W W W W W W W W W < < < < < < . . . . . .		8	$	$q
 q
 q
 q
 q
J. q
 q
 q
 q
 q
r   