
    Xf                         d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	m
Z
 d dlmZ d dlmZ  ej                  e      Z G d dej$                  j&                        Zy)    N)List)	renderers
interfacesobjects
exceptions	constants)requirements)pslistc                   z     e Zd ZdZdZdZ fdZedee	j                  j                     fd       Zd Zd Z xZS )	PrivszLists process token privileges)      r   r   r   r   c                 *   t        |   |i | t        j                  D ]a  }t        j
                  j                  |t        j
                  j                  dd            }t        j
                  j                  |      sa n0 t        j                  t        j                  d       t        d      t        |d      5 }t        j                  |      d   }|D ci c]  }t        |      ||    c}| _        d d d        y c c}w # 1 sw Y   y xY w)Nwindowszsids_and_privileges.jsonz5sids_and_privileges.json file is missing plugin errorzBThe sids_and_privileges.json file missed from you plugin directoryr
privileges)super__init__r   PLUGINS_PATHospathjoinexistsvolloglogLOGLEVEL_VVVRuntimeErroropenjsonloadintprivilege_info)	selfargskwargs
plugin_dirsids_json_file_namefile_handle	temp_jsonpriv_num	__class__s	           b/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/privileges.pyr   zPrivs.__init__   s    $)&) $00 	J"$'',,BGGLL4NO# ww~~12	 JJ&&G T 
 %s+ 	{		+.|<ICL#7?Hy22#D	 	#	 	s    D	D3D	D		Dreturnc                     t        j                  ddddg      t        j                  ddt        d	      t        j                  d
t
        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r3   r4   element_typeoptionalr
   r   )r3   pluginversion)r	   ModuleRequirementListRequirementr"   PluginRequirementr
   PsList)clss    r-   get_requirementszPrivs.get_requirements0   sa     **,()4
 ((< 	 **fmmY
 	
    c              #   d  K   |D ]h  }	 |j                   j                         j                  d      }|j                         D ]'  \  }}}}| j                  j                  t        |            s)t
        j                  t        j                  d| d       V| j                  j                  t        |            \  }}	g }
|r|
j                  d       |r|
j                  d       |r|
j                  d       dt        |j                        t        j                   j#                  |j$                        t        |      t'        |      d	j)                  |
      t'        |	      gf * k y # t        j                  $ r( t
        j                  t        j                  d       Y w xY ww)
N_TOKENzSkip invalid token.zSkip invalid privilege (z).PresentEnabledDefaultr   ,)Tokendereferencecastr   InvalidAddressExceptionr   r   r   r   r   r#   getr"   appendUniqueProcessIdr   utilityarray_to_stringImageFileNamestrr   )r$   procstaskprocess_tokenvaluepresentenableddefaultr3   desc
attributess              r-   
_generatorzPrivs._generatorD   s}     %	D $

 6 6 8 = =h G
 5B4L4L4N 0w **..s5z:JJ!..2J5'QS0T !0044SZ@
d  
%%i0%%i0%%i0 D001778J8JKE
D	,D	
 
)%	 55 

9113HIs(   F0)E2D?F027F-)F0,F--F0c                    t         j                  j                  | j                  j	                  dd             }| j
                  j                  | j                  d      }t        j                  dt        fdt        fdt        fdt        fdt        fdt        fg| j                  t         j                  j                  | j
                  |j                  |j                  |	                  S )
Nr6   r0   PIDProcessValue	Privilege
AttributesDescription)context
layer_namesymbol_tablefilter_func)r
   r>   create_pid_filterconfigrL   rd   modulesr   TreeGridr"   rR   r\   list_processesre   symbol_table_name)r$   rg   r0   s      r-   runz	Privs.runl   s    mm55dkkooeT6RS%%dkk(&;<!!C #c"s#$ OO,, LL%00!'!9!9 +	 - 
 	
rA   )__name__
__module____qualname____doc___version_required_framework_versionr   classmethodr   r   configurationRequirementInterfacer@   r\   rn   __classcell__)r,   s   @r-   r   r      sM    (H"+4 
j&>&>&S&S!T 
 
&&P
rA   r   )r    loggingr   typingr   volatility3.frameworkr   r   r   r   r   #volatility3.framework.configurationr	   volatility3.plugins.windowsr
   	getLoggerro   r   pluginsPluginInterfacer    rA   r-   <module>r      sK      	  W W < .			8	$q
J.. q
rA   