
    [
#g,                         d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ  e j                  e      Z G d d	ej"                  j$                        Zy)
    N)
interfaces
exceptions)	renderers)requirements)utility)format_hints)pslistc                   0    e Zd ZdZdZed        Zd Zd Zy)ProcessGhostingzOLists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0)      r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   )r   r   r   )r   	componentversion)r   ModuleRequirementVersionRequirementr	   PsList)clss    g/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/processghosting.pyget_requirementsz ProcessGhosting.get_requirements   sE     **,()4
 ++		
 		
    c           	   #     K   | j                   j                  | j                  d      }|j                  d      j	                  d      st
        j                  d       y |D ]<  }t        j                         }t        j                  |j                        }|j                  j                  j                  dk7  r	 |j                  }|j                  }nd}t%        |t&              r,|dvr(t
        j)                  d| d| d	|j*                          |dk(  s|d
k(  st        j                         }|rBt-        j.                  t         j"                        5  |j0                  j2                  }d d d        d|j*                  |t5        j6                  |      ||ff ? y # t         j"                  $ r d}Y w xY w# 1 sw Y   PxY ww)Nr   	_EPROCESSImageFilePointerzdThis plugin only supports Windows 10 builds when the ImageFilePointer member of _EPROCESS is presentr   )r      zInvalid delete_pending value z found for  r!   )contextmodulesconfigget_type
has_membervollogwarningr   UnreadableValuer   array_to_stringImageFileNamer    voloffsetDeletePendingr   InvalidAddressException
isinstanceintdebugUniqueProcessId
contextlibsuppressFileNameStringr   Hex)selfprocsr   procdelete_pendingprocess_namefile_objectpaths           r   
_generatorzProcessGhosting._generator$   s    %%dkk(&;<{+667IJNNv D&668N"2243E3EFL $$((//14$"&"7"7K%0%>%>N  .#.>3O3N3C;|n\]^b^r^r]st
 a>Q#6 002#,,Z-O-OP ;*33::; ,,$$((5&	 	9  "99 $"#K$ ; ;sI   B9G	<F"A	G	9G	F=.4G	"F:7G	9F::G	=G	G	c                    t         j                  j                         }| j                  j                  | j
                  d      }t        j                  dt        fdt        fdt        j                  fdt        fdt        fg| j                  t         j                  j                  | j                  |j                  |j                  |                  S )Nr   PIDProcessFILE_OBJECTr/   Path)r#   
layer_namesymbol_tablefilter_func)r	   r   create_active_process_filterr#   r$   r%   r   TreeGridr2   strr   r9   rA   list_processesrG   symbol_table_name)r:   rI   r   s      r   runzProcessGhosting.runT   s    mm@@B%%dkk(&;<!!C  0 01 #& OO,, LL%00!'!9!9 +	 - 
 	
r   N)	__name__
__module____qualname____doc___required_framework_versionclassmethodr   rA   rO    r   r   r   r      s(    Y"+
 
.`
r   r   )loggingr5   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   	getLoggerrP   r(   pluginsPluginInterfacer   rV   r   r   <module>r`      sK      8 + < 1 8 .			8	$W
j((88 W
r   