X f^/ddlZddlZddlmZmZmZmZddlmZm Z m Z m Z m Z ddl mZddlmZddlmZddlmZddlmZdd lmZejeZGd d e jjejZdS) N)CallableIterableListType) renderers interfaceslayers exceptions constants) requirements)utility) format_hints)intermed)pe) timelinerc eZdZdZdZdZdZedZede j j de de de j jd ee jjd e jjf d Ze dd eeded ee j jgeffdZe ddee ded ee j jgeffdZedfde j j de de dee j jgefd ee j jf dZdZdZdZd S)PsListzALists the processes present in a particular windows memory image.)rrFc tjddddgtjdd|jd tjd t d d tjd ddd gS)NkernelzWindows kernelIntel32Intel64)name description architecturesphysicalz+Display physical offsets instead of virtualT)rrdefaultoptionalpidz8Process ID to include (all other processes are excluded))r element_typerrdumpzExtract listed processesF)r ModuleRequirementBooleanRequirementPHYSICAL_DEFAULTListRequirementint)clss ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/pslist.pyget_requirementszPsList.get_requirementss  *,()4     +I,      ( V      +6    %  contextkernel_table_name pe_table_nameproc open_methodreturnc d}d} |j}|}||tjzdz||j} ||tjzdz| j|} |jd|jj j d } || |jd | d | jd d }| D]/\} } | | || 0n7#t$r*}t d |d|Yd}~nd}~wwxYw|S)abExtracts the complete data for a process as a FileHandlerInterface Args: context: the context to operate upon kernel_table_name: the name for the symbol table containing the kernel's symbols pe_table_name: the name for the symbol table containing the PE format symbols proc: the process object whose memory should be output open_method: class to provide context manager for opening the file Returns: An open FileHandlerInterface object containing the complete data for the process or None in the case of failure NzInvalid process object_PEB layer_nameoffset_IMAGE_DOS_HEADER)r5r4stringreplace max_lengtherrors.z#xz.dmpzUnable to dump PE with pid z: )UniqueProcessIdadd_process_layerobjectr BANGPebImageBaseAddress ImageFileNamecastvolcountsanitize_filename reconstructseekwrite Exceptionvollogdebug)r'r+r,r-r.r/ file_handleproc_idproc_layer_namepeb dos_header process_namer5dataexcps r( process_dumpzPsList.process_dump7s, * J*G"4466O..!IN2V;*x!C ! .1DD+*(J  -22-17 3L &+--+ZZlZZS=QZZZZK !+ 6 6 8 8 ( (   (((!!$'''' ( J J J LLHwHH$HH I I I I I I I I JsDD E( E  ENpid_listexcludecLd}|pg}d|Dr |rfd}nfd}|S)awA factory for producing filter functions that filter based on a list of process IDs. Args: pid_list: A list of process IDs that are acceptable, all other processes will be filtered out exclude: Accept only tasks that are not in pid_list Returns: Filter function for passing to the `list_processes` method cdSNF_s r(z*PsList.create_pid_filter..r*cg|]}||SNr\.0xs r( z,PsList.create_pid_filter..s<<.s(9[(Hr*c|jvSrbrhris r(r_z*PsList.create_pid_filter..s(9(Lr*r\)r'rWrX filter_funcrjs @r(create_pid_filterzPsList.create_pid_filterrs^&o >r<<(<<<  M MHHHH LLLL r* name_listcLd}|pg}d|Dr |rfd}nfd}|S)a|A factory for producing filter functions that filter based on a list of process names. Args: name_list: A list of process names that are acceptable, all other processes will be filtered out exclude: Accept only tasks that are not in name_list Returns: Filter function for passing to the `list_processes` method cdSr[r\r]s r(r_z+PsList.create_name_filter..r`r*cg|]}||Srbr\rcs r(rfz-PsList.create_name_filter..s===Qq}q}}}r*c:tj|jvSrbr array_to_stringrCris r(r_z+PsList.create_name_filter..sg5aoFF+Ur*c:tj|jvSrbrsris r(r_z+PsList.create_name_filter..sg5aoFF&'r*r\)r'rnrXrlrjs @r(create_name_filterzPsList.create_name_filtersl&o O ==)===   UUUU ''''r*cdSr[r\r]s r(r_zPsList.ser*r4 symbol_tablerlc#K|j|jd}||||}|dj}|d|}|dd} |d|jj | z d } | j D]} || s| Vd S) a[Lists all the processes in the primary layer that are in the pid config option. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_func: A function which takes an EPROCESS object and returns True if the process should be ignored/filtered Returns: The list of EPROCESS objects from the `layer_name` layer's PsActiveProcessHead list after filtering kernel_virtual_offsetr3PsActiveProcessHead _LIST_ENTRY) object_typer5 _EPROCESSActiveProcessLinksT)r}r5absoluteN) r configmodule get_symboladdressr?get_typerelative_child_offsetrEr5r) r'r+r4rxrlkvontkrnlmp ps_aph_offset list_entryreloffeprocr.s r(list_processeszPsList.list_processess0nZ(/0GH>>,:c>RR ++,ABBJ __}_UU "";//EE   #>(61    ,  D;t$$    r*c #pK|jj|jd}tj|j|jddtj}|jj |j }t|tj j std||j|j |j||jddD]}|jd|js |jj}n:t-||jjd d \}}}}}d } |jd rT||j|j|||j}d }|r(|t7|j}d |j|j|j d|jjj!dtEj#||j$|%|&|'|(|)|f fV#tTj+$r-tX-d|jjddYwxYwdS)Nrwindowsr) class_typesz#Primary layer is not an intel layerr)rlrr)r5lengthDisabledr!zError outputting filer7r8r9z"Invalid process found at address: rez . Skipping).r+modulesrrIntermediateSymbolTablecreate config_pathrrr r4 isinstanceintelIntel TypeErrorrsymbol_table_namermgetr$rEr5listmappingrVopenclosestrpreferred_filenamer=InheritedFromUniqueProcessIdrCrDrFrHex ActiveThreadsget_handle_countget_session_id get_is_wow64get_create_time get_exit_timer InvalidAddressExceptionrLinfo) selfrr-memoryr.r5r^ file_outputrNs r( _generatorzPsList._generators%dk(&;< 8?? L$*It@  $V%67&&,"455 CABB B'' L    $..t{ud/K/KLL (  5 5 D ;??:t/DEE '+NN$(/!NDD((($Avq!%K& ;v& J"&"3"3 0% ##K#:K"J#))+++&)+*H&I&I ,9*//$'+'9'='C#,0 %(00*--//++--))++,,..**,,#*5    VVVVV e5 5 sDI778J32J3c#K|D]]}|\}}d|dd|dd|dd}|tjj|dfV|tjj|d fV^dS) Nz Process: r rz () )rr TimeLinerTypeCREATEDMODIFIED)rrow_depthrow_datars r(generate_timelinezPsList.generate_timeline s??$$ O OC" FHQhqkQQHQKQQ8A;QQQK 7 ?!M M M M 7 @(1+N N N N N  O Or*cl|jd|jsdnd}tjdt fdt fdt fd|tjfdt fd t fd t fd tfd tj fd tj fdt fg | S)Nrz(V)z(P)PIDPPIDrCOffsetThreadsHandles SessionIdWow64 CreateTimeExitTimez File output) rrr$rTreeGridr&rrrbooldatetimer)r offsettypes r(runz PsList.run'sT5JKK VEEQV !   #&&*&& (89C C c"$x01X./$  OO     r*r[)__name__ __module__ __qualname____doc___required_framework_version_versionr$ classmethodr)rr+ContextInterfacerobjectsObjectInterfacerpluginsFileHandlerInterfacerVrr&rrrmrvrrrrrr\r*r(rrs"KK"+H  [ 68#488 8  0 8 *,AB 8   0888[8t9>Cy26 :%56< =[0:?S 37 :%56< =[8 O33#433 3    / 0$ 6 3 *$4 5333[3j@@@DOOO     r*r) rloggingtypingrrrrvolatility3.frameworkrrr r r #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersrvolatility3.framework.symbolsr0volatility3.framework.symbols.windows.extensionsrvolatility3.pluginsr getLoggerrrLrPluginInterfaceTimeLinerInterfacerr\r*r(rs. 111111111111VVVVVVVVVVVVVV<<<<<<111111888888222222??????))))))  8 $ $g g g g g Z  /1Mg g g g g r*