[ #gP3ddlZddlZddlmZmZmZmZddlmZm Z m Z m Z m Z ddl mZddlmZddlmZddlmZddlmZdd lmZej2eZGd d e j8j:ej<Zy) N)CallableIterableListType) renderers interfaceslayers exceptions constants) requirements)utility) format_hints)intermed)pe) timelinerc eZdZdZdZdZdZedZede jjde de de jjd ee j j"d e j j"f d Ze dd eeded ee jjgeffdZed ee jjgeffdZe ddee ded ee jjgeffdZedfde jjde de dee jjgefd ee jjf dZdZdZdZy )PsListzALists the processes present in a particular windows memory image.)rrFc tjddddgtjdd|jd tjd t d d tjd ddd gS)NkernelzWindows kernelIntel32Intel64)name description architecturesphysicalz+Display physical offsets instead of virtualT)rrdefaultoptionalpidz8Process ID to include (all other processes are excluded))r element_typerrdumpzExtract listed processesF)r ModuleRequirementBooleanRequirementPHYSICAL_DEFAULTListRequirementintclss ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/pslist.pyget_requirementszPsList.get_requirementss  * *,()4   + +I,,    ( ( V    + +6  %  contextkernel_table_name pe_table_nameproc open_methodreturnc d}d} |j}|j}|j|tjzdz||j } |j|tjzdz| j |} |jjd|jjjd } ||j|jd | d | j d d }| jD]'\} } |j| |j| ) |S#t$r&}t j#d |d|Yd}~|Sd}~wwxYw)abExtracts the complete data for a process as a FileHandlerInterface Args: context: the context to operate upon kernel_table_name: the name for the symbol table containing the kernel's symbols pe_table_name: the name for the symbol table containing the PE format symbols proc: the process object whose memory should be output open_method: class to provide context manager for opening the file Returns: An open FileHandlerInterface object containing the complete data for the process or None in the case of failure NzInvalid process object_PEB layer_nameoffset_IMAGE_DOS_HEADER)r6r5stringreplace max_lengtherrors.z#xz.dmpzUnable to dump PE with pid z: )UniqueProcessIdadd_process_layerobjectr BANGPebImageBaseAddress ImageFileNamecastvolcountsanitize_filename reconstructseekwrite Exceptionvollogdebug)r(r,r-r.r/r0 file_handleproc_idproc_layer_namepeb dos_header process_namer6dataexcps r) process_dumpzPsList.process_dump7s|, * J**G"446O..!INN2V;*xx!C ! .1DD++*(J  --22--1177 3L &--++,Al^1S=Q=QRTz*PsList.create_pid_filter..r+c |jvSNr>x filter_lists r)r`z*PsList.create_pid_filter..s(9(9[(Hr+c |jvSrcrdres r)r`z*PsList.create_pid_filter..s(9(9(Lr+r])r(rXrY filter_funcrfrgs @r)create_pid_filterzPsList.create_pid_filterrsM& >r"*InheritedFromUniqueProcessIdExitTimeQuadPartget_handle_countrUnreadableValue)rfs r)r`z5PsList.create_active_process_filter..s JJL D!# D!!Q& D..!3 D ##q(  D ""$ (A(A(CC  r+r]r's r)create_active_process_filterz#PsList.create_active_process_filters   r+ name_listcjd}|xsg}|Dcgc]}|| c}r|rfd}|Sfd}|Scc}w)a|A factory for producing filter functions that filter based on a list of process names. Args: name_list: A list of process names that are acceptable, all other processes will be filtered out exclude: Accept only tasks that are not in name_list Returns: Filter function for passing to the `list_processes` method cyr\r]r^s r)r`z+PsList.create_name_filter..rar+cFtj|jvSrcr array_to_stringrDres r)r`z+PsList.create_name_filter..sg55aooF+Ur+cFtj|jvSrcr{res r)r`z+PsList.create_name_filter..sg55aooF&'r+r])r(rwrYrirfrgs @r)create_name_filterzPsList.create_name_filtersT& O "+=Qq}q= U'>rkcyr\r]r^s r)r`zPsList.ser+r5 symbol_tableric#K|j|jd}|j|||}|jdj}|j d|}|j djd} |j d|jj| z d } | jD]} || r | y w) a[Lists all the processes in the primary layer that are in the pid config option. Args: context: The context to retrieve required elements (layers, symbol tables) from layer_name: The name of the layer on which to operate symbol_table: The name of the table containing the kernel symbols filter_func: A function which takes an EPROCESS object and returns True if the process should be ignored/filtered Returns: The list of EPROCESS objects from the `layer_name` layer's PsActiveProcessHead list after filtering kernel_virtual_offsetr4PsActiveProcessHead _LIST_ENTRY) object_typer6 _EPROCESSActiveProcessLinksT)rr6absoluteN) r configmodule get_symboladdressr@get_typerelative_child_offsetrFr6r) r(r,r5rrikvontkrnlmp ps_aph_offset list_entryreloffeprocr/s r)list_processeszPsList.list_processess0nnZ(//0GH>>,:c>R ++,ABJJ __}_U "";/EE  #>>((61   ,,Dt$ -s CC C c #*K|jj|jd}tjj |j|j ddtj}|jj|j}t|tjjs td|j|j|j|j |j#|jj%ddD]}|jj%d|j&s|j(j*}n9t-|j/|j(j*d d \}}}}}d } |jd r\|j1|j|j |||j2}d }|r%|j5t7|j8}d |j:|j<|j>jAd|j>j(jBdtEjF||jH|jK|jM|jO|jQ|jS|f fy#tTjV$r2tXj[d|j(j*ddYwxYww)Nrwindowsr) class_typesz#Primary layer is not an intel layerr)rirr)r6lengthDisabledr!zError outputting filer8r9r:z"Invalid process found at address: rfz . Skipping).r,modulesrrIntermediateSymbolTablecreate config_pathrrr r5 isinstanceintelIntel TypeErrorrsymbol_table_namerjgetr$rFr6listmappingrWopenclosestrpreferred_filenamer>rqrDrErGrHexrprtget_session_id get_is_wow64get_create_time get_exit_timer InvalidAddressExceptionrMinfo) selfrr.memoryr/r6r_ file_outputrOs r) _generatorzPsList._generators%%dkk(&;< 88?? LL$**It@ $$V%6%67&&,,"4"45AB B'' LL     $ $..t{{ud/KL ( D ;;??:t/D/DE'+NN$((//!ND(($Avq!%K& ;;v&"&"3"3 00% #K#:K"#))+&)+*H*H&I ,,99**//$'+'9'9'='='C'C#,0 %((0**--/++-))+,,.**,#; d55  88K:V s,FLD-K L AL LLLc#K|jD]`}|\}}d|dd|dd|dd}|tjj|df|tjj|d fbyw) Nz Process: r rz () )rr TimeLinerTypeCREATEDMODIFIED)rrow_depthrow_datars r)generate_timelinezPsList.generate_timeline7s??$C" FH%hqk]!HQK=8A;-qQK 7 7 ? ?!M M 7 7 @ @(1+N N %sA5A7cz|jjd|jsdnd}tjdt fdt fdt fd|tjfdt fd t fd t fd tfd tjfd tjfdt fg |jS)Nrz(V)z(P)PIDPPIDrDOffsetThreadsHandles SessionIdWow64 CreateTimerrz File output) rrr$rTreeGridr&rrrbooldatetimer)r offsettypes r)runz PsList.run>sT5J5JKEQV !!   #&*& (8(89C C c"$x001X../$  OO   r+r\)__name__ __module__ __qualname____doc___required_framework_version_versionr$ classmethodr*rr,ContextInterfacerobjectsObjectInterfacerpluginsFileHandlerInterfacerWrr&rrrjrvr~rrrrrr]r+r)rrsK"+H  68##4488 8   00 8 *,,AAB 8    0 088t9>Cy26 :%%556< =0 :%%556< =  ,:?S 37 :%%556< =8 3##4433 3     / / 0$ 6 3 *$$44 533j@DO r+r) rloggingtypingrrrrvolatility3.frameworkrrr r r #volatility3.framework.configurationr volatility3.framework.objectsr volatility3.framework.renderersrvolatility3.framework.symbolsr0volatility3.framework.symbols.windows.extensionsrvolatility3.pluginsr getLoggerrrMrPluginInterfaceTimeLinerInterfacerr]r+r)rs_ 11VV<182?)   8 $~ Z   / /1M1M~ r+