
    *1f2                        d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ  ej        e          Z G d de	j        j        ej                  Z dS )    N)IterableCallableOptionalTuple)	renderers
interfaceslayers
exceptions)requirements)format_hints)intermed)pe)	timeliner)info)poolscanner)pslistc                      e Zd ZdZdZdZed             Zed             Ze	 	 	 dd	e	j
        j        d
ededededee	j        j        gef         fd            Zed fd	e	j
        j        d
ededee	j        j        gef         dee	j        j                 f
d            Zed	e	j
        j        d
edede	j        j        dee	j        j                 f
d            Zed	e	j
        j        d
ededeeeef         fd            Zd Zd Zd ZdS )PsScanzAScans for processes present in a particular windows memory image.)         )r   r   r   c                 J   t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          t          j        dt          dd          t          j
        dddd          t          j
        dddd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionr   )r   r   r   )r   	componentr    pidz8Process ID to include (all other processes are excluded)T)r   element_typer   optionaldumpzExtract listed processesF)r   r   defaultr$   physicalz*Display physical offset instead of virtual)r   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   InfoListRequirementintBooleanRequirement)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/psscan.pyget_requirementszPsScan.get_requirements   s     *,()4  
 *fmY   +ty)   ( V	   +6	   +H	  1
 	
    c                     |j         |         }t          |t           j        j                  st	          d          t          |                    |j        j        d                    d         \  }}}}}|S )a  Calculate the physical offset from the virtual offset of a process.

        Args:
            context: The context containing layers and modules information.
            layer_name: The name of the layer containing the process memory.
            proc: The process object for which to calculate the physical offset.

        Returns:
            int: The physical offset of the process.
        Raises:
            TypeError: If the primary layer is not an Intel layer.
        #Primary layer is not an intel layerr   offsetlength)	r	   
isinstanceintelIntel	TypeErrorlistmappingvolr7   )r0   context
layer_nameprocmemory_	ph_offsets          r1   physical_offset_from_virtualz#PsScan.physical_offset_from_virtual>   sx     
+&&,"455 	CABBB"&NN$(/!N<<#
 #

#Ay!Q r3   NTFr@   rA   r7   r'   excludereturnc                 ^     d }r#|r|r	 fd}n fd}n|rfd}nfd}|S )ab  A factory for producing filter functions that filter based on the physical offset of the process.

        Args:
            offset: A number that is the physical offset to be filtered out
            exclude: Accept only tasks that are not the offset argument

        Returns:
            Filter function to be passed to the list of processes.
        c                     dS NF rD   s    r1   <lambda>z-PsScan.create_offset_filter.<locals>.<lambda>i   s     r3   c                 :                         |           k    S NrF   rB   r0   r@   rA   r7   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>o   (    S%E%E#Z& & "&" r3   c                 :                         |           k    S rP   rQ   rR   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>v   rS   r3   c                 $    | j         j        k    S rP   r?   r7   rB   r7   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>}       tx&/H r3   c                 $    | j         j        k    S rP   rV   rW   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>   rX   r3   rL   )r0   r@   rA   r7   r'   rG   filter_funcs   ````   r1   create_offset_filterzPsScan.create_offset_filterW   s    $ &o 	I I " " " " " " "  K" " " " " " "  K  I"H"H"H"HKK"H"H"H"HKr3   c                     dS rK   rL   rM   s    r1   rN   zPsScan.<lambda>   s    e r3   symbol_tablerZ   c              #      K   t           j                            |ddg          }t           j                            ||||          D ]}|\  }}}	 ||          s|V  dS )a  Scans for processes using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of processes found by scanning the `layer_name` layer for process pool signatures
        s   Pros   ProcN)r   PoolScannerbuiltin_constraintsgenerate_pool_scan)
r0   r@   rA   r]   rZ   constraintsresult_constraint
mem_object_headers
             r1   scan_processeszPsScan.scan_processes   s      * "-AA:w/
 
 "-@@Z{
 
 	! 	!F 06,KW;z** !    	! 	!r3   rB   c                    |                      |||          }|j        |         j        d         }|                    |||          }|                    d                              d          }|g}	|j        |         j        }
|dk    r|
dk    r|	                    |dz              |	D ]}|                    d|j	        j
        |z
  d	          }|                                }t          |j        |                             |j        j        d
                    d
         \  }}}}}|r|j        j        |k    r|c S dS )a  Returns a virtual process from a physical addressed one

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols
            proc: the process object with physical address

        Returns:
            A process object on virtual address layer

        kernel_virtual_offset)rA   r7   _ETHREADThreadListEntry)   r   i  @      T)object_typer7   absoluter   r6   N)get_osversionr	   configmoduleget_typerelative_child_offsetbits_per_registerappendobjectThreadListHeadFlinkowning_processr=   r>   r?   r7   )r0   r@   rA   r]   rB   r    kvontkrnlmp	tleoffsetoffsetsbitsofsethreadvirtual_processrD   rE   s                   r1   virtual_process_from_physicalz$PsScan.virtual_process_from_physical   s|   * ##GZFF nZ(/0GH>>,:c>RR%%j11GG
 
	 + ~j);l""trzzNN9q=)))  	' 	'Coo&*036 &  G &4466O '+z*22*.5a 3  ' ' 	'#Q9a
  '48?i#?#?&&&&tr3   c                     t           j                            |||          }t          |j                  }t          |j                  }t           j                            |||          }|j        }|||fS )an  Returns the complete OS version (MAJ,MIN,BUILD)

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A tuple with (MAJ,MIN,BUILD)
        )r   r,   get_kuser_structurer.   NtMajorVersionNtMinorVersionget_version_structureMinorVersion)	r0   r@   rA   r]   kusernt_major_versionnt_minor_versionversbuilds	            r1   rq   zPsScan.get_osversion   sn    " 	--gz<PPu344u344y..w
LQQ! "2E::r3   c              #     K   | j         j        | j        d                  }t          j                            | j         | j        ddt          j                  }| j         j	        |j
                 }t          |t          j        j                  st          d          |                     | j         |j
        |j        t"          j                            | j                            dd                               D ]}d}| j        d	         r||j        j
        |j
        k    r|}n'|                     | j         |j
        |j        |          }t"          j                            | j         |j        ||| j                  }d
}|r|j        }| j        d         s|j        j        }n:t7          |                    |j        j        d                    d         \  }	}	}}	}		 d|j        |j        |j                             d|j        j        j!        d          tE          j#        |          |j$        |%                                |&                                |'                                |(                                |)                                |ffV  # tT          j+        $ r- tX          -                    d|j        j        dd           Y w xY wd S )Nr   windowsr   )class_typesr5   r"   )rZ   Disabledr%   zError outputting filer'   r   r6   stringreplace)
max_lengtherrorsz"Invalid process found at address: xz
. Skipping).r@   modulesrr   r   IntermediateSymbolTablecreateconfig_pathr   r   r	   rA   r9   r:   r;   r<   rg   symbol_table_namer   r*   create_pid_filtergetr?   r   process_dumpopenpreferred_filenamer7   r=   r>   UniqueProcessIdInheritedFromUniqueProcessIdImageFileNamecastcountr   HexActiveThreadsget_handle_countget_session_idget_is_wow64get_create_timeget_exit_timer
   InvalidAddressExceptionvollogr   )
selfr   pe_table_namerC   rB   file_outputvprocfile_handler7   rD   s
             r1   
_generatorzPsScan._generator   s     %dk(&;< 8??L$*It @ 
 
 $V%67&&,"455 	CABBB''L$77t8T8TUU	 ( 
 
 :	 :	D %K{6" A8&&*;;; EE >>f&79QSW E %m88L,!I  6 A"-"@K;z* '+NN$(/!NDD( (($Avq!,9*//$'+'9'='C#, 0  
 %(00*--//++--))++,,..**,,#    ( 5   VVVVV    o:	 :	s   B6J8KKc              #      K   |                                  D ]]}|\  }}d|d          d|d          d|d          d}|t          j        j        |d         fV  |t          j        j        |d	         fV  ^d S )
Nz	Process: r    r   z (r   )rn   	   )r   r   TimeLinerTypeCREATEDMODIFIED)r   row_depthrow_datar   s        r1   generate_timelinezPsScan.generate_timeline=  s      ??$$ 	O 	OC"FHQhqkQQHQKQQ8A;QQQK	 7 ?!MMMM	 7 @(1+NNNNN		O 	Or3   c                 F   | j         d         sdnd}t          j        dt          fdt          fdt          fd| t
          j        fdt          fd	t          fd
t          fdt          fdt          j        fdt          j        fdt          fg| 	                                          S )Nr'   z(V)z(P)PIDPPIDr   OffsetThreadsHandles	SessionIdWow64
CreateTimeExitTimezFile output)
rr   r   TreeGridr.   strr   r   booldatetimer   )r   
offsettypes     r1   runz
PsScan.runD  s    "&+j"9DUUu
! #&&*&&(89C C c"$x01X./$ OO
 
 	
r3   )NTF)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr2   rF   r   r@   ContextInterfacer   r.   r   r   objectsObjectInterfacer[   r   rg   r   r   r   rq   r   r   r   rL   r3   r1   r   r      sT       KK"+H
 
 [
B   [0 
 ) )#4) ) 	)
 ) ) 
:%56<	=) ) ) [)V  O! !#4! ! 	!
 /0$6
! 
*$4	5! ! ! [!> :#4: : 	:
  0: 
*$4	5: : : [:x ;#4; ; 	;
 
sC}	; ; ; [;.C C CJO O O
 
 
 
 
r3   r   )!r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   volatility3.plugins.windowsr   r   r   	getLoggerr   r   pluginsPluginInterfaceTimeLinerInterfacer   rL   r3   r1   <module>r      sL  
   6 6 6 6 6 6 6 6 6 6 6 6 K K K K K K K K K K K K < < < < < < 8 8 8 8 8 8 2 2 2 2 2 2 ? ? ? ? ? ? ) ) ) ) ) ) , , , , , , 3 3 3 3 3 3 . . . . . .		8	$	$
 
 
 
 
Z/1M 
 
 
 
 
r3   