
    [
#g3                        d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ  ej4                  e      Z G d de	j:                  j<                  ej>                        Z y)    N)IterableCallableOptionalTuple)	renderers
interfaceslayers
exceptions)requirements)format_hints)intermed)pe)	timeliner)info)poolscanner)pslistc                      e Zd ZdZdZdZed        Zed        Ze	 	 	 dde	j                  j                  ded	ed
ededee	j                   j"                  gef   fd       Zed fde	j                  j                  dededee	j                   j"                  gef   dee	j                   j"                     f
d       Zede	j                  j                  dedede	j                   j"                  dee	j                   j"                     f
d       Zede	j                  j                  dededeeeef   fd       Zd Zd Zd Zy)PsScanzAScans for processes present in a particular windows memory image.)         )r   r   r   c                 d   t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        j                  d
      t        j                  dt        dd      t        j                  dddd      t        j                  dddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversionr   )r   r   r   )r   	componentr    pidz8Process ID to include (all other processes are excluded)T)r   element_typer   optionaldumpzExtract listed processesF)r   r   defaultr$   physicalz*Display physical offset instead of virtual)r   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   InfoListRequirementintBooleanRequirement)clss    ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/psscan.pyget_requirementszPsScan.get_requirements   s     **,()4
 **fmmY ++tyy) (( V	 ++6	 ++H	1
 	
    c                     |j                   |   }t        |t         j                  j                        st	        d      t        |j                  |j                  j                  d            d   \  }}}}}|S )a  Calculate the physical offset from the virtual offset of a process.

        Args:
            context: The context containing layers and modules information.
            layer_name: The name of the layer containing the process memory.
            proc: The process object for which to calculate the physical offset.

        Returns:
            int: The physical offset of the process.
        Raises:
            TypeError: If the primary layer is not an Intel layer.
        #Primary layer is not an intel layerr   offsetlength)	r	   
isinstanceintelIntel	TypeErrorlistmappingvolr7   )r0   context
layer_nameprocmemory_	ph_offsets          r1   physical_offset_from_virtualz#PsScan.physical_offset_from_virtual>   so     
+&&,,"4"45ABB"&NN$((//!N<#

#Ay!Q r3   Nr@   rA   r7   r'   excludereturnc                 d     d }r&|r|r
 fd}|S  fd}|S |rfd}|S fd}|S )ab  A factory for producing filter functions that filter based on the physical offset of the process.

        Args:
            offset: A number that is the physical offset to be filtered out
            exclude: Accept only tasks that are not the offset argument

        Returns:
            Filter function to be passed to the list of processes.
        c                      yNF rD   s    r1   <lambda>z-PsScan.create_offset_filter.<locals>.<lambda>i   s    r3   c                 0    j                  |       k(  S NrF   rB   r0   r@   rA   r7   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>o   !    S%E%E#Z& "&"r3   c                 0    j                  |       k7  S rP   rQ   rR   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>v   rS   r3   c                 6    | j                   j                  k(  S rP   r?   r7   rB   r7   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>}       txx&/Hr3   c                 6    | j                   j                  k7  S rP   rV   rW   s    r1   rN   z-PsScan.create_offset_filter.<locals>.<lambda>   rX   r3   rL   )r0   r@   rA   r7   r'   rG   filter_funcs   ````   r1   create_offset_filterzPsScan.create_offset_filterW   sW    $ &"  & "    "HK  #IKr3   c                      yrK   rL   rM   s    r1   rN   zPsScan.<lambda>   s    er3   symbol_tablerZ   c              #      K   t         j                  j                  |ddg      }t         j                  j                  ||||      D ]  }|\  }}}	 ||      r|  yw)a  Scans for processes using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A list of processes found by scanning the `layer_name` layer for process pool signatures
        s   Pros   ProcN)r   PoolScannerbuiltin_constraintsgenerate_pool_scan)
r0   r@   rA   r]   rZ   constraintsresult_constraint
mem_object_headers
             r1   scan_processeszPsScan.scan_processes   sj     * "--AA:w/
 "--@@Z{
F 06,KWz*  
s   AA A rB   c                    | j                  |||      }|j                  |   j                  d   }|j                  |||      }|j	                  d      j                  d      }|g}	|j                  |   j                  }
|dk(  r|
dk(  r|	j                  |dz          |	D ]  }|j                  d|j                  j                  |z
  d	      }|j                         }t        |j                  |   j                  |j                  j                  d
            d
   \  }}}}}|s|j                  j                  |k(  s|c S  y)a  Returns a virtual process from a physical addressed one

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols
            proc: the process object with physical address

        Returns:
            A process object on virtual address layer

        kernel_virtual_offset)rA   r7   _ETHREADThreadListEntry)   r   i  @      T)object_typer7   absoluter   r6   N)get_osversionr	   configmoduleget_typerelative_child_offsetbits_per_registerappendobjectThreadListHeadFlinkowning_processr=   r>   r?   r7   )r0   r@   rA   r]   rB   r    kvontkrnlmp	tleoffsetoffsetsbitsofsethreadvirtual_processrD   rE   s                   r1   virtual_process_from_physicalz$PsScan.virtual_process_from_physical   sY   * ##GZF nnZ(//0GH>>,:c>R%%j1GG
	 + ~~j);;l"trzNN9q=) Coo&**0036 & G &446O '+z*22*..55a 3 ' 	'#Q9a
 488??i#?&&# $ r3   c                     t         j                  j                  |||      }t        |j                        }t        |j
                        }t         j                  j                  |||      }|j                  }|||fS )an  Returns the complete OS version (MAJ,MIN,BUILD)

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
            A tuple with (MAJ,MIN,BUILD)
        )r   r,   get_kuser_structurer.   NtMajorVersionNtMinorVersionget_version_structureMinorVersion)	r0   r@   rA   r]   kusernt_major_versionnt_minor_versionversbuilds	            r1   rq   zPsScan.get_osversion   so    " 		--gz<Pu334u334yy..w
LQ!! "2E::r3   c              #     K   | j                   j                  | j                  d      }t        j                  j                  | j                   | j                  ddt        j                        }| j                   j                  |j                     }t        |t        j                  j                        st        d      | j                  | j                   |j                  |j                   t"        j$                  j'                  | j                  j)                  dd                   D ]  }d}| j                  d	   r|j*                  j                  |j                  k(  r|}n3	 | j-                  | j                   |j                  |j                   |      }d
}|rOt"        j$                  j3                  | j                   |j                   ||| j4                        }|r|j6                  }| j                  d   s|j*                  j8                  }n9t;        |j=                  |j*                  j8                  d            d   \  }	}	}}	}		 d|j>                  |j@                  |jB                  jE                  d|jB                  j*                  jF                  d      tI        jJ                  |      |jL                  |jO                         |jQ                         |jS                         |jU                         |jW                         |ff  y # t.        j0                  $ r d }Y w xY w# t.        jX                  $ r2 tZ        j]                  d|j*                  j8                  dd       Y Gw xY ww)Nr   windowsr   )class_typesr5   r"   )rZ   Disabledr%   zError outputting filer'   r   r6   stringreplace)
max_lengtherrorsz"Invalid process found at address: xz
. Skipping)/r@   modulesrr   r   IntermediateSymbolTablecreateconfig_pathr   r   r	   rA   r9   r:   r;   r<   rg   symbol_table_namer   r*   create_pid_filtergetr?   r   r
   PagedInvalidAddressExceptionprocess_dumpopenpreferred_filenamer7   r=   r>   UniqueProcessIdInheritedFromUniqueProcessIdImageFileNamecastcountr   HexActiveThreadsget_handle_countget_session_idget_is_wow64get_create_timeget_exit_timeInvalidAddressExceptionvollogr   )
selfr   pe_table_namerC   rB   file_outputvprocfile_handler7   rD   s
             r1   
_generatorzPsScan._generator   s    %%dkk(&;< 88??LL$**It @ 
 $$V%6%67&&,,"4"45ABB''LL$$77t8TU	 ( 
D %K{{6"88&&&*;*;; E% $ B B LL"--"44 	! 6"(--"<"<00%		#K #&1&D&D;;z*'+NN$((//!ND(($Avq!,,99**//$'+'9'9'='='C'C#, 0 
 %((0**--/++-))+,,.**,# W
& &BB % $%X 55 88K:VsQ   E$M6'2LB2M6CL.M6L+'M6*L++M6.AM3/M62M33M6c              #      K   | j                         D ]`  }|\  }}d|d    d|d    d|d    d}|t        j                  j                  |d   f |t        j                  j                  |d	   f b y w)
Nz	Process: r    r   z (r   )rn   	   )r   r   TimeLinerTypeCREATEDMODIFIED)r   row_depthrow_datar   s        r1   generate_timelinezPsScan.generate_timelineE  s     ??$C"FH%hqk]!HQK=8A;-qQK	 7 7 ? ?!MM	 7 7 @ @(1+NN	 %s   A5A7c                 L   | j                   d   sdnd}t        j                  dt        fdt        fdt        fd| t
        j                  fdt        fd	t        fd
t        fdt        fdt        j                  fdt        j                  fdt        fg| j                               S )Nr'   z(V)z(P)PIDPPIDr   OffsetThreadsHandles	SessionIdWow64
CreateTimeExitTimezFile output)
rr   r   TreeGridr.   strr   r   booldatetimer   )r   
offsettypes     r1   runz
PsScan.runL  s    "&++j"9Uu
!! #&*&(8(89C C c"$x001X../$ OO
 	
r3   )NTF)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr2   rF   r   r@   ContextInterfacer   r.   r   r   objectsObjectInterfacer[   r   rg   r   r   r   rq   r   r   r   rL   r3   r1   r   r      s	   K"+H
 
B  0 
 )##44) ) 	)
 ) ) 
:%%556<	=) )V  !##44! ! 	!
 //0$6
! 
*$$44	5! !> :##44: : 	:
   00: 
*$$44	5: :x ;##44; ; 	;
 
sC}	; ;.KZO
r3   r   )!r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.framework.symbolsr   0volatility3.framework.symbols.windows.extensionsr   volatility3.pluginsr   volatility3.plugins.windowsr   r   r   	getLoggerr   r   pluginsPluginInterfaceTimeLinerInterfacer   rL   r3   r1   <module>r      se   
   6 6 K K < 8 2 ? ) , 3 .			8	$G
Z//1M1M G
r3   