
    *1fz                         d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ  ej        e          Z G d de	j        j                  ZdS )	    N)CallableDictSetTuple)objects
interfaces	renderers
exceptions)requirements)format_hints)pslistc                        e Zd ZdZdZd fdZed             Zd fdej	        d	e
ej        j        gef         ddfd
Zd fd	e
ej        j        gef         fdZd Z xZS )PsTreezLPlugin for listing processes in a tree based on their parent process
    ID.   r   r   returnNc                      t                      j        |i | i | _        i | _        i | _        t          g           | _        d S )N)super__init__
_processes_levels	_childrenset
_ancestors)selfargskwargs	__class__s      ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/pstree.pyr   zPsTree.__init__   sE    $)&)))UW').0$'GG    c           	          t          j        ddddg          t          j        ddt          j        j        d	          t          j        d
t          j        d          t          j        dt          dd          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesphysicalz+Display physical offsets instead of virtualT)r%   r&   defaultoptionalr   r   )r%   	componentversionpidzXProcess ID to include (with ancestors and descendants, all other processes are excluded))r%   element_typer&   r*   )	r   ModuleRequirementBooleanRequirementr   PsListPHYSICAL_DEFAULTVersionRequirementListRequirementint)clss    r   get_requirementszPsTree.get_requirements   s     *,()4  
 +I6	   +	   ( v	  
 	
r    c                     dS NF _s    r   <lambda>zPsTree.<lambda>;       e r    r-   filter_funcc                    |h}d}| j                             |d          \  }} ||           }||j        |vr|r| j                            |j                   | j                            |j        t          g                     }|                    |j                   || j        |j        <   |                    |j                   | j                             |j        d          \  }}|dz  }|	|j        |v|| j        |<   dS )z0Finds how deep the pid is in the processes list.r   N)NN   )	r   getInheritedFromUniqueProcessIdr   addUniqueProcessIdr   r   r   )	r   r-   r?   seenlevelprocr<   filtered
child_lists	            r   
find_levelzPsTree.find_level6   s"    u/%%c400a"{4(((4#DD#P#P :##D$8999++D,MsSUwwWWJNN4/000@JDN4<=HHT6777o))1< GD! QJE 4#DD#P#P "Sr    c                     dS r9   r:   r;   s    r   r=   zPsTree.<lambda>S   r>   r    c              #      	
K    j         j         j        d                  }t          j                             j         |j        |j                  D ]} j                            dt          j        j	                  s|j
        j        }nS|j        } j         j        |         }t          |                    |j
        j        d                    d         \  }}}}}||f j        |j        <    j        D ]}                     |           t%          g           	d
dt&          f	 
fd
 j        D ]$} j        |         dk    r 
|          E d	{V  %d	S )z Generates the Tree of processes.r"   r(   r   )offsetlengthF
descendantc              3     K   | 	v rt                               d|             d S 	                    |            | 
j        vr"|s t                               d|  d           d S 
j        |          \  }}|j        |j        |j                            d|j        j	        j
        d          t          j        |          |j        |                                |                                |                                |                                |                                f
}	 |j        j        j        }||                                pt-          j                    fz  }n,# t0          j        $ r |t-          j                    fz  }Y nw xY w	 |                                j        }||j                                        |j                                        fz  }n># t0          j        $ r, |t-          j                    t-          j                    fz  }Y nw xY w
j        |          dz
  |fV  
j                             | g           D ] } ||p |                     E d {V  !d S )Nz!Pid cycle: already processed pid zPid cycle: pid z not in filtered treestringreplace)
max_lengtherrorsrA   )!vollogdebugrD   r   r   rE   rC   ImageFileNamecastvolcountr   HexActiveThreadsget_handle_countget_session_idget_is_wow64get_create_timeget_exit_timeSeAuditProcessCreationInfoName
get_stringr	   NotAvailableValuer
   InvalidAddressExceptionget_pebProcessParametersCommandLineImagePathNamer   r   rB   )r-   rP   rH   rN   rowauditprocess_params	child_pidr?   process_pidsr   yield_processess           r   rq   z*PsTree._generator.<locals>.yield_processesl   s     l""FFFGGGtS!!!$/))*)IsIIIJJJt?3/LD&$1"'');)?)Ei (    (("%%''##%%!!##$$&&""$$C87EJ((**Ki.I.K.KMM5 8 8 8	355778
!%!A".99;;"0;;==  5   /11/11  <$q(#....!^//R88  	*?zBT1B1B-B          s%   )<E& &&FFAG" "8HHrA   N)F)contextmodulesconfigr   r1   list_processes
layer_namesymbol_table_namerB   r2   rZ   rN   layerslistmappingr   rE   rK   r   boolr   )r   r?   r"   rH   rN   rv   memoryr<   r-   rp   rq   s   ``       @@r   
_generatorzPsTree._generatorO   s      %dk(&;<M00L&+V-E
 
 	A 	AD ;??:v}/MNN #.
,Z8'+NN$(/!NDD( (($Avq! 59&LDOD011 ? 	. 	.COOC----2ww2	 2	T 2	 2	 2	 2	 2	 2	 2	 2	 2	h < 	0 	0C|C A%%*?3/////////	0 	0r    c                    | j                             dt          j        j                  sdnd}t          j        dt          fdt          fdt          fd| t          j
        fdt          fd	t          fd
t          fdt          fdt          j        fdt          j        fdt          fdt          fdt          fg|                     t          j                            | j                             dd                                         S )Nr(   z(V)z(P)PIDPPIDrX   OffsetThreadsHandles	SessionIdWow64
CreateTimeExitTimeAuditCmdPathr-   )r?   )rt   rB   r   r1   r2   r	   TreeGridr5   strr   r\   r{   datetimer}   create_pid_filter)r   
offsettypes     r   runz
PsTree.run   s     ;??:v}/MNNEE 	 ! #&&*&&(89C C c"$x01X./# OO"M;;KOOE400    !
 
 	
r    )r   N)__name__
__module____qualname____doc___required_framework_versionr   classmethodr7   r   Pointerr   r   ObjectInterfacer{   rK   r}   r   __classcell__)r   s   @r   r   r      s         #,, , , , , , 
 
 [
: O" "_" /0$6
" 
" " " ": O	S0 S0/0$6
S0 S0 S0 S0j
 
 
 
 
 
 
r    r   )r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr   	getLoggerr   rV   pluginsPluginInterfacer   r:   r    r   <module>r      s      - - - - - - - - - - - - L L L L L L L L L L L L < < < < < < 8 8 8 8 8 8 . . . . . .		8	$	$p
 p
 p
 p
 p
Z/ p
 p
 p
 p
 p
r    