
    *1fz                         d dl Z d dlZd dlmZmZmZmZ d dlmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ  ej$                  e      Z G d de	j*                  j,                        Zy)	    N)CallableDictSetTuple)objects
interfaces	renderers
exceptions)requirements)format_hints)pslistc                        e Zd ZdZdZd fdZed        Zd fdej                  d	e
ej                  j                  gef   ddfd
Zd fd	e
ej                  j                  gef   fdZd Z xZS )PsTreezLPlugin for listing processes in a tree based on their parent process
    ID.   r   r   returnNc                 n    t        |   |i | i | _        i | _        i | _        t        g       | _        y )N)super__init__
_processes_levels	_childrenset
_ancestors)selfargskwargs	__class__s      ^/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/pstree.pyr   zPsTree.__init__   s5    $)&)UW').0$'G    c           	         t        j                  ddddg      t        j                  ddt        j                  j
                  d	      t        j                  d
t        j                  d      t        j                  dt        dd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesphysicalz+Display physical offsets instead of virtualT)r%   r&   defaultoptionalr   r   )r%   	componentversionpidzXProcess ID to include (with ancestors and descendants, all other processes are excluded))r%   element_typer&   r*   )	r   ModuleRequirementBooleanRequirementr   PsListPHYSICAL_DEFAULTVersionRequirementListRequirementint)clss    r   get_requirementszPsTree.get_requirements   s     **,()4
 ++I66	 ++	 (( v	
 	
r    c                      yNF _s    r   <lambda>zPsTree.<lambda>;       r    r-   filter_funcc                 d   |h}d}| j                   j                  |d      \  }} ||       }||j                  |vr|r%| j                  j	                  |j
                         | j                  j                  |j                  t        g             }|j	                  |j
                         || j                  |j                  <   |j	                  |j                         | j                   j                  |j                  d      \  }}|dz  }||j                  |vr|| j                  |<   y)z0Finds how deep the pid is in the processes list.r   N)NN   )	r   getInheritedFromUniqueProcessIdr   addUniqueProcessIdr   r   r   )	r   r-   r?   seenlevelprocr<   filtered
child_lists	            r   
find_levelzPsTree.find_level6   s    u//%%c40a"4((4#D#DD#P##D$8$89++D,M,MsSUwWJNN4//0@JDNN4<<=HHT667oo))11<GD! QJE 4#D#DD#P "Sr    c                      yr9   r:   r;   s    r   r=   zPsTree.<lambda>S   r>   r    c              #   X   	
K    j                   j                   j                  d      }t        j                  j                   j                   |j                  |j                        D ]  } j                  j                  dt        j                  j                        s|j                  j                  }n^|j                  } j                   j                  |   }t        |j                  |j                  j                  d            d   \  }}}}}||f j                  |j                   <     j                  D ]  } j#                  |        t%        g       	d	dt&        f	 
fd
 j(                  D ]%  } j(                  |   dk(  s 
|      E d{    ' y7 w)
z Generates the Tree of processes.r"   r(   r   )offsetlength
descendantc              3   *  K   | 	v rt         j                  d|         y 	j                  |        | 
j                  vr|st         j                  d|  d       y 
j                  |    \  }}|j
                  |j                  |j                  j                  d|j                  j                  j                  d      t        j                  |      |j                  |j                         |j                         |j!                         |j#                         |j%                         f
}	 |j&                  j                  j(                  }||j+                         xs t-        j.                         fz  }	 |j5                         j6                  }||j8                  j+                         |j:                  j+                         fz  }
j<                  |    dz
  |f 
j>                  jA                  | g       D ]  } ||xs	  |             E d {      y # t0        j2                  $ r |t-        j.                         fz  }Y w xY w# t0        j2                  $ r. |t-        j.                         t-        j.                         fz  }Y w xY w7 |w)Nz!Pid cycle: already processed pid zPid cycle: pid z not in filtered treestringreplace)
max_lengtherrorsrA   )!vollogdebugrD   r   r   rE   rC   ImageFileNamecastvolcountr   HexActiveThreadsget_handle_countget_session_idget_is_wow64get_create_timeget_exit_timeSeAuditProcessCreationInfoName
get_stringr	   NotAvailableValuer
   InvalidAddressExceptionget_pebProcessParametersCommandLineImagePathNamer   r   rB   )r-   rP   rH   rN   rowauditprocess_params	child_pidr?   process_pidsr   yield_processess           r   rq   z*PsTree._generator.<locals>.yield_processesl   sd    l"@FGS!$//)*se3HIJ??3/LD&$$11""''););)?)?)E)Ei (    (""%%'##%!!#$$&""$C877EEJJ((*Ki.I.I.KMM
!%!A!A"..99;"00;;=  <<$q(#..!^^//R8 	*zBT1B-B  ! 55 8	335778 55 //1//1 sW   D(J,A
H 7AI AJJJ+I
J	I

J>JJJJrA   N)F)contextmodulesconfigr   r1   list_processes
layer_namesymbol_table_namerB   r2   rZ   rN   layerslistmappingr   rE   rK   r   boolr   )r   r?   r"   rH   rN   rv   memoryr<   r-   rp   rq   s   ``       @@r   
_generatorzPsTree._generatorO   sm     %%dkk(&;<MM00LL&++V-E-E
 	AD ;;??:v}}/M/MN#..
,,Z8'+NN$((//!ND(($Avq! 59&LDOOD001	A ?? 	.COOC-	. 2w2	T 2	 2	h << 	0C||C A%*3///	0/s   FF*F* F(!F*c                 $   | j                   j                  dt        j                  j                        sdnd}t        j                  dt        fdt        fdt        fd| t        j                  fdt        fd	t        fd
t        fdt        fdt        j                  fdt        j                  fdt        fdt        fdt        fg| j                  t        j                  j                  | j                   j                  dd                         S )Nr(   z(V)z(P)PIDPPIDrX   OffsetThreadsHandles	SessionIdWow64
CreateTimeExitTimeAuditCmdPathr-   )r?   )rt   rB   r   r1   r2   r	   TreeGridr5   strr   r\   r{   datetimer}   create_pid_filter)r   
offsettypes     r   runz
PsTree.run   s     ;;??:v}}/M/MN  	 !! #&*&(8(89C C c"$x001X../# OO"MM;;KKOOE40  !
 	
r    )r   N)__name__
__module____qualname____doc___required_framework_versionr   classmethodr7   r   Pointerr   r   ObjectInterfacer{   rK   r}   r   __classcell__)r   s   @r   r   r      s     #,, 
 
: "__" //0$6
" 
": 	S0//0$6
S0j
r    r   )r   loggingtypingr   r   r   r   volatility3.frameworkr   r   r	   r
   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr   	getLoggerr   rV   pluginsPluginInterfacer   r:   r    r   <module>r      sN      - - L L < 8 .			8	$p
Z// p
r    