
    [
#go!                         d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	 d dl
mZmZ d dlmZmZmZmZmZmZ  ej(                  e      Z G d dej.                        Zy)	    N)	constants
exceptions)plugins)requirements)format_hintsTreeGrid)handlesinfopslistpsscansessionsthrdscanc                       e Zd ZdZdZdZ eej                  ej                  z   dz   dz         Z
ed        Zd Zd Zd	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zy)PsXViewa  Lists all processes found via four of the methods described in "The Art of Memory Forensics," which may help
    identify processes that are trying to hide themselves. I recommend using -r pretty if you are looking at this
    plugin's output in a terminal.   r   r      r   r   . c                    t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      t        j                  dt        j                  d      t        j                  dt        j                  d      t        j                  dt        j                  d      t        j                  ddd      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   r   )r   	componentversionr   r   r   r   r	   physical-offsetsz@List processes with physical offsets instead of virtual offsets.T)r   r   optional)r   ModuleRequirementVersionRequirementr
   Infor   PsListr   PsScanr   ThrdScanr	   HandlesBooleanRequirement)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/psxview.pyget_requirementszPsXView.get_requirements'   s     **,()4
 ++tyy) ++	 ++	 ++8+<+<i ++'//9 ++'^+
 	
    c                 z    |j                   j                  d|j                   j                  j                  d      S )Nstringreplace)
max_lengtherrors)ImageFileNamecastvolcount)selfprocs     r+   _proc_name_to_stringzPsXView._proc_name_to_stringE   s9    !!&&!3!3!7!7!=!=i ' 
 	
r-   c                 2    |D ]  }|| j                   vs y y)NFT)valid_proc_name_chars)r7   strcs      r+   _is_valid_proc_namezPsXView._is_valid_proc_nameJ   s"    A222  r-   c                     |D cg c]4  }|j                         r"| j                  | j                  |            r|6 c}S c c}w N)is_validr>   r9   )r7   	proc_listps      r+   _filter_garbage_procszPsXView._filter_garbage_procsP   sF     
zz| 8 89R9RST9U V 
 	
 
s   9Ac                 l   | j                   d   s|S | j                  j                  | j                   d      }|j                  }	 t	        | j                  j
                  |   j                  |d            d   \  }}}}}|S # t        j                  $ r t        j                  d|d       Y |S w xY w)Nr    r   r   )offsetlengthz Page fault: unable to translate 0x)configcontextmodules
layer_namelistlayersmappingr   PagedInvalidAddressExceptionvollogdebug)r7   rF   r   rL   _original_offset_original_length_length_layer_names           r+   _translate_offsetzPsXView._translate_offsetW   s    {{-.M%%dkk(&;<&&
	IOS##J/77va7PPPL.  66 	ILL;F2;GH	Is   <B ,B32B3c                     | j                  |      }|D ci c](  }| j                  |j                  j                        |* c}S c c}w r@   )rD   rW   r5   rF   )r7   tasksr8   s      r+   _proc_list_to_dictzPsXView._proc_list_to_dictg   s>    **51JOP$&&txx7=PPPs   -Ac                 $    | j                  |      S r@   )rZ   )r7   rY   s     r+   _check_pslistzPsXView._check_pslistk   s    &&u--r-   c                 |    t         j                  j                  | j                  ||      }| j	                  |      S )NrJ   rL   symbol_table)r   r&   scan_processesrJ   rZ   )r7   rL   r_   ress       r+   _check_psscanzPsXView._check_psscann   s9    mm**LLZl + 
 &&s++r-   c                 X   g }t         j                  j                  | j                  d      D ]7  }d }	 |j	                         }|j                         s'|j                  |       9 | j                  |      S # t        $ r' t        j                  t        j                  d       Y zw xY w)Nr   )module_namez,Unable to find the owning process of ethread)r   r'   scan_threadsrJ   owning_processrA   appendAttributeErrorrQ   logr   LOGLEVEL_VVVrZ   )r7   retethreadprocesss       r+   _check_thrdscanzPsXView._check_thrdscanu   s    ((55LLh 6 
G G
!002'')

7#
  &&s++ " 

**Bs    A9A99-B)(B)c           	      d   g }|D ]  }| j                  |      }|dk(  s	 |j                  d      rt        j                  | j                  | j
                        }t        |j                  |j                              }|D ]\  }	|	j                  |j                  | j                  ||            dk(  s3|j                  |	j                  j                  d             ^  | j'                  |      S # t        j                  $ r( t        j!                  t"        j$                  d       Y )w xY w)Nz	csrss.exeObjectTable)rJ   config_pathProcess	_EPROCESSz#Cannot access eprocess object table)r9   
has_memberr	   r(   rJ   rq   rM   rp   get_object_typeget_type_maprg   Bodyr4   r   InvalidAddressExceptionrQ   ri   r   rj   rZ   )
r7   rY   rL   r_   rk   rC   r   handles_pluginhndlshs
             r+   _check_csrss_handleszPsXView._check_csrss_handles   s   A,,Q/D{"||M2)0$(LLd>N>N* !%^%;%;AMM%J K!&A ! 1 1$2$?$?(,j,%&!"
 $-!- !$

166;;{+C D "' 2 &&s++ "99 JJ!..0Us   BC45,C447D/.D/c           
   #     K   | j                   j                  | j                  d      }|j                  }|j                  }t        t        j                  j                  | j                   ||            }i }| j                  |      |d<   | j                  ||      |d<   | j                         |d<   | j                  |||      |d<   |D cg c]  }t        ||   j                                 }}t        |g       }t        |      }|D ]  }d }	|D 
ci c]  }
|
d }}
|D ]  }|||   v sd||<   |	r||   |   }	 |	j                   }| j#                  |	      }|	j%                         }t'        |      t(        j(                  k7  rd	}nt+        |      }d
t-        j.                  |      |||d   |d   |d   |d   |ff  y c c}w c c}
w w)Nr   r^   r   r   r   csrssFT r   )rJ   rK   rI   rL   symbol_table_namerM   r   r%   list_processesr\   rb   rn   r|   keyssumsetUniqueProcessIdr9   get_exit_timetypedatetimer<   r   Hex)r7   r   rL   r_   kdbg_list_processes	processessourceoffsetsrF   r8   src
in_sourcespidr   	exit_times                  r+   
_generatorzPsXView._generator   s    %%dkk(&;<&&
//"MM((, ) 
 	"001DE	("00\J	( $ 4 4 6	*!66\
	' AJJf4	&)..01JJ gr" g,FD09:#u*:J:#Yv..)-Jv&(08	 $ &&C,,T2D**,II("3"33		N	  $$V,x(x(z*w'	 )  K ;s+   CG#G1$G
GG.G6BGc                     | j                   d   rdnd}d|z   }t        |t        j                  fdt        fdt
        fdt        fdt        fd	t        fd
t        fdt        fg| j                               S )Nr    z
(Physical)z	(Virtual)OffsetNamePIDr   r   r   r~   z	Exit Time)rI   r   r   r   r<   intboolr   )r7   offset_type
offset_strs      r+   runzPsXView.run   s    &*kk2D&El;+
\--.4 4 T"$c"	 OO
 	
r-   N)__name__
__module____qualname____doc___required_framework_version_versionr   r/   ascii_lowercaseascii_uppercaser;   classmethodr,   r9   r>   rD   rW   rZ   r\   rb   rn   r|   r   r    r-   r+   r   r      s    & #,H!7!77#=C 
 
:


 Q.,,*,<AF
r-   r   )r   loggingr/   volatility3.frameworkr   r    volatility3.framework.interfacesr   #volatility3.framework.configurationr   volatility3.framework.renderersr   r   volatility3.plugins.windowsr	   r
   r   r   r   r   	getLoggerr   rQ   PluginInterfacer   r   r-   r+   <module>r      sI        7 4 < B  
		8	$h
g%% h
r-   