
    Xfs                         d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ  ej        e          Z G d dej        j        ej                  ZdS )	    N)	renderers
interfaces)requirements)utility)pslist)	timelinerc                   >    e Zd ZdZdZed             Zd Zd Zd Z	dS )SessionszOlists Processes with Session information extracted from Environmental Variables   r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t          d
d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/sessions.pyget_requirementszSessions.get_requirements   st     *,()4  
 *fmY   ( W	  
 	
    c              #   ~  K   | j         j        | j        d                  }t          j                            | j                            dd                     }i }t          j                            | j         |j        |j	        |          D ]}|
                                }t          j                    }d}d}|                                D ]T\  }	}
|	                                dk    r|
}n|	                                dk    r|
}|	                                dk    r|
}U| d| }|dk    rt          j                    }||j        t!          j        |j                  ||                                |d	}||v r||                             |           |g||<   |                                D ]}|D ]}d
|                    d          |                    d          |                    d          |                    d          |                    d          |                    d          ffV  d S )Nr   r   )filter_func username
userdomainsessionname/)
session_id
process_idprocess_name	user_nameprocess_startsession_typer   r)   r.   r*   r+   r,   r-   )contextmodulesconfigr   r   create_pid_filtergetlist_processes
layer_namesymbol_table_nameget_session_idr   NotAvailableValueenvironment_variableslowerUniqueProcessIdr   array_to_stringImageFileNameget_create_timeappendvalues)selfr   r#   sessionsprocr)   r.   user_domainr,   varval	full_userrowrowss                 r   
_generatorzSessions._generator)   sr     %dk(&;<m55dkooeT6R6RSS M00L$#	 1 
 
 *	- *	-D ,,..J %688L KI 6688 ' 'S99;;*,, #IIYY[[L00"%K99;;-//#&L '4444IC%799	 )"2 ' 78J K K&!%!5!5!7!7 , C X%%$++C0000(+u$$ OO%% 		 		D  GGL))GGN++GGL))GGN++GGK((GGO,,     		 		r!   c              #      K   |                                  D ][}|\  }}t          |d         t                    r9d|d          d|d          d|d          }|t          j        j        |d         fV  \d S )N   z	Process: r       z started by user    )rJ   
isinstancestrr   TimeLinerTypeCREATED)rA   rH   _depthrow_datar   s        r   generate_timelinezSessions.generate_timelineh   s      ??$$ 	R 	RC"FH (1+s++ Rc(1+ccccV^_`Vacc"I$;$CXa[QQQQ	R 	Rr!   c           	          t          j        dt          fdt          fdt          fdt          fdt          fdt          j        fg|                                           S )Nz
Session IDzSession Typez
Process IDProcessz	User NamezCreate Time)r   TreeGridr   rQ   datetimerJ   )rA   s    r   runzSessions.runq   s^    !s#%s#C c" 12 OO

 

 
	
r!   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr    rJ   rV   r[    r!   r   r
   r
      sj        YY"+
 
 [
$= = =~R R R
 
 
 
 
r!   r
   )rZ   loggingvolatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.plugins.windowsr   volatility3.pluginsr   	getLoggerr\   vollogpluginsPluginInterfaceTimeLinerInterfacer
   rb   r!   r   <module>rn      s   
   7 7 7 7 7 7 7 7 < < < < < < 1 1 1 1 1 1 . . . . . . ) ) ) ) ) )		8	$	$k
 k
 k
 k
 k
z!193O k
 k
 k
 k
 k
r!   