
    Xfs                         d dl Z d dlZd dlmZmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ  ej                  e      Z G d dej                   j"                  ej$                        Zy)	    N)	renderers
interfaces)requirements)utility)pslist)	timelinerc                   6    e Zd ZdZdZed        Zd Zd Zd Z	y)SessionszOlists Processes with Session information extracted from Environmental Variables   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j
                  d	t        d
d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionpidz9Process IDs to include (all other processes are excluded)T)r   element_typer   optional)r   ModuleRequirementPluginRequirementr   PsListListRequirementint)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/sessions.pyget_requirementszSessions.get_requirements   sa     **,()4
 **fmmY (( W	
 	
    c              #   ^  K   | j                   j                  | j                  d      }t        j                  j                  | j                  j                  dd             }i }t        j                  j                  | j                   |j                  |j                  |      D ]  }|j                         }t        j                         }d}d}|j                         D ]F  \  }	}
|	j                         dk(  r|
}n|	j                         dk(  r|
}|	j                         dk(  sE|
}H | d| }|dk(  rt        j                         }||j                  t!        j"                  |j$                        ||j'                         |d	}||v r||   j)                  |       |g||<    |j+                         D ]o  }|D ]h  }d
|j                  d      |j                  d      |j                  d      |j                  d      |j                  d      |j                  d      ff j q y w)Nr   r   )filter_func username
userdomainsessionname/)
session_id
process_idprocess_name	user_nameprocess_startsession_typer   r)   r.   r*   r+   r,   r-   )contextmodulesconfigr   r   create_pid_filtergetlist_processes
layer_namesymbol_table_nameget_session_idr   NotAvailableValueenvironment_variableslowerUniqueProcessIdr   array_to_stringImageFileNameget_create_timeappendvalues)selfr   r#   sessionsprocr)   r.   user_domainr,   varval	full_userrowrowss                 r   
_generatorzSessions._generator)   s    %%dkk(&;<mm55dkkooeT6RS MM00LL$$#	 1 
 *	-D ,,.J %668L KI 668 'S99;*, #IYY[L0"%K99;-/#&L' '-q4IC%779	 )"22 ' 7 78J8J K&!%!5!5!7 ,C X%$++C0(+u$U*	-Z OO% 		D GGL)GGN+GGL)GGN+GGK(GGO,  		s   D#H-&DH-c              #      K   | j                         D ]Q  }|\  }}t        |d   t              sd|d    d|d    d|d    }|t        j                  j
                  |d   f S y w)N   z	Process: r       z started by user    )rJ   
isinstancestrr   TimeLinerTypeCREATED)rA   rH   _depthrow_datar   s        r   generate_timelinezSessions.generate_timelineh   s~     ??$ 	RC"FH (1+s+ )(1+a}DUV^_`VaUbc"I$;$;$C$CXa[QQ	Rs
   ,A(9A(c           	          t        j                  dt        fdt        fdt        fdt        fdt        fdt        j                  fg| j                               S )Nz
Session IDzSession Typez
Process IDProcessz	User NamezCreate Time)r   TreeGridr   rQ   datetimerJ   )rA   s    r   runzSessions.runq   s\    !!s#%s#C c" 1 12 OO

 
	
r!   N)
__name__
__module____qualname____doc___required_framework_versionclassmethodr    rJ   rV   r[    r!   r   r
   r
      s.    Y"+
 
$=~R
r!   r
   )rZ   loggingvolatility3.frameworkr   r   #volatility3.framework.configurationr   volatility3.framework.objectsr   volatility3.plugins.windowsr   volatility3.pluginsr   	getLoggerr\   vollogpluginsPluginInterfaceTimeLinerInterfacer
   rb   r!   r   <module>rn      sP   
   7 < 1 . )			8	$k
z!!1193O3O k
r!   