
    [
#g7                         d dl Z d dlmZmZmZmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZmZmZ  e j(                  e      Z G d d	ej.                  j0                        Zy)
    N)ListDictTuple	Generator)	renderers
interfaces)requirements)utility)format_hints)pslistthreadsvadinfothrdscanc                   l   e Zd ZdZdZdZedeej                  j                     fd       Zdej                  j                  deeeeeeeef      f   deeeeef   fdZd	eeeeeeeef      f   d
edeeeef   fdZdededeeeef   ddf   fdZdej                  j                  fdZd Zd Zy)SupsiciousThreadsz)Lists suspicious userland process threads)      r   r   r   r   returnc                    t        j                  ddddg      t        j                  ddt        d	      t        j                  d
t
        j                  d      t        j                  dt        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturespidzFilter on specific process IDsT)r   r   element_typeoptionalr   )   r   r   )r   pluginversionr   r   )r   	componentr"   )
r	   ModuleRequirementListRequirementintPluginRequirementr   ThreadsVersionRequirementr   VadInfo)clss    j/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/suspicious_threads.pyget_requirementsz"SupsiciousThreads.get_requirements   s|     **,()4
 ((< 	 **w	 ++'//9
 	
    r   
all_rangesc                    |j                   j                  }||vrg ||<   |j                         j                         D ]  }|j	                         }t        |t              r|sd}|j                  t        j                  j                  | j                  |j                  |j                        t        j                        }||   j                  |j!                         |j#                         ||f        ||   S )zn
        Maintains a hash table so each process' VADs
        are only enumerated once per plugin run
        N)voloffsetget_vad_roottraverseget_file_name
isinstancestrget_protectionr   r*   protect_valuescontext
layer_namesymbol_table_namewinnt_protectionsappend	get_startget_end)selfr   r/   prockeyvadfnprotection_strings           r,   _get_rangeszSupsiciousThreads._get_ranges-   s     hhooj  JsO((*335&&(!"c*"B$'$6$6OO22f&7&79Q9Q --	%! 3&&]]_ckkm5FK 6  #r.   rangesaddressc                 F    |D ]  \  }}}}||cxk  r|k  sn |||fc S  y)z
        Walks a process' VADs looking for the one
        containing `address`

        Returns its base address, protection string, and mapped file, if any
        )NNN )rA   rH   rI   startendrF   rE   s          r,   
_get_rangezSupsiciousThreads._get_rangeN   s8     28-E3)2%#%/33 28  r.   exe_paththread_addressNc              #     K   | j                  ||      \  }}}|y |d}|d|ddf |dk7  r|d|dd| f |rI|j                         j                  d      r)|j                         |j                         k7  r|d	f y y y y w)
Nz<Non-File Backed Region>zCThis thread started execution in the VAD starting at base address (z#xz ), which is not backed by a filePAGE_EXECUTE_WRITECOPYzVAD at base address (z<) hosting this thread has an unexpected starting protection z.exezyVAD at base address ({vad_base:#x}) hosting this thread maps an application executable that is not the process exectuable)rN   lowerendswith)rA   rO   rH   rP   vad_baseprotvad_paths          r,   _check_thread_addressz'SupsiciousThreads._check_thread_address]   s      $(??6>#J $ 1H UV^_aUb  cC  D  ++'}4pqupvw   ))&1!X^^%55  L  6 2 s   BB	c              #   H  K   t         j                  j                  | j                  j	                  dd             }t         j                  j                  | j                  |j                  |j                  |      D ]  }| j                  |||      }t        ||j                  j                           dk  r<|j                  }t        j                  |j                         }| j#                  ||j$                        \  }}	}
t'        |
t(              sd }
||||
|f  y w)Nr   )r:   r;   symbol_tablefilter_func   )r   PsListcreate_pid_filterconfiggetlist_processesr:   r;   r<   rG   lenr1   r2   UniqueProcessIdr
   array_to_stringImageFileNamerN   SectionBaseAddressr6   r7   )rA   r   r/   r[   rB   rH   r   	proc_name___rO   s              r,   _enumerate_processesz&SupsiciousThreads._enumerate_processes   s      mm55dkkooeT6RSMM00LL((11#	 1 
D %%fj$?F :dhhoo./!3&&C//0B0BCI"oofd6M6MNOAr8h,Y&88'
s   D D"c              #     K   | j                   j                  | j                  d      }i }| j                  ||      D ]  \  }}}}}t	               }t
        j                  j                  ||      D ]  }	|	j                  j                  dkD  s|	j                  j                  dk(  r6t        j                  j                  |	      }
|
sX|
\  }}}}}}|df|	j                  dfg}|D ]V  \  }}||v r|j!                  |       | j#                  |||      D ]%  \  }}d||||t%        j&                  |      ||ff ' X   y w)Nr   r   r   Start
Win32Start)r:   modulesr_   rj   setr   r(   list_threadsExitTimeQuadPartTcbStater   ThrdScangather_thread_infoWin32StartAddressaddrX   r   Hex)rA   r   r/   rB   r   rg   rO   rH   checkedthreadinforh   tidstart_address	addressesrI   r:   rW   notes                      r,   
_generatorzSupsiciousThreads._generator   sc    %%dkk(&;<
6:6O6OJ7
2D#y(F
 eG!//66vtD??++a/6::3C3Cq3H  ((;;FC15.1c=!Q #G,--|<	
 )2$GW') KK(*.*D*D &'+$  %#(,,W5$ "  + )2# E7
s   EEc           
          t        j                  dt        fdt        fdt        fdt        fdt        j
                  fdt        fdt        fg| j                               S )NProcessPIDTIDContextAddresszVAD PathNote)r   TreeGridr7   r&   r   ry   r   )rA   s    r,   runzSupsiciousThreads.run   sa    !!C C L,,-S! OO
 	
r.   )__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   configurationRequirementInterfacer-   r:   ModuleInterfacer   r&   r   r7   rG   rN   r   rX   rj   r   r   rK   r.   r,   r   r      s.   3"+H
j&>&>&S&S!T 
 
,""22 d5c3);#<==>
 
sCc!	"B 3U3S#+=%> ??@ KN 	sC}	 ""58"	5c?D$.	/"H9 ((8894-^
r.   r   )loggingtypingr   r   r   r   volatility3.frameworkr   r   #volatility3.framework.configurationr	   volatility3.framework.objectsr
   volatility3.framework.renderersr   volatility3.plugins.windowsr   r   r   r   	getLoggerr   vollogpluginsPluginInterfacer   rK   r.   r,   <module>r      sN   
  / / 7 < 1 8 J J			8	$F

**:: F
r.   