
    *1f                         d dl Z d dlZd dlmZ d dlmZmZmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ  e j        e          Z G d d	ej        j        ej                  ZdS )
    N)Iterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscanner)	timelinerc            
           e Zd ZdZdZdZed             Zedej	        j
        dededeej        j                 fd	            Zd
 Zd Zd ZdS )ThrdScanzScans for windows threads.)      r      r   r   c                 v    t          j        ddddg          t          j        dt          j        d          gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr	   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr	   PoolScanner)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/thrdscan.pyget_requirementszThrdScan.get_requirements   sR     *,()4  
 *";+BI  	
 		
    context
layer_namesymbol_tablereturnc              #      K   t           j                            |ddg          }t           j                            ||||          D ]}|\  }}}|V  dS )a  Scans for threads using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            layer_name: The name of the layer on which to operate
            symbol_table: The name of the table containing the kernel symbols

        Returns:
              A list of _ETHREAD objects found by scanning memory for the "Thre" / "Thr\xE5" pool signatures
        s   Thrs   ThreN)r	   r   builtin_constraintsgenerate_pool_scan)	r   r!   r"   r#   constraintsresult_constraint
mem_object_headers	            r   scan_threadszThrdScan.scan_threads%   s~      $ "-AA:w/
 
 "-@@Z{
 
 	 	F 06,KW		 	r    c           	   #   @  K   | j         j        | j        d                  }|                     | j         |j        |j                  D ]}	 |j        j        }|j        j	        }|j        j
        }|j        }|                                }|                                }nP# t          t          j        f$ r7 t"                              d                    |||j                             Y w xY wdt)          j        |          ||t)          j        |          ||ffV  d S )Nr   z*Thread :{}, invalid address {} in layer {}r   )r!   modulesconfigr-   r"   symbol_table_namevoloffsetCidUniqueProcessUniqueThreadStartAddressget_create_timeget_exit_time
ValueErrorr   InvalidAddressExceptionvollogdebugformatr   Hex)	selfr   ethreadthread_offsetowner_proc_pid
thread_tidthread_start_addrthread_create_timethread_exit_times	            r   
_generatorzThrdScan._generatorA   sY     %dk(&;<((L&+V-E
 
  	  	G ' 2!(!:$[5
$+$8!++-- # ))++ !  
 BC   @GG"$5v7H   
   $]33" $%677&$
 
 
 
 
- 	  	s   	ABA
C*)C*c           	   #     K   |                                  D ]}|\  }}i }|\  |d<   |d<   |d<   |d<   |d<   |d<   t          |d         t          j                  sEd|d          d|d          d	|d          d
}|t          j        j        |d         fV  t          |d         t          j                  r|t          j        j        |d         fV  d S )NOffsetPIDTIDr7   
CreateTimeExitTimezThread: Tid z in Pid z	 (Offset ))rH   
isinstancedatetimer
   TimeLinerTypeCREATEDMODIFIED)r@   row_depthrow_datarow_dictr   s         r   generate_timelinezThrdScan.generate_timelinef   s!     ??$$ 	 	C"FHH "(&$
 h|4h6GHH q%qq(5/qq\dem\nqqqK 	 7 ?,AWXXXX(:.0ABB +4Z(   +	 	r    c           	          t          j        dt          j        fdt          fdt          fdt          j        fdt
          j        fdt
          j        fg|                                           S )NrJ   rK   rL   r7   rM   rN   )r   TreeGridr   r?   intrQ   rH   )r@   s    r   runzThrdScan.run   se    !<+,!12x01X./ OO

 

 
	
r    N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr   r   r!   ContextInterfacestrr   objectsObjectInterfacer-   rH   rY   r]    r    r   r   r      s        $$ #,H

 

 [

 #4  	
 
*$4	5   [6# # #J  8
 
 
 
 
r    r   )loggingrQ   typingr   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr   volatility3.plugins.windowsr	   volatility3.pluginsr
   	getLoggerr^   r<   pluginsPluginInterfaceTimeLinerInterfacer   ri   r    r   <module>ru      s            C C C C C C C C C C < < < < < < 8 8 8 8 8 8 3 3 3 3 3 3 ) ) ) ) ) )		8	$	$|
 |
 |
 |
 |
z!193O |
 |
 |
 |
 |
r    