
    [
#gm                         d dl Z d dlZd dlmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ  e j"                  e      Z G d d	ej(                  j*                  ej,                        Zy)
    N)CallableIterable)	renderers
interfaces
exceptions)requirements)format_hints)poolscanner)	timelinerc                       e Zd ZdZdZdZ fdZed        Zede	j                  j                  dedee	j                  j                     fd	       Zed
        ZdefdZd Zede	j*                  j,                  defd       Zd Z xZS )ThrdScanzScans for windows threads.)      r   )   r   r   c                 F    t        |   |i | | j                  | _        y )N)super__init__scan_threadsimplementation)selfargskwargs	__class__s      `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/thrdscan.pyr   zThrdScan.__init__   s#    $)&)"//    c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr
   )r   r   r   )r    pluginversion)r   ModuleRequirementPluginRequirementr
   PoolScanner)clss    r   get_requirementszThrdScan.get_requirements   sG     **,()4
 **";+B+BI	
 		
r   contextmodule_namereturnc              #      K   |j                   |   }|j                  }|j                  }t        j                  j                  |ddg      }t        j                  j                  ||||      D ]  }|\  }}	}
|	  yw)ar  Scans for threads using the poolscanner module and constraints.

        Args:
            context: The context to retrieve required elements (layers, symbol tables) from
            module_name: Name of the module to use for scanning

        Returns:
              A list of _ETHREAD objects found by scanning memory for the "Thre" / "Thr\xE5" pool signatures
        s   Thrs   ThreN)modules
layer_namesymbol_table_namer
   r'   builtin_constraintsgenerate_pool_scan)r(   r*   r+   moduler/   symbol_tableconstraintsresult_constraint
mem_object_headers              r   r   zThrdScan.scan_threads)   s       -&&
//!--AA:w/
 "--@@Z{
F 06,KW	
s   A<A>c                    	 |j                   j                  }|j                  j                  }|j                  j                  }|j
                  }|j                         }|j                         }t        j                  |      ||t        j                  |      ||fS # t        j                  $ r; t        j                  dj                  |j                   j                               Y y w xY w)NzThread invalid address {:#x})voloffsetCidUniqueProcessUniqueThreadStartAddressget_create_timeget_exit_timer   InvalidAddressExceptionvollogdebugformatr	   Hex)r(   ethreadthread_offsetowner_proc_pid
thread_tidthread_start_addrthread_create_timethread_exit_times           r   gather_thread_infozThrdScan.gather_thread_infoG   s    	#KK..M$[[66N 11J ' 4 4'')  %%'  ]+./
 	
	 11 	LL7>>w{{?Q?QRS	s   A.B AC,+C,filter_funcc              #      K   | j                   d   }| j                  | j                  |      D ]  }| j                  |      }|sd|f  y w)Nr   r   )configr   r*   rO   )r   rP   kernel_namerH   infos        r   
_generatorzThrdScan._generatora   sL     kk(+**4<<EG**73D$i	 Fs   AA	Ac           	   #     K   | j                  | j                        }| j                  |      D ]  }|\  }}i }|\  |d<   |d<   |d<   |d<   |d<   |d<   t        |d   t        j                        sCd|d    d|d    d	|d    d
}|t
        j                  j                  |d   f t        |d   t        j                        s|t
        j                  j                  |d   f  y w)NOffsetPIDTIDr@   
CreateTimeExitTimezThread: Tid z in Pid z	 (Offset ))	rP   rR   rU   
isinstancedatetimer   TimeLinerTypeCREATEDMODIFIED)r   	filt_funcrow_depthrow_datarow_dictr!   s          r   generate_timelinezThrdScan.generate_timelinej   s    $$T[[1	??9-C"FHH "(&$
 h|4h6G6GH(%(9(5/ARR[\dem\n[oopqK 	 7 7 ? ?,AWXX(:.0A0AB++44Z( + .s   CC,%C,rR   c                     d S )zZReturns a function that can filter this plugin's implementation method based on the configc                      y)NF )xs    r   <lambda>z&ThrdScan.filter_func.<locals>.<lambda>   s    r   rj   )r(   rR   s     r   rP   zThrdScan.filter_func   s
     r   c           	      &   | j                  | j                        }t        j                  dt        j
                  fdt        fdt        fdt        j
                  fdt        j                  fdt        j                  fg| j                  |            S )NrW   rX   rY   r@   rZ   r[   )	rP   rR   r   TreeGridr	   rG   intr^   rU   )r   rb   s     r   runzThrdScan.run   s    $$T[[1	!!<++,!1!12x001X../ OOI&

 
	
r   )__name__
__module____qualname____doc___required_framework_version_versionr   classmethodr)   r   r*   ContextInterfacestrr   objectsObjectInterfacer   rO   r   rU   rg   configurationHierarchicalDictrP   rp   __classcell__)r   s   @r   r   r      s    $ #,H0 

 

 ##44  
*$$44	5	 : 
 
2 h  < !9!9!J!J x  
r   r   )loggingr^   typingr   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr   volatility3.framework.renderersr	   volatility3.plugins.windowsr
   volatility3.pluginsr   	getLoggerrq   rD   pluginsPluginInterfaceTimeLinerInterfacer   rj   r   r   <module>r      sV      % C C < 8 3 )			8	$I
z!!1193O3O I
r   